Due diligence on overseas and remote clients

Q: What might this look like on a file?

Illustration only. A UK company with one director and shareholder asks a practice to take over its accounts and corporation tax. The director lives in Portugal and wants to deal entirely by email. The practice checks the company at Companies House, confirms the director is the person with significant control, and records the company number and registered office. It sends the director a link to a digital identity provider it has confirmed is on the DVS register. The check fails because the provider cannot match a non UK address. The practice instead asks for a passport copy certified by a Portuguese notary, with the certifier's details, and checks the certifier's existence online. It holds a short video call in which the director shows the passport. Proof of address is a recent Portuguese utility bill. Because staff cannot read Portuguese, the practice obtains a certified translation. Sanctions and adverse media searches, including in Portuguese, are clear. The client is rated normal risk with a note explaining why the remote and overseas factors are mitigated.

Nothing in the Money Laundering Regulations stops a practice taking on a client it never meets or who lives abroad, and neither feature makes a client high risk automatically. But regulation 33(6) lists non face to face relationships without safeguards, and links to higher risk countries, as factors the firm must weigh, and a link to a FATF call for action country makes enhanced due diligence compulsory. The answer is to replace the comfort of meeting someone with stronger evidence: a certified digital identity service, properly certified documents, a video check, or more than one of these.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Is a remote client automatically high risk?

No. Regulation 33(6)(b)(iii) of the Money Laundering Regulations 2017 (MLR 2017) lists as a risk factor business relationships or transactions that are not conducted face to face and lack certain safeguards, and gives as an example of a safeguard an electronic identification process that meets the conditions in regulation 28(19). Regulation 33(7) then reminds firms that the presence of a risk factor does not always mean the risk is high. So a remote client verified through a reliable digital process may sit comfortably at normal risk, while a remote client who resists every form of verification should not.

ICAEW’s due diligence guidance treats an online meeting, such as a video call, as meeting the client. The real concern is anonymity: the firm cannot be sure the person sending documents is the person named on them. The UK National Risk Assessment 2025 also notes that supply chains, where a service reaches the end user through an intermediary, put distance between the firm and the client, and that the risk rises further where intermediaries or end users are outside the UK.

The decision belongs in the client risk assessment, with the delivery channel recorded as one factor alongside the client, service and geography.

How can you verify someone you never meet?

Regulation 28(19) says information from an electronic identification process can count as coming from a reliable, independent source if the process is secure from fraud and misuse and gives the necessary level of assurance that the person is who they claim to be. HMRC’s guidance (AMLG11400, section 14.5) says digital identity services certified against the UK digital verification services trust framework and on the DVS register are a reliable and independent source, and that a provider not on the register cannot reliably be treated as suitable. The register has been statutory since 1 December 2025 and anyone can search it to check a provider’s certificate. More detail is in electronic identity verification.

Where documents are used instead, HMRC’s guidance (section 14.4) says originals should be seen where possible; otherwise copies certified by a suitable professional can be accepted. The certifier should write that it is a true copy of the original seen by them, sign, date and print their name, and add their occupation, address and telephone number. The firm must check that the certifier exists. HMRC adds that certification on its own is not enhanced due diligence.

Other practical safeguards suggested by the professional bodies include:

a video call in which the client holds up the photo identity document (ACCA);
an additional form of identity (ACCA);
a photograph of the client holding their open passport beside their face, or posting a letter to the stated address and asking for it to be returned (ICAEW).

ACCA’s client due diligence factsheet warns that photographs of identity documents sent in by the client, without independent verification, would not typically be acceptable.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What changes when the client lives overseas?

HMRC’s guidance (section 14.6) says the same types of identity document should be obtained for non UK residents as for UK residents. Where the firm doubts a document, it can contact the relevant embassy or consulate or use the Public Register of Authentic travel and identity Documents Online (PRADO). If a document is in a language the firm’s staff do not understand, HMRC expects a certified translation and can require one under regulation 66 when inspecting records. The firm must record each step it takes.

Two practical limits follow. First, ICAEW notes that electronic verification systems tend to work well only for individuals in the UK, because they rely on UK databases, so a check on an overseas resident may simply fail and documents will be needed. Second, address evidence from abroad is harder to judge, which is where a returned letter or an official document from the country of residence can help.

ICAEW’s electronic due diligence helpsheet also suggests overseas company registries, the ICIJ Offshore Leaks Database for offshore structures, and adverse media searches in more than one language for firms with overseas clients.

What about overseas companies and structures?

For a company customer, regulation 28(3) requires its name, registration number and registered office (and principal place of business if different) to be obtained and verified, with reasonable measures to establish the law it is subject to, its constitution and its directors. HMRC’s guidance says that for a non UK company the firm must obtain an excerpt of the register kept under the law of its home country as proof of registration, for business relationships.

If the client is an overseas entity that must register on the Register of Overseas Entities, regulation 30A(1)(f) requires the firm to collect an excerpt of that register before the relationship starts, and regulation 30A(3)(c) requires material discrepancies to be reported to the registrar of companies for England and Wales. Beneficial owners of overseas companies are identified in the usual way; see verifying beneficial owners of corporate clients.

Regulation 33(6)(b)(vi) lists the formation of companies in a third country as a service risk factor, and regulation 33(6)(a)(vi) lists a corporate structure that is unusual or excessively complex for the business.

Which countries make enhanced due diligence compulsory?

Since 30 June 2026, when the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) took effect, regulation 33(1)(b) requires enhanced due diligence for any business relationship with a person established in a FATF call for action country, and any relevant transaction where either party is established in one. A FATF call for action country is one on the FATF list of High Risk Jurisdictions subject to a Call for Action. The detail is on high risk third countries.

Other countries do not trigger mandatory enhanced due diligence, but regulation 33(6)(c) requires firms to weigh geographical risk factors, including countries identified by credible sources as lacking effective anti money laundering systems, countries with significant corruption or other criminal activity, countries subject to sanctions or embargoes, and countries that fund or support terrorism.

Do sanctions checks apply as well?

Yes, separately from the Money Laundering Regulations. OFSI’s guidance explains that relevant firms, which include firms and sole practitioners providing accountancy services or tax advice by way of business, must tell OFSI as soon as practicable if they know or reasonably suspect that a person is a designated person or has breached financial sanctions, where the information came to them in the course of business. Overseas clients and their beneficial owners should be screened against the UK sanctions list as part of onboarding; see financial sanctions checks for accountants.

What might this look like on a file?

Illustration only. A UK company with one director and shareholder asks a practice to take over its accounts and corporation tax. The director lives in Portugal and wants to deal entirely by email.

The practice checks the company at Companies House, confirms the director is the person with significant control, and records the company number and registered office.
It sends the director a link to a digital identity provider it has confirmed is on the DVS register. The check fails because the provider cannot match a non UK address.
The practice instead asks for a passport copy certified by a Portuguese notary, with the certifier’s details, and checks the certifier’s existence online. It holds a short video call in which the director shows the passport.
Proof of address is a recent Portuguese utility bill. Because staff cannot read Portuguese, the practice obtains a certified translation.
Sanctions and adverse media searches, including in Portuguese, are clear. The client is rated normal risk with a note explaining why the remote and overseas factors are mitigated.

What are the common mistakes?

Accepting a scanned passport by email from a client never seen, with no certification, video check or digital verification.
Using an electronic tool that only screens for sanctions and politically exposed persons and treating it as identity verification.
Relying on a digital identity provider without checking it appears on the DVS register.
Accepting documents in a foreign language that nobody at the firm can read.
Treating every overseas client as high risk, or none of them, instead of assessing the actual country and structure.
Not recording what was done, when, and why it was considered enough.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.