Ongoing Monitoring and Periodic CDD Review for Accountants

Customer due diligence does not end when a client signs the engagement letter. The Money Laundering Regulations 2017 expect a firm to monitor each business relationship as it goes on, which means watching the work and the money for anything that no longer fits what you know, and keeping your client records current. This guide explains what ongoing monitoring involves for an accountancy practice, what should trigger a review, how often to review, and what supervisors look for. It relies mainly on HMRC's Economic Crime Supervision Handbook and on guidance from the Insolvency Practitioners Association, so check the current text and your own supervisor's guidance before you rely on it. This is general information, not legal advice.

What ongoing monitoring means

Regulation 28(11) has two parts, as the Insolvency Practitioners Association explains it. The first is scrutiny of transactions throughout the relationship, including the source of funds where necessary, to check they fit your knowledge of the client, their business and their risk profile. The second is reviewing your existing records and keeping the CDD documents and information up to date, which means asking for renewed documents and not relying on outdated ones.

HMRC adds an important point about scope. Ongoing monitoring applies where there is a business relationship as defined in regulation 4, and HMRC says it is vital to work out which clients you have such a relationship with, because other situations can call for CDD without triggering ongoing monitoring. A one-off piece of work and a client you act for every year are not the same thing.

Watching the work and the money

HMRC says a business should be able to show when and how it reviews transactions, who is responsible, and what happens to the findings. Its inspectors may ask whether the system is manual, automated or both, whether review happens in real time or afterwards, whether alerts are reviewed, and whether source of funds checks are triggered. For a small practice that might mean a standing agenda item at partner meetings, a note on the file when a client pays through an unexpected route, or a rule that anything unusual goes to the money laundering reporting officer (MLRO).

Patterns to watch, according to HMRC, include changes in the size or frequency of transactions and in their geographic origin or destination, and whether the client's risk rating should change as a result. In HMRC's own case studies, one business was judged compliant because it questioned a change in payment method and updated its risk assessment. Another was judged non-compliant because it ignored an alert about a threefold rise in spending.

Keeping client information up to date

Reviews can be event-driven or periodic. HMRC lists these triggers:

• an unusual transaction;
• a new representative acting for the client;
• a change in beneficial ownership, such as a new politically exposed person (PEP);
• a change in the purpose of the relationship; and
• any development that affects the client's risk assessment.

Separately, regulation 27(8) requires CDD to be reapplied when you become aware of a change in an existing client's circumstances that is relevant to their risk. HMRC also notes that UK companies must tell a business about changes to details such as name, address, directors or beneficial owners, and that these changes should prompt a review. For help tracing owners, see our guide to ultimate beneficial ownership for accountants, and for a change involving a politically exposed person see our guide to politically exposed persons.

Do you need to re-verify identity every year?

Not generally. HMRC says identity does not usually need re-verifying unless you doubt the evidence or the client's details have changed, although an up-to-date copy may still be needed in some cases, such as an expired passport. Where nothing has changed, HMRC says you need not keep repeated copies of the same documents, and long-standing clients may be reviewed using information you already hold. What you must be able to show is that you looked.

How often should you review?

HMRC says review frequency must be risk-based and set client by client, with higher-risk clients reviewed more often than those under standard or simplified CDD. It does not set a fixed interval, and neither does the Insolvency Practitioners Association, which recommends that a review of AML documentation and the money laundering risk assessment is part of every file review. A sensible small-firm approach is to set a maximum interval for each risk band, record it in your procedures, and then follow it. HMRC points out that actual practice must match what your policies, controls and procedures say.

What supervisors check

According to HMRC, inspectors check whether your policies cover ongoing monitoring and whether they are followed in practice. They may select a client, look at the transaction records, and confirm that changes were identified and acted on. They also look at whether risk assessments are updated, whether alerts and reports are reviewed, whether SARs are raised where needed, and whether CDD information is refreshed on a risk-based schedule. A breach of regulation 28(11) can lead to the business being directed to guidance and, in some cases, a sanction. HMRC also says transaction records need not be kept beyond 10 years, so check the retention rules in your own procedures.

A practical review routine

1. Set review intervals by risk band. Write them into your procedures.
2. Diarise each client's next review. Use your practice management software or a simple spreadsheet.
3. Use a short checklist. Has ownership changed? Is the work still the same? Do payments look normal? Are documents current?
4. Record the outcome. Note any change to the risk rating and why.
5. Escalate concerns. If you cannot get updated documents, make a file note of what you tried and tell your MLRO.

For the wider picture on onboarding and due diligence, see our guide to KYC and customer due diligence for accountancy practices, and see our CPD courses for training.

Frequently asked questions

Is ongoing monitoring required for every client?

It applies where you have a business relationship under regulation 4. HMRC says you should work out which clients that covers.

How often must I review client records?

There is no fixed interval. HMRC says it must be risk-based and set client by client, with higher-risk clients reviewed more often.

Do I need new ID documents every year?

Not usually. Re-verification is needed if you doubt the evidence or the details have changed, and an expired document may need replacing.

What counts as a trigger?

HMRC gives examples including an unusual transaction, a new representative, a change in beneficial ownership, a change in the purpose of the relationship, or any other development affecting risk.

What if a client will not provide updated documents?

Make a file note of the steps taken, update the risk assessment if risk has increased, and speak to your MLRO. If CDD cannot be applied, regulation 31 may apply.