Best AML Compliance Practices for Small Accounting Firms

Best AML Compliance Practices for Accounting Firms 

Here are the core practices that keep your firm compliant with UK AML regulations. 

Customer Due Diligence 

You must conduct Customer Due Diligence (CDD) when establishing any new client relationship, regardless of whether it’s ongoing accountancy work or a one-off transaction. CDD is also required when you suspect money laundering, when you doubt previously obtained client information, or when a client’s circumstances change significantly.  

The CDD process has three parts.  

• First, identify your client by collecting their full name, residential address, and date of birth. For individuals, use passports, driving licenses, or government-issued photo ID. Verify addresses through utility bills, bank statements, or council tax bills. For corporate clients, check the company structure through Companies House, verify the entity exists, and identify beneficial owners controlling more than 25%. 

• Second, verify information through independent sources. Don’t just accept documents at face value. Check against credit reference databases, the electoral register, or other authoritative sources.  

• Third, understand why this client needs your services, where their funds come from, and what activity levels you expect from the relationship. 

Risk Assessment Framework 

The regulations adopt a risk-based approach explicitly, meaning you tailor procedures to actual threats rather than treating every client identically. When assessing customer risk, consider client type first. A long-standing UK resident with straightforward rental income presents different risks than a newly arrived individual with complex international business structures. 

Services you provide matter too. Basic bookkeeping carries different risk profiles than corporate restructuring or trust administration. Geography plays a role, as clients operating solely in the UK present lower risk than those with interests in high-risk jurisdictions.  

Document your risk assessment for each client. A simple file note explaining why you consider them standard, low, or high risk satisfies the requirement.  

Enhanced Due Diligence Requirements 

Enhanced Due Diligence (EDD) becomes mandatory in specific situations. When clients aren’t physically present during identification, you must take additional steps.  

• Require the first payment from a bank account in the client’s name,  

• obtain extra documentation, or  

• use video verification technology 

Politically exposed persons require enhanced measures regardless of other factors. PEPs include individuals in prominent public positions, their immediate family, and known close associates. UK domestic PEPs need lighter-touch measures compared to non-UK PEPs, but both require senior approval for new relationships and enhanced ongoing monitoring. 

Clients from high-risk third countries identified by the EU also trigger enhanced due diligence. You must obtain source of wealth and source of funds information, apply additional verification measures, and conduct more frequent monitoring throughout the relationship. 

Record Keeping Standards 

Retain copies of all documents used in customer due diligence. This includes identification documents, verification checks, beneficial ownership information, risk assessments, and decision-making notes.  

Keep transaction records showing services provided, amounts charged, and payments received. If you file a Suspicious Activity Report, retain a copy with supporting information. 

The standard retention period is five years from the end of the business relationship or completion of an occasional transaction. Records can be kept as original paper documents, photocopies, scanned digital images, or computerised records. The requirement is accessibility and readability throughout the retention period, not specific format. 

Appointing a Nominated Officer 

Every accounting firm must appoint a nominated officer who receives internal suspicious activity reports and decides whether to file SARs with the National Crime Agency. In small practices, this is typically the principal or owner. Larger firms might designate a senior manager. 

The position requires sound judgment, understanding of money laundering risks, and sufficient seniority to make independent decisions without fee-earning pressures influencing reports. If your firm is FCA-regulated, you must also appoint a Money Laundering Reporting Officer with broader compliance management responsibilities. In small firms, one person often serves both roles. 

Ongoing Monitoring Procedures 

Compliance doesn’t end after initial onboarding. You must maintain awareness of client affairs throughout the relationship through appropriate vigilance during normal interactions. When preparing annual accounts, consider whether the financial position changed dramatically or unexpectedly.  

• Have new directors been appointed? 

• Has ownership structure changed?  

• Are transactions inconsistent with the stated business model? 

Your annual engagement letter renewal provides a natural checkpoint to review client information and refresh risk assessments. If circumstances change in ways that increase risk, apply additional due diligence measures proportionate to the new risk level.  

Written Policy Statement 

Every accounting firm must maintain a written AML policy statement, even sole practitioners.  

Your policy must name your nominated officer and define their responsibilities. It should explain how you conduct customer due diligence, including; 

• how you identify and verify clients,  

• how you assess risk levels, and  

• what enhanced measures you apply in higher-risk situations?  

Additionally, it should explain your ongoing monitoring approach, internal reporting procedures, staff training requirements and how you ensure everyone steps aware of their AML obligations.