AML checklist for accountants and bookkeepers: supervision, due diligence, records and training

"AML requirements for accountants" is searched a lot, and mostly by people who already know they have them and want the list. This is the list, from HMRC's own guidance, written as what a practice does and where it keeps the evidence.

1. Be supervised

Accountants providing services to clients, auditors, tax advisers and bookkeepers must be supervised for anti-money-laundering purposes. A practice supervised by one of the 14 professional bodies HMRC lists, including ICAEW and ACCA, does not register with HMRC; everyone else must register with HMRC and pay its fees. Trading without supervision is the one item on this list that can close the practice, and a practice that lets its body membership lapse without registering with HMRC has walked into it. Evidence: the certificate or HMRC registration, on file and in the date diary.

2. Assess the practice's risk

A written risk assessment for the practice as a whole: the clients it has, the services it offers, where its clients are and how they are met. It is the document that justifies everything else being proportionate to a small practice rather than a bank. Evidence: the assessment, dated and reviewed yearly.

3. Policies, controls and a nominated officer

Written policies and procedures, internal controls proportionate to the practice's size, and a nominated officer who receives reports of suspicion from staff and decides whether to report onward. In a four-partner practice the nominated officer is usually a partner, and every member of staff needs to know who. Evidence: the policy document and the appointment.

4. Customer due diligence

Due diligence is required when establishing a business relationship, for occasional transactions of 15,000 euros or more, when money laundering is suspected, and when there is doubt about information previously obtained. In practice that means identity and verification for every new client, and understanding who owns a company client. Enhanced due diligence applies where the client is not met in person, is a politically exposed person, is from a high-risk third country, or presents higher risk for another reason. Evidence: the onboarding file: identity documents, the beneficial ownership check, the risk rating and who approved it.

This is the same point in the client's life as the engagement letter and, since November 2025, the Companies House personal code. Our guide on Companies House identity verification covers that step; collecting all three together is the efficient way.

5. Keep records for five years

Records of due diligence and transactions are kept for five years from the end of the business relationship or the completion of the transaction. Evidence: a retention rule in the practice's document system, so that files are not deleted early or kept forever.

6. Train the staff

Relevant staff are trained on their responsibilities and on recognising suspicious activity, and the training is recorded. A new junior who has never heard of the nominated officer is a finding at the next supervisory visit. Evidence: the training log.

7. Report suspicion

Staff report to the nominated officer; the officer decides whether to make a suspicious activity report. The decision and its reasons are recorded either way.

Ongoing monitoring, not just onboarding

Due diligence is not finished at onboarding. The regulations expect a practice to keep client information current and to look again when something changes: a new director, a new line of business, an unexplained change in the pattern of transactions, or a client who starts asking for things the practice did not previously provide. In a small practice this is usually the partner who knows the client noticing, and the fix is to write the notice down on the client file with the date, so the monitoring is evidenced rather than remembered.

Keeping it in one place

Every item above is evidenced in two files: the practice file (supervision, risk assessment, policies, training) and the client file (due diligence, risk rating, records). A practice that can produce both on request is compliant; one that is compliant but cannot produce them is not, as far as a supervisor is concerned. The records policy and the onboarding checklist are where the client file starts.

This is general information, not legal advice. Fees, forms and the detail of enhanced due diligence are on GOV.UK and with the practice's supervisor.