AML client due diligence for accountants under the MLRs 2017

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OneID's blog post: Accountants in scope of the MLRs 2017 must complete client due diligence at onboarding, keep records for five years, and avoid slowing engagement start-up with weak identity checks.

Why it matters: IAM, KYC and identity verification teams need to treat regulated onboarding as a governance workflow, not a paperwork step, because delay and assurance failure are the same control problem in practice.

Context

Client due diligence is an identity assurance problem before it is a compliance task. Under the MLRs 2017, firms must establish who the client is from a reliable, independent source before the engagement starts, then keep that evidence current through the relationship.

The governance gap appears when onboarding is designed around document chasing instead of verified identity signals. For accountants handling thin-file individuals, new directors, or sole traders, the control has to work quickly enough to support business flow without weakening the assurance threshold.

That makes this a useful example of regulated identity and governance basics in a professional-services setting, where the duty attaches to the service provided rather than the job title.

Key questions

Q: What should accountants do when a client cannot be verified from one data source?

A: They should move to a documented fallback that uses additional reliable independent sources rather than accepting weaker evidence. The goal is not to relax the standard, but to preserve assurance for thin-file clients who do not resolve cleanly in a single dataset. If the control cannot produce a confident identity decision, the engagement should stay on hold until it can.

Q: Why do AML onboarding checks slow down legitimate clients?

A: They slow down when firms design around manual document collection instead of verified identity data. Legitimate clients with limited credit or public-sector footprint often need more than one source to clear the check, so a single-source workflow turns a normal case into an exception. The fix is a better assurance model, not a looser rule.

Q: How should firms separate client due diligence from wider AML duties?

A: Client due diligence confirms who the client is and why the engagement exists. It does not replace risk assessment, ongoing monitoring, source-of-funds checks, or suspicious activity reporting. Firms should map those duties as separate controls so staff understand which part of AML they are completing at each stage of the relationship.

Q: What records should a practice keep after client onboarding?

A: Keep the identity evidence, the verification decision, the engagement purpose, and the relationship end date together for five years after the relationship ends or the transaction completes. That record set lets a supervisor reconstruct how the firm met its due diligence obligation and supports consistent deletion once the retention period expires.

Technical breakdown

How client due diligence works under the MLRs 2017

Customer due diligence under the MLRs 2017 has three parts: identify the client, verify the identity from a reliable independent source, and understand the purpose and intended nature of the engagement. In practice, the identity step is the one that creates friction because it has to happen before or during onboarding, not after work begins. Electronic verification is acceptable when it genuinely tests against reliable sources rather than merely collecting a document image. That is why the control is about assurance quality, not just data collection. See the IAM and IGA Basics.

Practical implication: define the identity evidence standard before intake teams start asking clients for documents.

Why thin-file clients break document-based onboarding

Thin-file clients expose the weakness in single-source verification. A new director, recent arrival to the UK, or recently formed company may not resolve cleanly in one dataset, even when the identity is genuine. If the workflow expects a passport scan to settle the issue, it pushes staff into manual escalation and creates avoidable delay. Multi-source matching changes the mechanism by comparing identity attributes across independent data sources, which increases the chance of a confident match without requiring the client to assemble paperwork first. See the Identity Proofing and KYC Guide.

Practical implication: design a fallback path for low-footprint identities instead of forcing every case through the same document workflow.

What ongoing monitoring adds after onboarding

CDD does not end once the client is verified. Regulation 28 requires ongoing monitoring and keeping the CDD current, which means the firm must be able to show that the original identity decision still supports the relationship. Regulation 40 adds retention discipline by requiring records for five years after the relationship ends or the occasional transaction completes. The governance issue here is continuity: a verified client can still become stale if records, risk assessments, and supporting evidence are not maintained together. See the NHI Lifecycle Management Guide.

Practical implication: treat verification, monitoring, and retention as one lifecycle control rather than separate administrative tasks.

NHI Mgmt Group analysis

AML onboarding is an identity lifecycle problem, not just a compliance checklist. The MLRs 2017 require firms to identify, verify, monitor, and retain evidence across the full client relationship. That means the governance model has to handle both first-time assurance and later evidence retention as one continuous control. Practitioners should read this as lifecycle governance for regulated identity, not as a one-off onboarding exercise.

Multi-source verification is the practical answer to thin-file identity, but only if the assurance rule stays intact. A client with limited data footprint can defeat a single-source check even when they are legitimate. The article shows why broader matching matters, but the governing principle remains the same: verification must still come from a reliable independent source. The implication is that speed and assurance have to be engineered together, not traded off informally.

The duty attaches to the service, which is why title-based thinking fails. Accountants, tax advisers, bookkeepers and payroll agents can all fall in scope when they provide accountancy or tax services by way of business. That creates a programme design issue for firms that split work across job titles or delivery models. The governance question is who performs the regulated service, not what label appears on the org chart.

Record retention is part of the identity control, not an afterthought. Five-year retention requirements turn client verification into an evidence problem as much as an authentication problem. If the firm cannot reconstruct how identity was established, monitored, and retained, the control is incomplete even if the onboarding step felt smooth. Practitioners should treat retention design as part of the same client assurance architecture.

What this signals

Practices that treat AML onboarding as a document chase will keep tripping over thin-file clients, because the underlying problem is assurance design rather than client cooperation. Firms that separate evidence quality from workflow speed will find it easier to preserve both onboarding throughput and defensible identity decisions.

The deeper governance lesson is that regulated identity controls only work when the verification method matches the client population. For professional services firms, that means building a path for low-footprint identities, not assuming every legitimate client will fit a single verification pattern.

For practitioners

• Define the evidence threshold for client identity Set a clear standard for what counts as a reliable independent source before staff begin onboarding. Align intake scripts, reviewer checks and exception handling to that threshold so teams do not improvise when a client has limited records.
• Add a thin-file fallback path Create a separate workflow for newly formed companies, recent arrivals and other low-footprint clients. Use broader electronic matching when standard document-based verification does not produce a confident result.
• Separate verification from wider AML controls Keep client identity verification distinct from PEP and sanctions screening, source-of-funds checks, ongoing monitoring and suspicious activity reporting. That separation prevents teams from assuming one control discharges the others.
• Build retention into the workflow Store the verification decision, supporting evidence and relationship end date together so five-year retention can be applied consistently. Deletion rules should be tied to lawful basis and record expiry, not to ad hoc file cleanup.

Key takeaways

• Accountancy and tax firms in scope of the MLRs 2017 must verify client identity from a reliable independent source and keep that evidence current.
• Thin-file clients expose the weakness of single-source onboarding, which can slow legitimate engagements even when the underlying identity is genuine.
• The strongest control design separates verification, monitoring and retention while preserving a clear evidence trail for supervisors.

Related NHI Mgmt Group resources: IAM and IGA Basics · NHI Lifecycle Management Guide · Identity Proofing and KYC Guide

Key terms

• Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
• Thin-File Identity: Thin-file identity describes a person or business that has limited data presence across standard verification sources. It is not the same as being suspicious. The challenge for practitioners is to distinguish low footprint from low trust and use broader matching when one dataset cannot support a confident decision.
• Reliable Independent Source: A reliable independent source is evidence that does not rely solely on what the client supplies and can stand up to verification against external records. For regulated onboarding, the source must support a defensible identity decision, not just a faster one.
• Ongoing Monitoring: Ongoing monitoring is the continuous review of identities, systems, and activity to detect risk, misuse, and policy drift after access is granted. In IAM and NHI governance, it tracks behavior, privilege changes, secret use, and anomalous actions so security teams can spot compromise, enforce least privilege, and support timely response.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.