Key takeaways

  • Accountants must carry out customer due diligence under regulation 28 of the Money Laundering Regulations 2017 before they start acting for a client.
  • For a company client you must record its name, registration number and registered office, its directors, and its beneficial owners, and understand its ownership and control structure.
  • You cannot verify a beneficial owner by relying solely on the Companies House register; regulation 28(9) rules that out.
  • Since 30 June 2026, the occasional transaction threshold is £12,000, replacing 15,000 euros.
  • Mandatory enhanced due diligence now applies to clients linked to a FATF call for action country, rather than the old high-risk third country list.
  • The CCAB guidance updated in July 2026 says an identity check provider that is not on the DVS register should not be relied on alone.
  • Keep CDD records for 5 years from the end of the client relationship.

Client due diligence (CDD) means identifying and verifying each client, and anyone who owns or controls it, before you start work, then keeping that knowledge up to date. The rules are in regulation 28 of the Money Laundering Regulations 2017, amended from 30 June 2026. This checklist sets out what to collect, when to go further, and what to keep.

When do you need to carry out CDD?

You must apply CDD when you take on a new client, before the business relationship starts. HMRC’s guidance lists the other triggers:

  • you suspect money laundering or terrorist financing
  • you doubt identity information you obtained earlier
  • an existing client’s circumstances change, such as new owners or a big shift in activity
  • you carry out an occasional transaction of £12,000 or more, including linked transactions

The £12,000 figure replaced 15,000 euros on 30 June 2026, under the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621). Update any procedure manual that still quotes euros.

Before you start: the firm-wide risk assessment

Your CDD must follow your firm-wide risk assessment, which regulation 18 requires. Read HMRC’s sector risk assessment, AMLG3700 (updated 13 October 2026), before you rate client risk.

The CDD checklist for every new client

Work through these steps for each client and record what you did.

  1. Identify the client. For an individual: full name, date of birth and residential address.
  2. Verify the identity. Use a document or information from a reliable, independent source, such as a passport or photocard driving licence, or a certified electronic check.
  3. For a company, record the basics. Name, registration number, registered office and principal place of business, under regulation 28(3).
  4. Record the management. The full names of the board and senior persons responsible for operations.
  5. Understand ownership and control. Map the structure, including any holding companies or trusts.
  6. Identify the beneficial owners. Usually anyone owning or controlling more than 25%, and take reasonable measures to verify each one.
  7. Check anyone acting for the client. Under regulation 28(10), confirm they are authorised and verify their identity.
  8. Record the purpose of the relationship. What services, why, and the expected activity and source of funds.
  9. Rate the risk. Low, standard or high, with your reasons.
  10. Sign off and file. Note the date, who did the checks and who approved them.

The Companies House register helps, but you cannot verify beneficial owners by “relying solely” on it. That is regulation 28(9). Companies House identity verification for directors and PSCs does not replace your own checks.

Which evidence is acceptable?

The CCAB guidance updated in July 2026 adds a section on evidence for beneficial owners, with a passport as the preferred form. ACCA’s summary says firms should weigh how reliable and independent the evidence is, not collect documents by habit.

Evidence typeUse it forPoint to watch
Passport or photocard licenceIdentityCheck it is current
Utility bill or bank statementAddressRecent and in the client’s name
Electronic ID checkIdentity and addressProvider should be on the DVS register
Companies House extractCompany detailsNot enough alone for beneficial owners

An electronic provider that is not certified under the UK Digital Verification Services (DVS) trust framework should not be relied on alone. Your MLRO is responsible for making sure electronic checks give enough assurance.

When do you need enhanced due diligence?

Enhanced due diligence (EDD) is required for higher-risk clients. Use this decision list:

  • If the client is a politically exposed person (PEP) or a family member or close associate, then get senior management approval, establish source of wealth and funds, and monitor more closely.
  • If the client is linked to a FATF call for action country, then apply EDD before the relationship starts. This term replaced “high-risk third country” from 30 June 2026.
  • If a transaction is unusually complex or unusually large for its type, then apply EDD. Complexity or size alone is no longer the test.
  • If you have not met the client and the risk is higher, then consider extra checks, such as a first payment from an account in their name.
  • If none applies and the risk is low, then simplified due diligence may be possible, but record why.

The CCAB guidance says its EDD indicators are not a mandatory checklist. Document your reasoning whether or not you apply EDD.

Ongoing monitoring and record keeping

CDD does not end at onboarding. Regulation 28(11) requires you to scrutinise transactions and keep CDD information up to date. A sensible routine is:

  • refresh CDD at least yearly for high-risk clients, and on any change of ownership or activity
  • look again when work does not match what you know about the client
  • report suspicions to your MLRO, who decides on a report to the National Crime Agency

Keep CDD records, risk assessments and training records for 5 years from the end of the relationship.

What to do now

  1. Update thresholds. Replace euro figures with sterling, including £12,000 for occasional transactions.
  2. Swap the EDD wording. Use “FATF call for action country” in your forms.
  3. Check your ID provider. Confirm it appears on the DVS register.
  4. Review open files. Make sure each has a risk rating and a beneficial owner record.

For the wider process see onboarding a new client, AML registration for accountants, professional clearance letters and AML supervision moving to the FCA.

Frequently asked questions

Can I rely on Companies House identity verification for AML?

No. Regulation 28(9) says you cannot meet the beneficial owner verification duty by relying solely on information filed at Companies House. Use it as a starting point and verify independently.

What is the CDD threshold for occasional transactions in 2026?

It is £12,000, from 30 June 2026. It replaced the earlier 15,000 euro threshold.

How long must accountants keep CDD records?

Keep them for 5 years from the end of the business relationship or the completion of the occasional transaction.

Who is a beneficial owner of a company client?

Usually any individual who owns or controls more than 25% of the shares or voting rights, or who otherwise controls the company. If none can be found after all possible means, you may treat the senior managing official as the beneficial owner and record your efforts.

Sources

Rates, thresholds and rules in this guide were checked against HMRC and GOV.UK guidance on 6 November 2026. Tax rules change, so check the current position on GOV.UK or with a qualified adviser before acting. This guide is general information, not personal advice.