Anyone who becomes an owner, partner, director or senior manager of an accountancy practice needs approval from the firm’s AML supervisor under regulation 26 of the Money Laundering Regulations 2017, which in practice means a basic criminal record check before or at the point they take the role. The firm must also be supervised from the first day it trades, tell its supervisor about the changes, and apply its own customer due diligence to the clients it inherits, either by doing the checks again or by formally relying on the seller’s.

Who needs supervisor approval?

Regulation 26(1) says no person may be the beneficial owner, officer or manager of a firm of external accountants, auditors, tax advisers or insolvency practitioners, or act as a sole practitioner, unless approved by the firm’s supervisory authority. These people are usually called BOOMs. HMRC’s guidance on approval checks lists who is caught:

  • beneficial owners, including the buyer of a practice or a new shareholder;
  • officers, including directors, partners, the company secretary and the nominated officer;
  • senior managers who make decisions affecting compliance or are responsible for regulated activities;
  • sole practitioners.

So a new salaried partner joining an existing firm, a director appointed on a merger and a buyer taking over a sole practice all need approval. Managers not routinely involved in the firm’s AML policies and procedures are outside the check.

What does approval actually test?

Approval is about criminal convictions, not competence. Regulation 26(8) says the supervisor must grant approval unless the applicant has been convicted of a relevant offence. The list in Schedule 3 is wide and includes offences under the money laundering legislation, the Proceeds of Crime Act, the Bribery Act, cheating the public revenue, being knowingly concerned in the fraudulent evasion of tax, offences under the VAT Act 1994, and “any offence which has deception or dishonesty as one of its components”. HMRC’s guidance says the test applies to unspent convictions, whether committed in the UK or overseas.

How it is done depends on the supervisor:

  • ICAEW requires a basic criminal record check from the Disclosure and Barring Service in England and Wales, Disclosure Scotland or AccessNI, and will not accept self declarations. It asks for the new BOOM’s original certificate after the firm submits a regulatory application or a notification of a change to its records, and will not authorise the BOOM until it has seen it.
  • HMRC runs its own approval check for the accountancy service providers it supervises, checking the information against its records and police records. The application is made and paid for through the firm’s Government Gateway account, and HMRC aims to give a decision within 45 days.

Can the new owner start before approval comes through?

Regulation 26(4) requires a firm to take reasonable care that nobody is appointed or continues to act as an officer or manager unless they are approved or have applied and are waiting for a decision. HMRC’s guidance confirms a BOOM can start once the application is submitted, but must stop immediately if it fails. The firm must not let anyone take up the role before applying.

The penalties are real. Under regulation 26(12) and (13), acting as an officer or manager without approval, or knowingly being a beneficial owner without it, is a criminal offence carrying up to two years’ imprisonment on indictment. If an approved person is later convicted of a relevant offence, regulation 26(10) requires both the individual and the firm to tell the supervisor within 30 days.

Is the firm itself still supervised after the change?

A practice must be supervised for AML before it carries on business. HMRC’s guidance says accountancy service providers not supervised by a professional body must register with HMRC. ICAEW’s helpsheet on changes in the composition of a firm warns that its automatic AML supervision applies only to member firms, so a change of structure can end it; the firm would then need to apply separately. The same helpsheet reminds firms to notify ICAEW of structural changes, tell their professional indemnity insurer and update their HMRC agent account details.

Buying through a new company is the common trap. The new company is a different firm and needs supervision in its own right from the day it takes on clients. HMRC’s civil measures guidance says trading while unregistered can lead to a penalty proportionate to how long the business traded, and can be treated as a criminal matter.

What notifications are due?

  • Regulation 21(4): the identity of a newly appointed nominated officer or compliance officer within 14 days of appointment.
  • HMRC supervised firms: other material changes within 30 days. HMRC counts each unnotified change as a separate breach, so two directors joining and three leaving is five breaches.

Can the buyer rely on the seller’s client due diligence?

Only formally. ICAEW’s guidance on buying and selling fees says each firm is responsible for its own customer due diligence, but the buyer may rely on the seller’s if the seller gives written consent, following paragraphs 5.4.1 to 5.4.7 of the CCAB guidance, and the buyer is then responsible for ongoing due diligence. Regulation 39 sets the conditions:

  • the buyer remains liable for any failure;
  • it must immediately obtain from the seller all the information needed to identify and verify each client and beneficial owner;
  • it must have arrangements to obtain copies of the identification evidence immediately on request, and the seller must keep them for the regulation 40 period.

ICAEW’s CDD helpsheet adds that when taking over clients from a closing practice, the new firm must still carry out its own risk assessment and the documentation will need updating as part of ongoing due diligence. Reliance saves repeating identity checks; it does not transfer the seller’s view of risk. See reliance on third parties.

If reliance is not available, the buyer applies full due diligence itself. Regulation 27(8) requires due diligence on existing customers at appropriate times on a risk based approach and when relevant circumstances change, and a change of adviser is an obvious moment. Where the client will not cooperate, regulation 31 means the buyer must not act.

What should the buyer’s own risk assessment cover?

Regulation 18 requires a written firm wide risk assessment that reflects the firm’s customers, services, geography and delivery channels. An acquisition can change all four, and regulation 19(4)(c) requires appropriate measures when a firm adopts new business practices. The buyer should update its assessment before completion, not at the next annual review. ICAEW names over reliance on long standing client relationships as a root cause of non compliance, which is a particular risk with an inherited client list where the seller “knew everyone”. See firm wide risk assessment.

The seller should not simply hand over a list of suspicious activity reports during negotiations. Section 333C of the Proceeds of Crime Act permits disclosures between advisers of the same kind only about a client or former client of both, and only to prevent a money laundering offence. Questions in due diligence are better framed around the seller’s AML policies, its latest monitoring review and which clients it rates as high risk.

How might this work in practice?

Illustration only. Priya, a chartered accountant, sets up a limited company to buy a retiring sole practitioner’s 220 clients.

  1. She arranges AML supervision for the new company and applies for approval as its director and beneficial owner, sending ICAEW her basic DBS certificate.
  2. She appoints herself nominated officer and notifies ICAEW within 14 days.
  3. The seller agrees in writing to reliance and passes over identification evidence for each client, with an undertaking to supply originals on request.
  4. Priya rerates every client against her own risk assessment, flags 15 cash businesses and two with overseas owners for enhanced checks, and schedules updated due diligence at each client’s first engagement letter.

What are the common mistakes?

  • Letting a new partner or director act before an approval application is in.
  • Starting to trade through a new entity that is not yet supervised.
  • Treating the seller’s files as the buyer’s due diligence without a written reliance agreement.
  • Copying the seller’s client risk ratings instead of reassessing them.
  • Forgetting to notify a new nominated officer within 14 days.

The commercial side of a purchase is covered in buying an accountancy practice and practice mergers.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.