Onboarding a new client runs in a fixed order: screen the enquiry, carry out and record anti money laundering checks, contact the previous accountant, agree terms and fees in writing, and only then get HMRC authorisation and start work. Identity checks must normally be finished before the business relationship starts, and if they cannot be completed the firm must not act.

Why does the order of onboarding steps make a difference?

Each step depends on the one before it. A firm cannot sensibly quote until it knows the scope, cannot accept until it has assessed the risk and verified identity, and should not ask HMRC for access until the client has accepted the terms. Doing things out of order is where most onboarding problems start: work begun before customer due diligence is complete, an engagement letter sent after the first invoice, or an agent authorisation requested for a client who later turns out to be unacceptable.

The rules come from three places. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) set the legal checks. Section 320 of the ICAEW Code of Ethics, which applies from 1 July 2026, covers client acceptance and changes in professional appointment, and section 330 covers fees. The HMRC Standard for Agents sets out what HMRC expects of anyone dealing with it for clients.

What should happen at the enquiry stage?

Before quoting, find out what the client actually needs and whether the firm can do it. Section 320 of the Code says a self interest threat to professional competence and due care arises if the team does not have, or cannot acquire, the competencies to perform the service. The factors it lists include understanding the client’s business, the complexity of its operations, the scope of the work, and whether the level of fee has regard to the resources required.

A short structured enquiry form helps. It should capture:

  • who the client is (individual, partnership, company, trust) and who will instruct the firm
  • the services wanted and any deadlines already close
  • the current adviser, if any, and why the client is moving
  • anything that suggests higher risk, such as overseas ownership, cash heavy trade or an open HMRC enquiry

This is also the moment to check for conflicts with existing clients and to decide whether the work is within the firm’s experience. The pages on conflicts of interest and work outside your expertise cover those tests in detail.

What anti money laundering checks are required before acting?

Regulation 27 of the MLRs requires customer due diligence when the firm establishes a business relationship. Regulation 28 sets out what that means: identify and verify the customer, assess and where appropriate obtain information on the purpose and intended nature of the relationship, and identify and take reasonable measures to verify any beneficial owner. For a company the firm must obtain and verify its name, company number and registered office address, and take reasonable measures to understand its ownership and control structure. Regulation 28(9) says a firm does not meet the beneficial owner requirement by relying solely on the register of people with significant control. Where someone acts for the client, regulation 28(10) requires the firm to verify that they are authorised to do so and to verify their identity.

The depth of checks follows the firm’s risk assessment of the client, as regulation 28(12) requires, so the client risk assessment should be completed and recorded at the same time. Sanctions screening sits alongside this.

Timing is set by regulation 30(2): verification must be completed before the business relationship is established. Regulation 30(3) allows verification to finish during the establishment of the relationship only if that is necessary not to interrupt the normal conduct of business and there is little risk of money laundering, and even then it must be completed as soon as practicable. If CDD cannot be completed, regulation 31 says the firm must not establish the relationship and must consider whether a suspicious activity report is required. Records of the CDD must be kept for five years from the end of the relationship under regulation 40. The full requirements are on the customer due diligence page.

How does professional clearance fit in?

Paragraph R320.5 of the Code requires a proposed accountant to at least seek to contact the existing or predecessor accountant. The Code notes that the client’s permission, preferably in writing, is usually needed first, so ask for it on the enquiry form. If there is no reply, R320.6A requires the proposed accountant to write by recorded delivery stating an intention to accept the engagement unless a reply is received within a specific and reasonable period.

Two questions should not be asked. The Code says the proposed accountant should not ask whether the existing accountant has reported suspicions of money laundering, and should not ask whether the existing accountant carried out client identification, because that responsibility cannot be delegated. If the client refuses permission for the existing accountant to talk, R320.7A requires the existing accountant to say so, and the proposed accountant must consider the reason carefully before accepting. The professional clearance page covers both sides of the exchange.

When must the engagement letter and fees be agreed?

R330.4 of the Code requires the firm to explain the basis on which fees will be calculated and give an estimated initial fee where applicable, at the earliest opportunity. R330.5 requires fee quotes or the basis of fees to be given in writing before the engagement starts or as soon as possible after it starts, normally in the engagement letter. The HMRC Standard for Agents says agents should agree the terms of engagement before starting to act and get confirmation that the client accepts them, and should make clear the rights both sides have to end the arrangement.

If the client is a consumer and the contract is made at a distance or off premises, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 give a cancellation period ending 14 days after the contract is entered into (regulation 30). Under regulation 36 the firm must not start the service in that period unless the consumer has expressly asked it to. The engagement letters page sets out what the letter should contain, and ICAEW’s sample letters include a privacy notice, which deals with the data protection side of onboarding.

How does the firm get HMRC authorisation?

HMRC guidance says registering with HMRC as a tax adviser is a legal requirement, separate from setting up online accounts, and that once registered the firm must get the client’s authorisation before acting for them. The method depends on the tax. VAT, Making Tax Digital for Income Tax and the Trust Registration Service use the digital handshake in the agent services account. Self Assessment, Corporation Tax and PAYE can use Online Agent Authorisation or the paper form 64-8.

With Online Agent Authorisation, HMRC posts the client an authorisation code within 7 working days, and the client should pass it on within 30 days or it expires. A separate code is sent for each tax service. Both HMRC guidance and the Standard for Agents say the firm must never ask a client for their HMRC sign in details, so building that wait into the timetable is better than looking for shortcuts.

What does a complete onboarding look like in practice?

Illustration only. A director contacts a firm in early November about moving her trading company and her own tax return from another accountant. The firm:

  1. sends an enquiry form asking about services, ownership, the current adviser and permission to contact them
  2. completes a client risk assessment, verifies the director’s identity using an electronic check, obtains the company details from Companies House and confirms with the director that she is the sole beneficial owner, keeping evidence beyond the register
  3. writes to the previous accountant for professional clearance and handover information
  4. issues an engagement letter with schedules for accounts, Corporation Tax and Self Assessment, with fixed fees and a list of what the client must provide and by when
  5. once the letter is signed, requests authorisation for Corporation Tax, PAYE and Self Assessment and sends the digital handshake for VAT
  6. loads the client’s filing deadlines into the practice calendar and sends the first records request

With the January Self Assessment deadline close, the firm agrees in the engagement letter what will happen if information arrives late, which leads into the systems described in getting records from clients on time.

What mistakes cause problems later?

  • Starting work, or filing anything, before identity verification is complete without a documented reason under regulation 30(3).
  • Treating the PSC register as the beneficial ownership check.
  • Asking the old accountant whether they ever made a suspicious activity report.
  • Agreeing fees by phone and confirming nothing in writing.
  • Asking a client for their Government Gateway password to save time.
  • Never revisiting the decision: R320.9 requires firms to review periodically whether to continue a recurring engagement, and the exit side is covered in disengagement letters.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.