Client Risk Rating, Acceptance and Exit: AML Guide for Accountants

Every accountancy firm has to decide, client by client, how much anti-money laundering (AML) scrutiny the work deserves, and what to do when a client will not or cannot provide what you need. This guide sets out how to rate a client's risk, what should push a client into enhanced checks, and what the Money Laundering Regulations 2017 require when customer due diligence (CDD) cannot be completed. It draws on HMRC's Economic Crime Supervision Handbook, which sets out how HMRC's inspectors test these points. Firms supervised by other bodies, such as ICAEW or ACCA, should also read their own supervisor's guidance. Rules and guidance are updated, including by the 2026 amendments, so check the current text and your own supervisor's guidance before you rely on this page. It is general information, not legal advice.

Start with the firm-wide risk assessment

A client risk rating is only as good as the firm-wide assessment behind it. Your assessment of the risks across your client base, services, delivery channels and geographies tells you what "normal" looks like for your firm, and so what stands out. If you have not yet written one, our firm-wide AML risk assessment guide shows how to build it. HMRC's handbook also expects the risks that its own published assessment and sector guidance identify to be considered in yours, so read those before you finalise your factors.

Building a client risk rating

Most firms use a simple scale of low, medium and high, and the label matters less than the reasoning recorded behind it. Typical factors to consider are:

• Who the client is. An individual, a small owner-managed company, a trust, a charity or a complex group each present different questions about ownership and control.
• How they came to you. A long-standing referral from a trusted source is different from an unsolicited approach from someone you have not met.
• What you are doing for them. Compliance and accounts preparation carry different exposure from handling client money or setting up companies and structures.
• Where the money and the people are. Unexpected links to higher-risk jurisdictions, or to sanctioned countries, are a reason to look harder.
• How you deal with them. HMRC's handbook lists non-face-to-face relationships without suitable safeguards among the situations that can carry inherently higher risk.
• Cash and unusual instructions. It also lists cash-intensive customers, so a client who wants to pay in cash for large amounts needs a clear explanation.

A written method matters as much as the factors. In its review of asset management and private markets firms, law firm Greenberg Traurig reports that 18% of firms had no formal customer risk assessment methodology. Whatever scale you use, write down how the factors combine into a rating, so that two people looking at the same client reach the same answer.

Record the rating, the date, who set it and the reasons. A rating with no stated reasons is hard to defend if your supervisor asks how you reached it.

Simplified, standard and enhanced checks

The rating should drive the level of checking. HMRC's handbook refers to customers being treated under simplified, standard or enhanced CDD, with higher-risk customers reviewed more often than the others. Simplified measures are only available where the lower risk is genuinely supported by your assessment, so do not use "simplified" as a default.

When enhanced due diligence is required

According to HMRC, enhanced due diligence (EDD) is required in these situations:

• your own risk assessment identifies a high risk;
• HMRC's published risk assessment and sector guidance identify a high risk relevant to your business;
• a client provides false or stolen identification, or false information, and you propose to continue dealing with them; and
• any other case that by its nature presents a higher risk.

HMRC describes EDD measures as obtaining additional verification from independent, reliable sources, learning more about the client's background, ownership and financial position, confirming that the work fits the stated purpose, and increasing monitoring. Our guide to enhanced due diligence for accountants goes into the steps in more detail.

What if you cannot complete due diligence?

Regulation 31 sets out what a firm must do where it cannot apply CDD. According to the text on legislation.gov.uk, the firm must not carry out a transaction through a bank account with or for the client, must not establish a business relationship or carry out a transaction with them otherwise, and must end any existing relationship. It must also consider whether a disclosure is required under the Proceeds of Crime Act 2002 or the Terrorism Act 2000.

HMRC's guidance gives some practical pointers on how its inspectors test this:

• They check whether a transaction was cancelled, and why.
• Where the work was part of an ongoing relationship, they look for any further transactions after it was ended.
• They check how any payment received was refunded, because a refund made in a different way from the original payment may point to a legitimate source of funds issue.

HMRC's case study treats completing a transaction without the required identification as a breach even where the business considered the risk low, and says the business should retrospectively consider a suspicious activity report (SAR). The regulation also contains exceptions, including for a professional adviser who is ascertaining a client's legal position or defending or representing a client in legal proceedings. They are narrow, so take advice from your supervisor before you rely on one.

Ending the relationship without tipping off

If you decide to decline or exit, think about what you say. Telling a client that you have made, or are thinking of making, a report can amount to tipping off. Keep your explanation to the fact that you are unable to complete your required checks and are therefore unable to act, and take advice before you say more. Our guide to suspicious activity reports explains the reporting and tipping-off rules.

A simple process for a small firm

1. Rate the client at onboarding. Record the factors, the rating and the date.
2. Apply the matching level of checks. Do not start work until the checks are complete, other than where the regulations allow.
3. Escalate unresolved gaps. If the client will not provide what you need, pass the matter to your money laundering reporting officer (MLRO) the same day.
4. Decide, record and act. Decline or exit, and consider a SAR.
5. Review the rating when circumstances change. A new beneficial owner or a change in the work should prompt a fresh look.

If you would like your team trained on these decisions, see our CPD courses.

Frequently asked questions

Do I have to rate every client?

Your risk-based approach needs a way of reflecting each client's risk, and the rating is how most firms record it. The label you use is less important than the recorded reasons.

Can I start work while I wait for documents?

Only where the regulations allow it. Regulation 31 prevents you from establishing a relationship or carrying out a transaction where you cannot apply CDD, so check with your supervisor before you rely on any flexibility.

What should I do with money a client has already paid?

Do not simply return it by a different route. HMRC notes that a refund made differently from the original payment can point to a risk. Speak to your MLRO before refunding.

Does leaving a client mean I do not need to report?

No. Regulation 31 requires you to consider whether a disclosure is needed, and HMRC says a retrospective SAR should be considered.