Home › Accountancy practices › Onboarding and AML
Onboarding and AML
New client onboarding checklist for accountants: clearance, AML checks, engagement letter, HMRC
26 steps for taking on a new accountancy client: the enquiry to the old accountant, AML checks, the engagement letter and HMRC access, each with its rule.
Taking on a client is four jobs that run at once: the enquiry to the previous accountant, the practice's own identity and risk checks, the engagement letter, and access to the client's tax records at HMRC. Each has its own clock, and the slowest, the enquiry, can take six weeks. This list puts the steps in the order a small practice meets them, with the rule behind each. The professional rules quoted are ICAEW's, so members of other bodies should check their own. Use one list for each new client and start it the day the client says yes.
Free tool
New client onboarding checklist
Tick each step as it is done. The ticks are kept in this browser only, so you can come back to the list; nothing is sent anywhere.
A working list, not a certificate and not advice: the rule behind each step, with its source, is set out below.
Works in your browser. Nothing you type leaves this device unless you ask us to email you the result.
Before you agree to act
Check the practice's own AML supervision is in date before you take anyone on. A practice supervised by one of the 14 professional bodies GOV.UK lists does not register with HMRC; everyone else must. GOV.UK says trading while not registered is a criminal offence, and a lapsed HMRC registration means a new application and the £300 fee again. Source: GOV.UK, money laundering supervision and registration fees pages. The working is in HMRC AML supervision for accountants and bookkeepers.
Get the client's written permission to contact their previous accountant. ICAEW's code says the incoming accountant needs the client's permission to write, preferably in writing, and the existing accountant needs the client's consent to answer. Without the signed authority the enquiry cannot be answered. Source: ICAEW Code of Ethics 2026, section 320. The working is in Professional clearance letter template.
Send the professional enquiry with the signed authority, asking for a reply in 14 days. Section 320 says an accountant asked to accept an appointment shall at least seek to contact the existing accountant. ICAEW's helpsheet says a reply period of less than two weeks is unlikely to be reasonable. Source: ICAEW Code of Ethics 2026, section 320; ICAEW helpsheet for the incoming accountant. The working is in Professional clearance letter template.
Leave two questions out of the enquiry: suspicious activity reports and identity checks. Do not ask whether a suspicious activity report has been made or whether identity checks were carried out. The code says client identification cannot be delegated to the existing accountant, so the new practice does its own. Source: ICAEW Code of Ethics 2026, section 320. The working is in Professional clearance letter template.
Ask in the same letter for the last accounts, the last return and deadlines in the next 90 days. ICAEW's helpsheet accepts that the enquiry and the request for records are often sent together. The existing accountant must deal promptly with a reasonable request to transfer records, and unpaid fees are not a reason for failing to respond. Source: ICAEW helpsheets on change of professional appointment. The working is in Professional clearance letter template.
No reply by day 14: telephone and email, and note both on the file. The helpsheet suggests chasing by another route, such as telephone, before the formal follow-up. It puts a reasonable wait before the tracked letter at 14 to 30 days, depending on the circumstances. Source: ICAEW helpsheet for the incoming accountant. The working is in Professional clearance letter template.
No reply by day 28: send the second letter by a tracked method, giving 14 more days. The code requires a second letter by recorded delivery, stating an intention to accept the engagement unless a reply arrives within a specific and reasonable period. The helpsheet counts an email with a read receipt as a tracked method. Source: ICAEW Code of Ethics 2026, section 320. The working is in Professional clearance letter template.
Day 42, or when the reply arrives: decide whether to act and write down why. Fraud, accounting irregularities and tax evasion should affect the decision; a fee dispute may not. After silence the code lets you assume no adverse comment but still expects other reasonable steps, such as asking the client whether any regulatory or legal matters are in progress. Source: ICAEW helpsheet for the incoming accountant. The working is in Professional clearance letter template.
Identity and risk checks
Verify the client's identity yourself and keep the documents on the client file. Customer due diligence is required when establishing a business relationship, and for occasional transactions of 15,000 euros or more. For a new client that means identity and verification, done by the practice and not taken from the last accountant. Source: GOV.UK, Money laundering regulations: your responsibilities. The working is in AML checklist for accountants and bookkeepers.
Company client: find out who owns and controls it, and record the check. Due diligence on a company includes understanding who owns it. The beneficial ownership check belongs in the onboarding file next to the identity documents, which is where a supervisor will look for it. Source: GOV.UK, Money laundering regulations: your responsibilities. The working is in AML checklist for accountants and bookkeepers.
Apply enhanced due diligence where the client is higher risk. Enhanced due diligence applies where the client is not met in person, is a politically exposed person, is from a high-risk third country, or presents higher risk for another reason. Source: GOV.UK, Money laundering regulations: your responsibilities. The working is in AML checklist for accountants and bookkeepers.
Write the risk rating on the file, with the name of the person who approved it. The onboarding file is the evidence: identity documents, the beneficial ownership check, the risk rating and who approved it. A practice that did the checks but cannot produce them is not compliant as far as a supervisor is concerned. Source: GOV.UK, Money laundering supervision for accountancy service providers. The working is in AML checklist for accountants and bookkeepers.
Company client: ask each director and person with significant control for their personal code. Since 18 November 2025 directors and people with significant control must verify their identity with Companies House. The next confirmation statement needs each director's personal code, and a person with significant control gets 14 days to supply theirs. Source: GOV.UK, Verifying your identity for Companies House. The working is in Companies House identity verification.
Unverified director: send the GOV.UK One Login link with a date two weeks before the statement. Verification through GOV.UK One Login is free and done once. A practice can verify a client itself only if it is registered with Companies House as an authorised agent. Without the codes the confirmation statement cannot be filed. Source: GOV.UK, Verifying your identity for Companies House; Confirmation statement guidance. The working is in Companies House identity verification.
The engagement letter
Put the dates for sending records in the engagement letter. Records due 18 days after each period ends, which is 23 July, 23 October, 23 January and 23 April for standard MTD quarters, leave the practice 15 days before the 7th. A date in the letter is something the client agreed to. Source: GOV.UK, MTD quarterly update deadlines; our records policy. The working is in How to stop clients sending records late.
State the charge for records that arrive after the practice's date. A records charge in the engagement letter applies to any period where the records arrive late. It does not need to be large; its job is to make the client feel the cost of lateness before the practice does. Source: our records policy. The working is in How to stop clients sending records late.
Add the retention paragraph: identity documents kept five years after you stop acting. Regulation 40 of the Money Laundering Regulations 2017 makes the practice keep due diligence records for five years from the end of the relationship and then delete the personal data, unless another law or legal proceedings need it. Source: Money Laundering Regulations 2017, regulation 40. The working is in How long should an accountant keep client records? The legal minimums, and a retention schedule to copy.
Say in the letter who owns which documents, and whether the retention policy is contractual. ICAEW's guidance says records the client gave the practice remain the client's property and recommends that the letter deals with ownership. It warns that telling clients about a retention policy may create a contractual commitment. Source: ICAEW guidance on document retention. The working is in How long should an accountant keep client records? The legal minimums, and a retention schedule to copy.
Hold the work until you are satisfied it is proper to act. The engagement letter can be drafted while the enquiry is out, but ICAEW's helpsheet says the new accountant must be satisfied it is proper to act before accepting or starting work. Source: ICAEW helpsheet for the incoming accountant. The working is in Professional clearance letter template.
HMRC access and records set-up
Create the authorisation request in the agent services account and email the client the link. The client signs in with their own details to accept the request. The link expires after 21 days, and an agent must never sign in with a client's credentials. Source: GOV.UK, Authorise an agent for taxes that use the digital handshake. The working is in How to sign up a client for MTD for Income Tax as an agent.
Chase the authorisation link on day 7 and day 14. A request sent on Monday 5 October 2026 expires 21 days later, on Monday 26 October. If the link lapses before the client accepts, the agent has to send a new one. Source: GOV.UK, Authorise an agent for taxes that use the digital handshake. The working is in How to sign up a client for MTD for Income Tax as an agent.
Add up gross self-employment and property income to see whether the client is in MTD. The test is qualifying income before expenses, not profit. Over £50,000 on the 2024 to 2025 return means the client has been in Making Tax Digital for Income Tax since 6 April 2026; over £30,000 on 2025 to 2026 means 6 April 2027. Source: GOV.UK, Check if you're eligible for Making Tax Digital for Income Tax. The working is in MTD for Income Tax deadline checker.
Set up the bank feed and a receipt-capture app before the first records request. A bank feed into Xero, QuickBooks or FreeAgent and receipt capture on the client's phone mean records arrive as the client spends. Set up at onboarding, they shrink the quarterly request to anything not on the feed. Source: our records policy. The working is in How to stop clients sending records late.
Send the client a plain list of what "records" means for their type of business. Half of late records are a definition problem. For a landlord the list is the agent's statements and any invoice over £100; for a trades sole trader it is the bank feed, sales invoices and materials receipts. Source: our records policy. The working is in How to stop clients sending records late.
Close the onboarding file
Note on the file what would prompt a fresh look at the client's due diligence. Due diligence does not end at onboarding. The regulations expect a practice to look again when something changes: a new director, a new line of business or an unexplained change in transactions. Write each review on the file with its date. Source: GOV.UK, Money laundering regulations: your responsibilities. The working is in AML checklist for accountants and bookkeepers.
Set the retention rule on the client's folder now, not when they leave. The five years for due diligence records run from the end of the business relationship. A retention rule in the document system from the start means the file is neither deleted early nor kept for ever. Source: Money Laundering Regulations 2017, regulation 40. The working is in AML checklist for accountants and bookkeepers.
How to use the list
Keep the ticked list in the client file with the documents behind it: the signed authority, both enquiry letters, the identity evidence, the risk rating and the signed engagement letter. If a step did not apply, such as personal codes for a sole trader, tick it and note why. When a supervisor visits, or the client disputes what was agreed, the dated list shows what was done and when. Clear the ticks before the next client.
A ticked list is a record that the steps were done, not proof that each was done properly. The list covers the points our guides and the official pages named above set out; it is not every duty a firm has. This page is general information, not legal advice.
Overlyft sets up AI assistants for accountancy practices: they prepare drafts for a person to approve. They do not tick off any of these steps for you, and you can do every one without them.
Short answers from this page
What does an accountant have to do when taking on a new client?
Four jobs run at once: the enquiry to the previous accountant, identity and risk checks, the engagement letter, and access to the client's tax records at HMRC. Our checklist puts them in 26 steps. The enquiry is the slowest, running to day 42 on ICAEW's figures. HMRC's authorisation link lasts 21 days, and a person with significant control has 14 days to supply a personal code.
Source: ICAEW Code of Ethics 2026, section 320, and GOV.UK guidance, as set out in our checklist
Where this comes from: GOV.UK, money laundering supervision and registration fees pages; ICAEW Code of Ethics 2026, section 320; ICAEW Code of Ethics 2026, section 320; ICAEW helpsheet for the incoming accountant; ICAEW helpsheets on change of professional appointment; ICAEW helpsheet for the incoming accountant; GOV.UK, Money laundering regulations: your responsibilities; GOV.UK, Money laundering supervision for accountancy service providers; GOV.UK, Verifying your identity for Companies House; GOV.UK, Verifying your identity for Companies House; Confirmation statement guidance; GOV.UK, MTD quarterly update deadlines; our records policy; our records policy; Money Laundering Regulations 2017, regulation 40; ICAEW guidance on document retention; GOV.UK, Authorise an agent for taxes that use the digital handshake; GOV.UK, Check if you're eligible for Making Tax Digital for Income Tax; each step names its source, and the linked guide shows the working.
AEO Lookup editorial team
We write practical guides for people who run small UK firms, and we check every fact against its source on the date shown. Read how we review, or tell us if something has changed.
