KYC Checklist for New Clients: A Practical Guide for Accountants

Most onboarding problems are not caused by missing knowledge. They happen because the checks are done in a different order every time and nobody records what was done. A checklist fixes that. This guide gives accountancy firms a practical know your client (KYC) checklist for new clients, with the reasoning behind each step and links to the detailed guides. The requirements come from the Money Laundering Regulations 2017 and the HMRC guidance described below, and your own supervisor may expect more, so use this as a starting point and adapt it to your firm's policies. It is general information, not legal advice.

Before you do any work

The rule that matters most is timing. If you cannot complete customer due diligence (CDD), regulation 31 says you must not establish a business relationship or carry out a transaction, and must end any existing relationship, and you must consider whether to make a disclosure. In practice that means the checklist is completed before the engagement letter is signed or work begins, not afterwards. Our guide to client risk rating, acceptance and exit explains what to do when a client cannot or will not provide what you need.

Step 1: Who is the client?

• Record whether the client is an individual, a company, a partnership, a trust, a charity or another entity.
• Note who is instructing you, and whether they are acting for someone else. If so, identify and verify that person too.
• Record how the client found you, and whether you have met them in person or only online.

Step 2: Identify and verify an individual

HMRC says you must obtain and verify the full name, date of birth and residential address, and that the evidence taken together must cover name, photo, date of birth and address, with at least one document showing a photo. For the checklist:

• photo ID seen and checked (valid, matches the person, not altered);
• address evidence seen from a reliable source (not a PO box);
• if a copy was used, it was certified properly and the certifier was checked; and
• if the check was done electronically, the provider is certified and you have recorded the result.

Our guide to ID documents, certified copies and proof of address covers acceptable evidence, and our guide to verifying client identity remotely covers digital checks.

Step 3: Identify and verify a company or other entity

• Name, registered number, registered office and principal place of business.
• Evidence from reliable sources, such as Companies House records, the certificate of incorporation and the articles of association.
• Directors and anyone authorised to instruct you, with their identity checked.
• Beneficial owners identified and verified, with ownership traced through any layers.

HMRC is clear that register entries alone are not enough, and that under regulation 28(9) you must use other sources to confirm beneficial ownership information. Our guide to ultimate beneficial ownership for accountants explains how.

Step 4: Understand the work and the money

Government guidance on digital identities makes the point that a digital identity check does not tell you the purpose and intended nature of the business relationship, and firms should not assume it covers all of CDD. Record in your own words:

• what you have been asked to do and why;
• whether you will handle client money, set up companies or structures, or deal in cash;
• where the client's money comes from and where it goes; and
• whether anything about the structure, the countries or the instructions looks unusual.

Step 5: Screen the client and owners

• Is any individual a politically exposed person (PEP), or a family member or close associate of one?
• Is any client, owner or controller a designated person under UK sanctions?
• Is there adverse media, if your policy requires it?

Record the date and the result. Because sanctions lists change, a clear result today is not a clear result next year. Our guide to UK sanctions for accountants covers the reporting and strict liability points.

Step 6: Rate the risk and decide the level of checks

Using your firm-wide risk assessment, give the client a rating and write down the reasons. HMRC says enhanced due diligence applies where your own risk assessment identifies a high risk, where HMRC's published assessment points to one, where a client provides false or stolen identification and you propose to continue, and in other inherently higher-risk cases. If the rating is high, add the enhanced checks before starting work.

Step 7: Approval and sign-off

• The person who carried out the checks signs and dates the checklist.
• A second person, such as a partner or the money laundering reporting officer, approves any high-risk acceptance.
• Any gaps or concerns are written down, with the decision taken.

Step 8: Set the review date

HMRC says review frequency must be risk-based and set client by client. Record the date of the next review and the events that would trigger an earlier one, such as a change in ownership, a new representative or a change in the work. Our guide to ongoing monitoring and periodic CDD review explains the routine.

Step 9: File the records

HMRC says identification and transaction records must be kept for five years after the business relationship ends or the occasional transaction is complete. Store the completed checklist, the documents or electronic verification results, the risk rating and the sign-off together, so that you can produce them quickly if your supervisor asks.

One-page checklist

1. Client type and instructing person recorded.
2. Identity verified for the individual or entity.
3. Beneficial owners identified and verified.
4. Purpose and nature of the relationship recorded.
5. Source of funds understood.
6. PEP and sanctions screening done and dated.
7. Risk rating assigned with reasons.
8. Enhanced checks done if rated high.
9. Sign-off and approval recorded.
10. Next review date set and records filed.

Training your team to use the checklist consistently is half the job, and our CPD courses can help.

Frequently asked questions

When must the checklist be completed?

Before work starts. Regulation 31 prevents you from establishing a relationship or carrying out a transaction if you cannot apply CDD.

Do I need a separate checklist for each client type?

One form can work if it has sections for individuals and entities, but record clearly which sections you completed.

How long should I keep the completed checklist?

Five years after the relationship ends, according to HMRC, then delete personal data unless an exception applies.

Can a digital ID check replace the whole checklist?

No. It can help verify identity, but you still need to understand the work, trace ownership, screen the client and assess risk.