The AML Check Your Accountancy Practice Can’t Afford to Skip

Anti-money laundering compliance for accounting practices isn’t a box-ticking exercise with a low-stakes annual return.

HMRC’s AML supervision of the accountancy sector is active, penalty-bearing, and increasingly rigorous. HMRC issued over £3.8 million in AML penalties to supervised businesses, including accountants, bookkeepers, and tax advisers, with individual fines ranging from a few hundred pounds to six figures.

The firms that faced the largest penalties weren’t the ones with criminal intent.

They were the ones with gaps in their processes that they hadn’t noticed, or had noticed and not fixed.

The AML check that sits at the heart of every compliant accounting practice is client due diligence (CDD). It’s the check that must be completed before the practice takes on a new client, repeated when circumstances change, and maintained as a living record throughout the relationship. It’s also the check that most practices either do inconsistently, document inadequately, or treat as a one-time event rather than an ongoing obligation.

That gap is exactly where HMRC focuses its supervision.

What do the Money Laundering Regulations require from accountancy practices?

The core obligations under the UK regulations are:

• Registration with an AML supervisory body (for most UK practices, this is ICAEW, ACCA, CIMA, ICAI, or HMRC itself)

• A written firm-wide risk assessment, reviewed and updated at least annually

• Written AML policies, controls, and procedures, proportionate to the firm’s size and client base

• A nominated Money Laundering Reporting Officer (MLRO) responsible for receiving and assessing internal suspicious activity reports

• Staff training on AML obligations, documented and up to date

• Client due diligence carried out on every client, before work begins

• Ongoing monitoring of client relationships throughout the engagement

• Suspicious activity reports filed with the National Crime Agency (NCA) where there are grounds for suspicion

Most practices have the headline elements in place. They’re registered, have an MLRO and a written policy. The failures that generate HMRC penalties are almost always in the details. Examples could be CDD that was never completed for older clients who predated the firm’s AML process, risk assessments that haven’t been updated since 2019, or staff who were trained once and haven’t received a refresher.

The CDD check: What it needs to cover and why it’s the most commonly incomplete

Client due diligence requires the practice to verify the identity of its clients, and for corporate clients, the identity of the people with significant control behind them. The specific requirements include:

• For individual clients: Verify full name, date of birth, and current address. Acceptable verification typically includes a combination of photographic ID (passport, driving licence) and address evidence (utility bill, bank statement). The verification must be documented and the documents stored securely.

• For corporate clients: Verify the company’s name, registration number, and registered address. Identify and verify the beneficial owners, which is any individual holding more than 25% of shares or voting rights, or otherwise exercising significant control. This is where CDD most often falls short. Practices that verify the company’s existence but don’t drill into the ownership structure behind it.

• For higher-risk clients: Enhanced due diligence (EDD) applies where the risk assessment identifies a higher risk profile, like politically exposed persons (PEPs), high-cash businesses, or clients with complex offshore structures. EDD requires additional steps, including understanding the source of wealth, obtaining additional verification, and closer ongoing monitoring.

Ongoing monitoring

Practices are required to keep CDD documentation up to date, and to update it when the circumstances of the engagement change. A client whose business changes significantly, who adds a new beneficial owner, or who starts operating in a higher-risk jurisdiction, is a client whose CDD needs revisiting.

Most firms do their CDD diligently at onboarding but never revisit it. So, a client file from 2018 might have a passport copy and an address verification, but it has nothing reflecting the director change in 2021, or the fact that the client is now handling larger cash transactions than they were when the relationship began.

Ongoing monitoring doesn’t require annual CDD reviews but it does require a risk-based approach. The higher the risk the more frequent the reviews should be.

The tipping-off offence: The rule that catches practices out during enquiries

One of the less-discussed but most practically important AML obligations is the tipping-off prohibition. If a practice has filed a suspicious activity report (SAR) with the NCA, or knows that a SAR is being considered, it is a criminal offence to inform the client that a report has been made or that a suspicion exists. This includes well-intentioned disclosures during routine client conversations.

Practices that handle a suspicious transaction by asking the client about it directly are potentially committing a tipping-off offence and are certainly not following the correct process. Staff training on the correct response to suspected money laundering, including the tipping-off prohibition, is a non-negotiable part of a compliant AML framework.

How BrightManager by Bright supports AML compliance

BrightManager by Bright provides the practice management layer that makes ongoing monitoring operational rather than aspirational. Client risk classifications, review date triggers, an integrated third-party ID verification tool, and AML-related task management within BrightManager means you have a live picture of which clients are due a CDD review and which have outstanding documentation.

For a more detailed overview, see our guide on AML compliance and client due diligence for accounting practices.

How does the Bright onboarding suite compare to alternatives for AML compliance?

The Bright approach integrates AML-compliant CDD directly into your firm’s workflow within BrightManager, rather than being handled in a separate system that needs to be manually reconciled with the practice management workflow. BrightManager by Bright gives you the onboarding and ongoing monitoring infrastructure to meet MLR 2017 obligations without adding administrative overhead.

This content may have been developed with the assistance of AI tools. Content is reviewed by a member of the Bright team before publication. Guidance on legislation can be obtained from your industry body.