- All resources
- AML Obligations and Client Due Diligence
Compliance
AML Obligations and Client Due Diligence
Client due diligence is where a firm concentrates most of its compliance risk, because the file either shows what was checked, when, and who approved it, or it does not. This pillar covers the obligations themselves: how UK and UAE firms tier client risk, what sanctions and PEP screening actually involves and where it comes from, what source of funds evidence should look like, and how often a file has to be revisited. It is worth being precise about where Accupe sits in that picture. Accupe captures and reviews identity and ID documents, files the evidence against the client and the named director, tracks expiry and review dates, and records every action in an append-only audit log. It does not run sanctions, PEP or adverse-media screening, and it is not a substitute for your AML obligations. Keep your screening provider and let Accupe hold the evidence and the deadlines.
Articles in this pillar.
The 14 closest matches from 25 articles on aml obligations and client due diligence, most relevant first.
UK AML Supervision for Accounting Firms: A Practical Handbook
AML supervision for UK accountancy firms under MLR 2017: choosing a supervisor, the four written documents you must hold, the MLRO role and CDD by risk tier.
Why it is here. The full supervisory picture: who supervises whom, and what each supervisor expects to see.
PEP and Sanctions Screening Under MLR 2017
What PEP, sanctions and adverse media screening involves under MLR 2017: what the data covers, what a hit means, ongoing monitoring and the audit trail.
Why it is here. How screening works and where it sits in onboarding. The screening itself belongs to your provider, not to Accupe.
CDD vs EDD vs SDD: a decision tree that works in real onboarding
A working decision tree for applying customer due diligence, enhanced due diligence and simplified due diligence under MLR 2017 during client onboarding.
Why it is here. A decision tree for choosing the level of due diligence, with the reasoning you have to record either way.
Suspicious Activity Reports (SARs): when to submit and how to write one
When to submit a SAR under POCA 2002 and how to write one the NCA can act on: the suspicion threshold, internal reporting, DAML consent and tipping off.
Why it is here. The reporting mechanics, including how to write a report that is actually usable.
Best AML/KYC Compliance Software for UK Firms (2025)
Compare AML and KYC compliance software for UK firms, from identity verification to audit-ready records, and see why integrated compliance beats bolt-ons.
Why it is here. A market view, useful when you are separating the screening layer from the evidence layer.
Onfido vs Veriff vs Persona for ID Verification in KYC 2026
Onfido, Veriff and Persona compared for identity verification in UK KYC work: where each fits, how they pair with practice software, and pricing patterns.
Why it is here. A comparison of identity verification providers, one layer below the compliance workflow.
The MLRO annual report: what to actually put in it (2026)
What to put in the MLRO annual report under MLR 2017: risk assessment refresh, CDD outcomes, internal and external SARs, training, and a working structure.
Why it is here. What belongs in the annual report, which is one of the first documents an inspection asks for.
AML risk assessment templates that survive a regulator review
How to structure firm-wide and client-level AML risk assessments under MLR 2017 so they actually withstand scrutiny from HMRC and the accountancy supervisors.
Why it is here. Risk assessment structure, and the sections that reviewers consistently find missing.
The Accupe Compliance Radar: Never Miss an AML or KYC Deadline
Turn terrifying regulatory risk into a calm, automated dashboard. Look closer at how Accupe's integrated Compliance Radar protects your firm.
Why it is here. Product detail on the deadline and evidence tracking side, if you want the mechanics.
The HMRC AML supervision visit: what they actually ask for
A walkthrough of what HMRC AML supervision visits look like in 2026, what evidence they sample, and the findings that most often appear in their letters.
Why it is here. A walkthrough of an actual supervisory visit, request by request.
PEP screening cadence: daily, monthly, or event-driven?
How often should a UK firm re-screen its client book: daily, monthly or event-driven? How to calibrate cadence to risk, document the decision and defend it.
Why it is here. How often to re-screen, and why the answer depends on the client rather than the calendar.
Source of funds vs source of wealth: the distinction examiners care about
Source of funds and source of wealth are not the same thing, and supervisors test the difference. How to evidence each without drowning your file in PDFs.
Why it is here. The distinction above, expanded, with worked examples of evidence that satisfies a reviewer.
ECCTA 2023 director identity verification: what changes for accountants in 2026
A practical guide for UK practices on ECCTA director ID verification, the ACSP route, transition deadlines and how to operationalise it across your client base.
Why it is here. Where UK company law reform intersects with your due diligence file.
7 industries where AML risk is materially higher
Seven sectors where UK accounting firms should expect to run enhanced due diligence, what to look for in each, and how to build the risk into onboarding.
Why it is here. Sector risk factors worth building into your firm-wide risk assessment.
The fundamentals.
What every firm should have straight on this topic, whether or not it ever uses Accupe.
The risk-based approach
Tier every client as simplified, standard or enhanced, and write down why. That rating is what justifies the depth of everything else on the file.
Identity and document verification
Collect ID and proof of address, put them through a review queue rather than an inbox, and record who approved what and when.
Sanctions and PEP screening
Checking a name against OFSI, OFAC, UN and EU lists is specialist work, and Accupe does not do it. Use a dedicated screening provider, then file its output with the rest of the client evidence.
Adverse media and periodic review
Negative news checks, and re-screening at a frequency set by risk, belong to your screening provider. What a reviewer asks you for later is the date of the last one and what it found.
Source of funds and wealth
Identity answers who somebody is, not where the money came from. Bank statements, sale contracts and dividend records belong on the client record, not in a partner mailbox.
Evidence you can produce years later
A file passes review when it can be reconstructed: the document, the reviewer, the timestamp and the decision, in an order nobody can quietly rewrite.
What your AML obligations actually require.
An accountancy practice is a regulated business, not a bystander. In the UK that comes from the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002; in the UAE it comes from the federal AML framework that treats accountants, auditors and corporate service providers as designated non-financial businesses and professions. The obligations are broadly the same shape in both places, and so are the ways firms fall short of them.
The obligations, in the order a supervisor checks them
Most firms think of AML as client due diligence. Due diligence is only one of six obligations, and it is not the one an inspection usually opens with. A supervisor starts at the top of the firm and works down, because a good client file produced by a firm with no written risk assessment is an accident rather than a control.
A UK practice is supervised either by HMRC or by a professional body such as ICAEW, ACCA, ICAS, AAT or CIOT. A UAE practice registers with its supervisory authority and on the goAML platform. Either way the questions are the same, and they run in this sequence.
- A written firm-wide risk assessment covering your clients, the services you sell, the countries you deal with, how you deliver the work and how you take payment. It has to be a document, reviewed and dated, not an understanding
- Written policies, controls and procedures that follow from that assessment, approved at the top of the firm
- A nominated officer, in most firms the MLRO, with the authority and the time to do the job, plus a deputy for when they are away
- Training that is recorded, repeated, and relevant to the work the person actually does
- Client due diligence proportionate to risk, applied before the business relationship starts and refreshed on a schedule
- Records kept for five years from the end of the relationship or the transaction, and retrievable without undue delay rather than merely stored somewhere
Risk tiering is the decision everything else hangs off
The risk-based approach is often read as permission to do less. It is really an obligation to write down why. A standard-risk rating with no reasoning behind it is the weakest point in most files, because it justifies the depth of every check that follows and cannot be defended after the fact.
Rate against the same factor set every time, so ratings are comparable across the firm and across reviewers. Five factors cover most of it, and any one of them can pull a client up a tier on its own.
| Factor | What raises the rating | What a reviewer looks for |
|---|---|---|
| Customer | Opaque ownership, nominee arrangements, a PEP or a close associate, reluctance to provide documents | A written note explaining the structure, not just a chart |
| Service | Company formation, trust and company services, holding client money, tax structuring advice | The rating changes when the service mix changes, not only at onboarding |
| Geography | Ownership, operations or funds connected to higher-risk jurisdictions | A named source for the country risk view, applied consistently |
| Delivery channel | Wholly non face-to-face onboarding, introduced business, intermediaries | Compensating checks where nobody has met the client |
| Funds and payment | Cash, third-party payers, crypto assets, funds routed through unrelated entities | Evidence of where the money came from, not just who paid |
Screening is a firm obligation. It is not something Accupe does
Checking clients and beneficial owners against sanctions lists is a legal obligation in its own right, separate from the money laundering regulations, and it applies to every business rather than only regulated ones. UK firms screen against the consolidated list of financial sanctions targets maintained by OFSI, and UAE firms are required to screen against the local terrorist list and the UN Consolidated List. PEP status and adverse media are handled alongside it, usually by the same provider.
Accupe does not do any of this. It runs no sanctions, PEP, adverse-media or watchlist screening, it does not monitor your clients against any list, and there is no button in the product that would. Keep a dedicated screening provider, run the checks your risk assessment calls for, and file the output as evidence against the client and the named individual it covers, with the date it was run and who reviewed it. That evidence, its expiry and its audit trail are what Accupe holds.
A working test for the file: could you show a reviewer the date of the last screening, what it returned, who looked at it, and what they concluded, without asking your provider to re-run anything? If not, the gap is in the filing, not in the screening.
Beneficial ownership, and the place most files are thin
Identifying the beneficial owner is where due diligence stops being administrative. The usual threshold is ownership or control of more than 25 percent, but the test is control rather than arithmetic, so a person with a controlling interest through a shareholders’ agreement counts even if their shareholding does not reach the threshold.
Where no beneficial owner can be identified after exhausting all reasonable means, the senior managing official can be treated as the beneficial owner, and the fact that you exhausted those means has to be recorded. Treating that fallback as the default, rather than the exception it is, is one of the most commonly criticised shortcuts in a supervisory review.
UK firms carry one extra duty here that is easy to miss: where the beneficial ownership you have verified does not match what the register shows, the discrepancy has to be reported to Companies House. Firms that pull officers and PSCs onto the client record spot these; firms that read the register once at onboarding do not.
Source of funds is not source of wealth
These are treated as synonyms in conversation and as different things in a review. Source of funds is where the money used in this transaction came from: the account it left, and the activity that put it there. Source of wealth is how the client accumulated their assets overall. Enhanced due diligence usually needs both, and a bank statement showing a balance answers neither on its own.
What satisfies a reviewer is corroboration rather than assertion. A sale contract, completion statement, dividend vouchers, a set of filed accounts, a probate document, a payslip series: something independent of the client that supports the story they told you, filed against the client record rather than left in a mailbox.
Ongoing monitoring, and what actually triggers a review
Due diligence is not an onboarding event. The obligation is continuous, which means both scrutiny of the work as it passes through the firm and keeping the underlying information current. Most firms set a periodic review cadence by risk tier, and that is sensible, but calendar reviews alone will always be behind events.
Trigger-based reviews are what close the gap: a change of director or PSC, a change of ownership, a new service that carries a different risk profile, a payment from a party you have not seen before, a request that does not fit the client you thought you had. A change to the officer list is worth treating as an automatic prompt to refresh the file, because it is both a common trigger and a visible one.
Suspicion, reporting and tipping off
If knowledge or suspicion of money laundering arises, the individual reports internally to the nominated officer, and the nominated officer decides whether an external report is required. In the UK that is a Suspicious Activity Report to the National Crime Agency; in the UAE it is a suspicious transaction or activity report filed through goAML. The obligation sits on the individual first, which is why training has to reach everyone who touches client work, not only the compliance team.
Where the firm needs to carry out an act that might otherwise be a prohibited act, the UK route is a defence against money laundering request. Consent is not instant: there is a notice period during which you must not proceed, followed by a moratorium period if consent is refused, and the practical consequence is that a DAML has to be made early rather than on the day of completion.
Tipping off is a criminal offence in its own right. Telling the client that a report has been made, or saying something that prejudices an investigation, is prosecutable even where the underlying suspicion turns out to be unfounded. This is also why the reporting file needs proper access controls: the risk is not only external.
How firms actually handle client due diligence.
The firms that come through an inspection cleanly are rarely the ones with the most controls. They are the ones whose controls are the same on every file, and whose files can be reconstructed years later without anybody’s memory.
Refresh the firm-wide risk assessment annually, in writing
Date it, record who approved it, and note what changed since last time. A risk assessment that has not moved in three years while the client base has is itself a finding.
Run onboarding as a gate, not a form
No work starts until identity is verified, the risk rating is recorded with reasoning, screening has been run by your provider and filed, and a named person has approved the client. If the gate can be walked around when a partner is in a hurry, it is not a gate.
Require two people for anything that lowers risk
One person can raise a rating or escalate a match. Reducing a rating, or clearing a potential match as a false positive, is the decision that benefits the firm commercially, so it is the one worth putting a second pair of eyes on.
Write reasons that a stranger could follow
"Checked, fine" is not a reason. Name what you compared: date of birth, nationality, middle name, employer, address history, and what ruled the match in or out. This is the note that has to make sense to somebody who was not there.
Diarise the refresh from the file, not from the calendar
Each piece of evidence gets a re-check date when it is filed. Identity documents expire, screening goes stale, and structures change. A single annual sweep will always find the gap after it opened.
Give the MLRO a real reporting line and a written annual report
The nominated officer needs the standing to stop work, and the firm needs a documented annual report covering internal reports received, external reports made, training delivered, and the weaknesses found and fixed.
Rehearse the exit
Decide in advance what happens when a client will not provide what you need: who signs off ceasing to act, how the file is closed, whether a report is required first, and what you can and cannot say to the client on the way out.
What a supervisor asks to see
Inspections vary, but the requests do not vary much. If each of these can be produced within a working day, the visit is a conversation rather than a search.
- The firm-wide risk assessment, dated and approved, and the policies that follow from it
- A named client file with the risk rating, the reasoning behind it, and who approved it
- Identity and address evidence for the client and each beneficial owner, with the date it was obtained and by whom
- The screening output from your provider, filed against the individual it covers, with the date it was run and the reviewer’s conclusion
- Source of funds or source of wealth evidence on the enhanced-risk files, corroborated rather than asserted
- The training log, showing who was trained, on what, and when
- The internal report register and the MLRO’s annual report, including the decisions where no external report was made and why
Where Accupe fits
What the product actually does here.
- Identity and ID document capture, with a firm-side review queue and approve or reject decisions recorded against a named reviewer
- Evidence filed against the client and the named director, with expiry alerts before a document lapses
- Compliance Radar: a per-client status view built from verification state, Companies House director coverage and the next review date
- An append-only, hash-chained audit log of compliance actions, plus granular roles so only the right people can see a file
Accupe does not run sanctions, PEP, adverse-media or watchlist screening, and nothing in it monitors your clients against a list. It is the evidence, workflow and deadline layer that sits alongside whichever screening provider you already use.
Straight answers.
The questions firms ask about aml obligations and client due diligence, including the ones where the answer is no.
Does Accupe screen clients against sanctions and PEP lists?
No. Accupe runs no sanctions, PEP, adverse-media or watchlist screening, and nothing in it monitors your clients against a list. Screening is your firm’s obligation and you need a dedicated provider for it. What Accupe does is hold the evidence: identity verification, the documents your provider returns, the risk position per client, the re-check dates and an append-only audit trail of who did what and when.
Who supervises an accountancy firm for AML in the UK?
Either HMRC or a professional body supervisor such as ICAEW, ACCA, ICAS, AAT or CIOT, depending on your memberships and the services you provide. You must be supervised by somebody before you carry out relevant business, and a firm that has drifted out of scope of its professional body without registering with HMRC has a gap rather than an exemption.
What counts as a beneficial owner?
Generally a natural person who ultimately owns or controls more than 25 percent of the shares or voting rights, or who otherwise exercises control over the management of the entity. Control is the operative idea, so somebody with a controlling arrangement below the percentage threshold still counts. Where no beneficial owner can be identified after exhausting all reasonable means, the senior managing official can be treated as the beneficial owner, and the steps you took have to be recorded.
How often should client due diligence be refreshed?
Set a cadence by risk tier and then add triggers on top of it. Higher-risk clients are usually reviewed annually and standard-risk clients less often, but the trigger events matter more than the calendar: a change of director or beneficial owner, a change of ownership, a new service line, an unexpected payer, or anything that does not fit the client you thought you had.
What is the difference between source of funds and source of wealth?
Source of funds is where the money in this specific transaction came from, including the account it left and the activity behind it. Source of wealth is how the client built their assets over time. Enhanced due diligence normally needs both, and both need corroboration from something independent of the client rather than an explanation recorded as fact.
Can we rely on another firm’s due diligence?
Reliance is permitted in defined circumstances, but it does not transfer the liability. You remain responsible for the adequacy of the checks, and you need to be able to obtain the underlying records from the other party immediately on request. In practice most firms find it easier and safer to do their own work than to build the agreements that make reliance defensible.
What happens if we suspect money laundering?
Report internally to the nominated officer as soon as the suspicion arises, and do not tell the client. The nominated officer decides whether an external report is needed, filed with the National Crime Agency in the UK or through goAML in the UAE. If the firm needs to carry out an act that could otherwise be prohibited, a defence against money laundering request has to be made and consent waited for, so it needs to be raised early rather than at completion.
How long do we have to keep AML records?
Five years from the end of the business relationship or from the date of an occasional transaction, and they need to be retrievable rather than merely stored. This is one reason the physical location of the evidence matters: a certified passport copy in a filing cabinet in a room nobody has the key to technically exists, but it will not be produced within a day.
See Accupe in action.
Book a walkthrough with a real client record on screen, or start a 14-day free trial. No credit card either way.
