AML Onboarding Evidence for UK Accounting Firms

An accounting firm that provides accountancy services in the course of business is a relevant person under the Money Laundering Regulations 2017, with duties to assess risk, check clients and keep records. The hard part is often not doing the checks but showing them: months later, and to a supervisor, the firm has to evidence what it checked, why it judged the risk the way it did, and when it last looked again.

The pressure on that evidence has risen. The Office for Professional Body Anti-Money Laundering Supervision (OPBAS) report published in March 2026 says the 22 professional body supervisors it oversees between them supervise over 41,400 legal and accountancy firms and practitioners, and that baseline compliance is good while some poor practice persists. HM Treasury's National Risk Assessment 2025 keeps accountancy service providers at high money laundering risk, and Companies House identity verification has added a second identity trail to many engagements.

This guide is for the Managing Partner and the money laundering reporting officer who have to stand behind the firm's onboarding file. It stays at the level of the evidence file itself: what the regulations ask the firm to hold, where firms fall short, and how to make that evidence continuous rather than assembled. It cedes the wider question of where AI pays across a practice to our accounting and advisory industry guide, agent-led practice operations to our post on the practice operations desk, bank-side corporate checks to our KYC review cost analysis, and identity checks over the phone to our piece on the accountancy practice client line.

This guide is shipped by the team behind DATS, the five-stage AI consulting system from DILR.AI, delivered by senior practitioners who ship code, not decks. Or see our AI operating model work, which covers governance, RACI and lifecycle, audit-ready by design.

What does a supervisor-ready AML onboarding file contain for an accounting firm?

A supervisor-ready AML onboarding file for a UK accounting firm holds four layers of written evidence: the firm-wide risk assessment, the policies that apply it, the client-level due diligence with its risk rating and reasoning, and the record of ongoing monitoring, all held for the retention period. The Money Laundering Regulations 2017 place each duty on the firm as the relevant person.

The first layer is the firm-wide risk assessment. Regulation 18 requires the firm to take appropriate steps to identify and assess the money laundering and terrorist financing risks its business faces, across its customers, geographies, services, transactions and delivery channels. Unless its supervisor notifies it in writing that this is not required, it must keep an up-to-date written record of the steps it took, and provide the assessment, the information behind it and that record to its supervisory authority on request. That last duty is the one that turns a document into evidence: the supervisor can ask not only for the conclusion but for how the firm reached it.

The second layer is policy. Regulation 19 requires written policies, controls and procedures that mitigate the risks the assessment found, that are regularly reviewed, proportionate to the firm's size and approved by senior management. The firm must also keep a written record of changes and of how those policies were communicated inside the business. A partner group that approved a policy in 2021 and never revisited it has a record, but not a reviewed one.

The third layer is the client file. Regulation 28 requires the firm to identify and verify the customer, and to assess the purpose and intended nature of the business relationship. For a company client it extends to the ownership and control structure and the beneficial owner. Where the client is a body corporate and the firm has exhausted all possible means of identifying the beneficial owner without success, it must keep written records of the actions it took, verify the senior person responsible for managing the company and record any difficulties. Where someone acts for the client, the firm must verify their authority and identity. Our KYC review cost analysis walks through these regulation 28 duties clause by clause from a bank's side; this guide keeps to how an accounting firm evidences them.

The fourth layer is monitoring. Regulation 28 also requires ongoing monitoring of the relationship, including keeping the due diligence documents up to date, and it requires the extent of the checks to reflect both the firm-wide risk assessment and the risk in the particular case. That single sentence is why a file that holds a passport copy but no risk rating, or a risk rating with no reasoning, is incomplete. The chain from firm risk to client risk to the depth of checks is what a reviewer reads.

Higher-risk clients deepen the third layer. Regulation 33 requires enhanced due diligence and enhanced ongoing monitoring where the firm's own assessment identifies high risk, where a client is a politically exposed person or a family member or close associate of one, where the firm finds false or stolen identification and still proposes to act, and where transactions are unusually complex, unusually large or have no apparent economic or legal purpose. The enhanced file must show what extra the firm did, not just that it flagged the risk. If you want a second view of how your own file maps to these layers, talk to our team before your next monitoring visit.

Why do accounting firms keep failing on documented AML evidence?

Accounting firms keep failing on documented AML evidence because the records do not show the work in a form a supervisor can test. The OPBAS report published in March 2026, citing HM Treasury's AML supervision report for 2023 to 2024, lists the recurring breaches as missing documentation of policies, due diligence, client risk assessments and records, and missing or inadequate firm-wide risk assessments.

The wording matters, because it names documentation as the failure, not the absence of checking. In paragraph 1.19 of its March 2026 report, OPBAS writes that "PBSs still report common breaches of inadequately documented policies and procedures, customer due diligence, client risk assessment or records and no or inadequate firm-wide risk assessment by their supervised population." OPBAS adds that these continued failures call into question the consistency and effectiveness of professional body supervision itself, which places the quality of member files at the centre of OPBAS's concerns.

The same report gives a concrete picture of what weak supervision looked like in one case. An accountancy sector supervisor found that a member had failed to provide proof of customer due diligence for its clients, then reviewed what OPBAS called a disproportionately small sample of client risk assessments, on average around 1%, and relied on the member's self-declaration without clear evidence of follow-up. OPBAS presents that as less effective practice, says it encouraged the supervisor to implement proportionate regular follow-ups, and says it is monitoring progress. For a firm, the safer assumption is that a sample request may be larger than it has been used to.

Enforcement at the supervisor level has also changed. OPBAS says that in 2025 it used its power of public censure for the first time against a professional body that failed to meet the UK's money laundering requirements, and its foreword welcomes the plan that, subject to legislation, the FCA will become the single AML supervisor for selected professional services. Neither point changes a firm's duties today, and OPBAS does not list in that sentence which professional services the change would cover. Our guide to enterprise AI consulting covers why regulated firms tend to start AI work on the evidence side rather than the decision side.

The firm-level stakes are personal as well as reputational. Regulation 86 makes contravening a relevant requirement a criminal offence, with up to two years' imprisonment on indictment, and gives a defence where the person took all reasonable steps and exercised all due diligence to avoid the offence. That defence is an evidence question. A firm can only show reasonable steps if it recorded them when it took them.

How does Companies House identity verification change an accountant's onboarding?

Companies House identity verification changes an accountant's onboarding by adding a statutory identity trail that runs alongside, not instead of, the firm's own due diligence. From 18 November 2025, directors and people with significant control must verify their identity, and an accounting firm registered as an Authorised Corporate Service Provider can carry out that verification for clients, at the same level of assurance Companies House requires.

The detail on the Companies House identity verification page is easy to flatten. The 18 November 2025 date is not a single deadline: Companies House describes it as the start of a 12-month transition period in which each existing director and person with significant control verifies by their own due date. Existing directors provide their personal code in the company's next confirmation statement filing, according to the gov.uk guidance on verifying your identity. Verification for people who file at Companies House comes later, from no earlier than November 2027, with at least six months' notice.

The Authorised Corporate Service Provider route is where the accounting firm's role changes. Companies House says AML supervised firms and sole traders, including accountants, can apply to become ACSPs, and that identity checks they carry out must meet the same level of assurance as verifying directly with Companies House. A firm that verifies a client's directors this way is now holding two kinds of identity evidence for the same people: the record behind a Companies House verification it performed, and its own regulation 28 due diligence on the client.

Those two trails should be linked but kept distinct. The Companies House check proves a named individual is who they say they are for the register. The firm's due diligence has to establish the client relationship, its purpose, the ownership and control structure and the risk rating. Regulation 28(9) says a regulated firm does not satisfy its beneficial ownership duty by relying solely on information delivered to the registrar, a point our bank KYC analysis quotes in full. For an accounting firm the practical rule is simple: a verified register entry is a stronger input to the client file, never a substitute for it. The same principle applies to caller checks on the phone, covered in our voice AI caller identity verification guide.

Which parts of AML onboarding can AI evidence, and which must stay with people?

AI can evidence the mechanical parts of AML onboarding for an accounting firm: collecting and checking documents against a list, comparing names against register data, flagging gaps in a client file, timestamping each step and prompting monitoring reviews. The judgements stay with people: the client risk rating, the decision to apply enhanced due diligence, acceptance of a high-risk client and any suspicion report.

The useful dividing line comes from the regulations themselves. Anything the firm must keep a record of is a candidate for automated capture, because a system can write the record at the moment the step happens rather than at the end of the month. That covers the document checklist, the date each item arrived, the match between a client's stated directors and the register, the trigger that opened a monitoring review, and the trail of attempts to identify a beneficial owner that regulation 28 requires in writing when identification fails.

Anything that requires the firm to assess risk is different. Regulation 28 says the extent of due diligence must reflect the firm's own assessment of risk in the particular case, and regulation 33 makes enhanced measures turn on whether a case is high risk. A model can propose a rating and show the factors it used, but the rating that goes on the file should be a named person's decision with their reasoning. OPBAS gives a caution from the supervisor side: one legal sector professional body built an AI risk model for its own supervision that assigned every new firm a default medium rating because it lacked early data, and OPBAS encouraged it, alongside developing the tool, to sample those new firms proportionately to validate the ratings. A practice using a model on its own clients faces the same question of what the model does when data is thin.

This split also keeps the firm clear of the obvious failure: an onboarding tool that silently passes clients with no human ever owning the risk call. The design work sits in the AI operating model, which sets out who decides, who reviews and what the system may do on its own. Firms weighing agent-led work under governance can see Cognibl, from DILR.AI, and our MTD agent evidence post, which looks at evidence for agent work on a different filing.

The same diagnostic logic underpins our AI execution office, embedded delivery with production placements the client owns.

How long must the evidence be kept, and when must it be deleted?

AML onboarding evidence must be kept for five years after the business relationship ends, under regulation 40 of the Money Laundering Regulations 2017, and then the firm must delete the personal data unless an exception applies. Transaction records within a relationship need not be kept beyond ten years. An accounting firm therefore needs a retention clock per client, started when the engagement ends, not a blanket policy.

Regulation 40 covers two kinds of record: copies of the documents and information obtained to satisfy due diligence, and supporting records sufficient to reconstruct a transaction that was subject to due diligence or monitoring. The five-year period runs from the date the firm knows, or has reasonable grounds to believe, that the relationship has ended or that an occasional transaction is complete. That judgement is worth recording when it is made. A client who quietly stops sending work leaves the end date to inference, and a file with no recorded end date makes the retention clock hard to evidence.

The deletion duty is the half firms forget. Once the period expires, the firm must delete personal data obtained for these regulations unless it is required to keep it by another enactment or for court proceedings, the data subject has consented, or the firm has reasonable grounds to believe the records need to be kept for legal proceedings. A practice that keeps every client passport copy indefinitely is not being cautious; it is holding personal data past the point the regulations allow. A continuous evidence system should carry deletion as a scheduled event with its own record, so the firm can show both that it kept what it had to and that it removed what it no longer could.

Retention design is also where firms most often discover that their evidence is scattered: identity documents in the practice management system, risk notes in email, monitoring reviews in a spreadsheet and the Companies House verification records somewhere else again. Pulling those into one file per client, with one clock, is a sensible first step in any evidence build, because the answer to a supervisor's sample request depends on it.

How should a firm sequence an AML evidence build?

An accounting firm should sequence an AML evidence build in the order a supervisor reads the file: firm-wide risk assessment first, then the client risk rating method, then document and register capture, then monitoring and retention. DATS, the AI consulting system from DILR.AI, runs AI work through five stages, from Discover and Diagnose to Scale and Run, with a named owner per ship.

The sequencing matters because automation built on an out-of-date firm-wide risk assessment simply records the wrong checks faster. In the Discover and Diagnose stage, the first question is whether the regulation 18 assessment reflects the firm's actual service mix. The ICAEW summary of the National Risk Assessment 2025 names payroll, bookkeeping, insolvency, tax advice and audit among the services criminals can use, and notes that payroll risk rises when it is offered as a standalone service or when the firm knows the client less well. A firm whose payroll book has grown since its last assessment should start there. HM Treasury published the NRA 2025 on 17 July 2025, and ICAEW's table shows accountancy service providers rated high for money laundering in 2017, 2020 and 2025.

The placement diagnostic produces a ranked roadmap of where AI belongs and where it does not. For onboarding evidence, a sensible order is capture and gap-flagging first, with nothing that touches the risk decision until the capture layer is trusted, and a pilot on one service line before the whole book. The operating model then covers governance, RACI and lifecycle, which is where decision rights and review rules are written down. Our comparison of an AI operating model and a centre of excellence covers how firms of different sizes hold that ownership.

There is a wider context for the investment case. McKinsey's State of AI reported in November 2025 that 88% of organisations use AI in at least one function but only about a third have it in production. Evidence work suits a first production placement for a regulated firm because the output is checkable: either the file answers a sample request or it does not. A partner group deciding whether to fund the work will find the questions in our post on board-level AI investment decisions apply directly.

A good internal test starts with regulation 18(6), which lets the supervisor ask for the risk assessment, the information it rested on and the record of steps. Go further: pick ten client files at random and time how long it takes to produce each client's rating, reasoning and monitoring history alongside it. If the answer is minutes rather than days, the evidence is continuous. The six enterprise AI solutions we document include enterprise knowledge retrieval and evaluation and observability for production agents.

What is the best way for a UK accounting firm to evidence AML onboarding in 2026?

The best way for a UK accounting firm to evidence AML onboarding in 2026 depends on its size and service mix. A small practice with a simple client book is often well served by an off-the-shelf onboarding and identity product plus its professional body's templates. A larger or faster-growing firm usually needs its own evidence model wired to its systems, which is where DATS fits.

The criteria are the same whichever route a firm takes. Can the system show, per client, the link from the firm-wide risk assessment to the client rating to the depth of checks? Does it record the reasoning behind a rating, not just the rating? Does it hold the Companies House verification trail separately from the firm's own due diligence? Does it start a retention clock when the relationship ends and record the deletion? Can the MLRO answer a ten-file sample in minutes? A product that answers yes to all five meets these criteria, whoever supplied it, though only the firm's supervisor can judge its files.

There are scenarios where DATS is not the right answer, and we would say so. A sole practitioner or a small practice with low-risk clients and a stable service mix will usually get more from a well-configured off-the-shelf tool than from a consulting engagement. A large group already running a Big Four AML transformation with Deloitte, PwC, EY or KPMG, with the change budget committed, should finish that programme before adding another. And a firm whose real gap is the firm-wide risk assessment itself, rather than the file evidence, may need its professional body's guidance and a partner's time more than any system.

DATS fits the firm in between: large enough that onboarding volume makes manual evidence fragile, with client data spread across systems, and with a partner group that wants the firm's compliance team to own the result. DATS is delivered by senior practitioners who ship code, not decks; read more about DILR.AI and our approach. We do not offer outcome guarantees, and a supervisor's view of a firm's files is always the supervisor's to form.

Frequently asked questions

Does Companies House identity verification replace our client due diligence?

Companies House identity verification does not replace an accounting firm's client due diligence under the Money Laundering Regulations 2017. It verifies that named directors and people with significant control are who they claim to be for the register. The firm still has to establish the relationship's purpose, the ownership and control structure, the beneficial owner and the risk rating, and record each step itself.

A verified register entry is a stronger input than an unverified one, but the regulation 28 file still has to stand on its own, with its own record of what the firm checked and why. Our DATS consulting system treats them as two linked records rather than one.

Can AI sign off a client as low risk?

AI should not sign off a client as low risk in an accounting firm's AML process. Regulation 28 of the Money Laundering Regulations 2017 requires due diligence to reflect the firm's own assessment of risk in each case. A system can propose a rating and show its factors, but the rating on file should be a named person's decision with recorded reasoning.

The duty sits with the firm as the relevant person, so the firm needs a named decision-maker and recorded reasoning it can show its supervisor. A default rating assigned quietly, like the medium rating OPBAS described in a supervisor's own model, can leave risk unidentified.

Will the FCA become our AML supervisor?

Whether the FCA becomes an accounting firm's AML supervisor depends on legislation not yet in force. OPBAS said in its March 2026 report that, subject to legislation, the FCA will become the single AML supervisor for selected professional services, without listing them in that sentence. Until any change takes effect, a firm's current supervisor and its duties under the Money Laundering Regulations 2017 are unchanged.

The practical step is the same either way: build files that would answer a larger sample than the one the firm is used to.

Want to see this in production? Start with DATS AI consulting, review our enterprise AI solutions, see where Dilr Voice agents fit a practice, or browse more industry guides on placing AI inside regulated firms.

Written by the Dilr.ai engineering team, practitioners who ship enterprise AI in production. Follow us on LinkedIn for shipping notes, or subscribe via the RSS feed.