For accountants, not regulators!
Whether you’re a sole practitioner or part of a large firm, everything in this kit applies to you. If AML feels overly complex or hard to prioritise, this guidance is designed to help you get to grips with the essentials and reduce risk through practical steps. We’ve simplified the legislation, pulled out what matters most, and structured it in a way that supports both training and day-to-day compliance. This content was developed with an independent AML expert for UK accountants, then reviewed and refined by our content team to ensure it’s clear, practical, and easy to use.
Minimum requirements
Client data collection is the essential first step in AML compliance. Before you carry out ID verification or assign a risk level, you must gather accurate and relevant information about your client — including their identity, business activities, ownership structure, and service expectations. This initial data lays the foundation for effective customer due diligence (CDD) and supports your ability to assess AML risk confidently. Done well, it helps prevent errors later in the compliance process, reduces risk, and ensures your firm meets regulatory requirements from day one.
Before you start working with a client or as part of a regular review, you must check and confirm they are who they claim to be, using reliable and independent evidence, such as a passport, a utility bill, and an electronic ID check. This is part of your wider Customer Due Diligence (CDD) responsibilities, which also include understanding your client’s risk level and gathering key information about them. If the risk is higher, you’ll need to dig deeper. You can use traditional methods (like checking documents in person) or trusted digital tools, like Firmcheck, that verify identity using databases and biometrics. Sanctions checks are also essential.. Make sure you keep records securely, follow a risk-based approach, and ensure your team knows the process – your firm is ultimately responsible for making good decisions when verifying client IDs.
Client risk assessments help you decide how much due diligence to apply based on the specific risks each client poses. By looking at factors like ownership structure, the services you’re providing, the nature of transactions, and where the client operates, you can tailor your AML approach and spot red flags early. A clear, well-documented risk assessment doesn’t just support compliance — it protects your firm from reputational damage, enforcement action, and the risk of being misused. It’s a core part of building a reliable, risk-based AML framework.
A firm-wide risk assessment (FWRA) is a key part of AML compliance, helping you understand where your firm may be vulnerable to money laundering or terrorist financing. It looks across your entire client base, services, delivery methods, and geographic exposure to build a clear picture of risk. This assessment can shape your policies and feeds into every client risk assessment you carry out. A well-documented, regularly updated FWRA not only keeps you compliant — it also helps your firm stay alert, focused, and protected in a fast-changing regulatory environment.
In the UK, by law, accounting firms are required to establish and maintain robust AML policies, controls and procedures. The legislative framework mandating these requirements includes the Money Laundering Regulations 2017 (MLR 2017). Regulation 19 of MLR 2017 requires firms to have appropriate and risk-sensitive policies, controls and procedures in place, covering aspects such as client due diligence (CDD), record-keeping, internal controls, risk assessment and management, and the monitoring of compliance.
Effective AML training is more than a legal requirement — it’s how you build a culture of compliance across your firm. When your team understand the risks, know what to do, and feel confident taking action, compliance becomes part of daily operations rather than a tick-box task. Clear policies, practical guidance, and real-world examples make training more engaging and easier to apply. Leadership buy-in, ongoing updates, and regular feedback help maintain momentum. If you need support, external training programmes like Firmcheck’s can help your team stay informed, consistent, and fully compliant.
Ongoing monitoring is how your firm keeps AML compliance accurate and responsive as clients, risks, and regulations change. It involves regularly reviewing client records, policies, and internal controls to ensure they reflect current realities. Without it, red flags can go unnoticed and your firm may fall out of step with legal requirements. Done well, monitoring helps spot unusual behaviour early, keeps documentation up to date, and strengthens your overall AML framework. It’s not just about staying compliant — it’s about proactively staying in control.
AML record keeping is about more than storing documents — it’s how your firm proves it has met its compliance obligations. You’re required to keep clear, accurate records covering due diligence, risk assessments, transactions, policies, and any suspicious activity. These must be securely stored, regularly updated, and retained for at least five years. Good record keeping protects your firm during audits, supports internal reviews, and helps you manage risk effectively. With the right tools, training, and consistency, it becomes a key part of a strong, compliant AML framework.
AML operations
Effective Anti-Money Laundering (AML) compliance is crucial for UK accounting firms to safeguard against financial crime and adhere to regulatory obligations. Central to this compliance framework are the clearly defined roles and responsibilities of individuals and teams tasked with implementing AML measures. This article explores the key AML roles, their responsibilities, and how they contribute to a robust compliance culture.
Managing AML can feel overwhelming without a clear system in place. Project managing your AML work means putting structure around your compliance — so tasks are assigned, tracked, and improved over time. Focus on five core areas: clear policies, consistent onboarding, targeted training, secure record keeping, and regular reviews. With the right structure in place, your firm can stay compliant, build confidence, and reduce the burden on your team. It’s about creating a manageable system that supports both compliance and growth.
AML compliance isn’t just a technology cost — it affects your team’s time, processes, and day-to-day operations. Without structure, these costs can quickly add up. By focusing on a few key areas — automating repeatable tasks, simplifying onboarding, using a risk-based approach, and reviewing budgets and vendor value — firms can reduce the cost and complexity of AML work. A streamlined system helps you stay compliant, protect your margins, and spend less time chasing paperwork.
Choosing the right AML solution isn’t about finding the flashiest tool — it’s about what works for your firm. Some use manual processes, others adopt integrated platforms, and many sit somewhere in between. To evaluate your options, focus on the essentials: Does it cover your compliance needs? Save time? Scale as you grow? The best solution balances automation and control, giving your team confidence without adding complexity. Start with your current gaps, prioritise risk-based workflows, and choose tools that support real-world efficiency.
Specific challenges
AML compliance requires ongoing time, resources, and attention—but the cost of non-compliance can be far more damaging. This article outlines the financial and operational impact of doing AML properly, from software and training to due diligence and record-keeping. It also explores the serious consequences of getting it wrong, including enforcement action, reputational harm, lost clients, and even criminal convictions. Many firms fall short due to common misconceptions—believing they're too small to be targeted, trusting long-standing clients without review, or assuming electronic checks are enough. Strong AML compliance means staying proactive, applying professional judgement, and building a culture where it’s part of everyday work.
AML compliance visits are official reviews by your supervisory authority to check how well your firm meets its AML obligations. During a visit (in-person or remote), they’ll expect to see your firm-wide risk assessment, AML policies, client due diligence records, training logs, and any SARs submitted. Supervisors can request documents at any time and have legal powers to do so. Being well-prepared shows your AML procedures are more than a paper exercise. Make sure your documentation is up to date, tailored to your firm, and reflects actual day-to-day practice. If shortcomings are found, you’ll be expected to fix them quickly—so having systems in place beforehand saves time and stress later. Regular internal reviews, strong record-keeping, and a proactive attitude are key to a smooth compliance visit.
Submitting a Suspicious Activity Report (SAR) is a legal obligation under UK AML laws. All relevant employees must know how to recognise, document, and report suspicious activity—first internally to the Nominated Officer, and then, if required, to the National Crime Agency (NCA). A strong SAR process includes clear staff training, secure record-keeping, and documented procedures that comply with MLR 2017 and POCA. Firms must also take steps to avoid tipping off and seek consent (DAML) when required. Supervisory authorities may review SARs and the processes behind them during compliance visits, making it vital for practices to have well-established, up-to-date reporting controls.
From April 2025, Companies House is introducing mandatory identity verification requirements as part of wider anti-money laundering reforms. Accountants must register as an Authorised Corporate Service Provider (ACSP) to file on behalf of clients and verify directors or PSCs. This includes maintaining AML supervision, accurate record-keeping, and using ID verification technology—or undergoing specialist training. Verification becomes mandatory for new directors/PSCs from Autumn 2025. Firms must collect and securely store client identity documents for up to seven years. Failing to meet these standards may result in penalties or suspension. Firmcheck offers tools to simplify this process and ensure compliance without disrupting day-to-day work.
Try Firmcheck for free
Start your compliance journey for free. Try Firmcheck's beautifully designed self-service platform and see why firms trust us with their AML compliance.
Sign up today