What to do when a client refuses to provide ID

Q: How might this work in practice?

Illustration only. A practice reviews the due diligence on a longstanding company client after a change of shareholders. The director provides his own passport but refuses to say who now owns the 60% held by an overseas company, saying it is none of the practice's business. The practice explains the legal requirement in writing and gives ten working days. No information arrives. The client manager reports the facts to the MLRO, noting that the refusal followed questions about large unexplained receipts. The MLRO concludes there are reasonable grounds to suspect, submits a report, and the practice ends the engagement with a neutral letter stating only that it can no longer act. The MLRO's decision and reasons are recorded on a restricted file.

If a client will not provide what is needed for customer due diligence, regulation 31 of the Money Laundering Regulations says the firm must not take on the work, must end any existing relationship and must consider whether a suspicious activity report is required. A refusal is not automatically suspicious, but the firm has to make that judgement, record it and, if there is suspicion, report it without tipping the client off.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What does the law require when due diligence cannot be completed?

Regulation 31(1) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) applies where a firm is unable to apply customer due diligence measures as required by regulation 28. The firm:

must not carry out any transaction through a bank account with or on behalf of the client;
must not establish a business relationship or carry out a transaction with the client otherwise than through a bank account;
must terminate any existing business relationship with the client;
must consider whether it is required to make a disclosure under Part 7 of the Proceeds of Crime Act 2002 or Part 3 of the Terrorism Act 2000.

The duty is not limited to identity documents. Regulation 28 also covers beneficial owners, the ownership and control structure of a company or trust, and the purpose and intended nature of the relationship. A client who supplies a passport but will not say who owns the company is equally a case where due diligence cannot be completed. For the full checklist, see customer due diligence for accountants.

Does it make a difference whether the client is new or existing?

For a prospective client, the firm simply does not start. For an existing client, regulation 27(8) requires due diligence to be reapplied at appropriate times on a risk based approach and when the client’s relevant circumstances change, and regulation 27(1)(d) requires it where the firm doubts earlier documents. If an established client refuses at that point, regulation 31(1)(c) requires the relationship to end. A long history with the client is not a defence; HMRC’s guidance at AMLG11300 points out that even people a firm knows well can become involved in illegal activity if their circumstances change.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

Is a delay the same as a refusal?

Not necessarily, but the room for delay is small. Regulation 30(2) requires verification before the relationship is established. Regulation 30(3) allows verification to be completed during the establishment of the relationship only where that is necessary not to interrupt the normal conduct of business, there is little risk of money laundering, and verification is completed as soon as practicable after contact is first made. HMRC describes this exception as very limited, says it does not allow due diligence to be delayed because verification is hard, and expects a written record of why the risk was judged low.

A practical approach is to set a short, fixed deadline in writing, chase once, and treat silence after that deadline as a failure to complete due diligence. Where the delay comes from a genuine obstacle, such as a lapsed passport, see due diligence when a client has no photo ID.

Are there any exceptions to the duty to stop?

Two narrow ones. Regulation 31(3) disapplies regulation 31(1) where a professional adviser is ascertaining the legal position for a client or defending or representing the client in, or concerning, legal proceedings. Regulation 31(4) limits this to an auditor, external accountant or tax adviser who is a member of a professional body that tests competence for admission and imposes and enforces professional and ethical standards. The exception covers that type of work only, not routine compliance.

Regulation 31(5) allows a court appointed administrator or liquidator to continue where all reasonable steps have been taken and resignation would prejudice creditors. Neither exception removes the duty to report suspicion.

Is a refusal to provide ID suspicious in itself?

It can be, but the firm has to look at the circumstances. HMRC lists among its warning signs for new customers a customer who is reluctant to provide details of their identity or provides fake documents, a customer whose identity cannot be proven, and one trying to use intermediaries to hide their involvement. Against that, some clients object on privacy grounds, misunderstand why the checks are needed, or simply go elsewhere.

The legal test is in section 330 of the Proceeds of Crime Act 2002: whether the person knows or suspects, or has reasonable grounds for knowing or suspecting, that another person is engaged in money laundering. Questions worth asking include whether the client offered an explanation, whether the refusal came after the firm asked about a particular transaction or the source of funds, and whether there are other red flags on the file. Staff should pass the facts to the MLRO, who makes the decision; see internal suspicion reports to the MLRO.

HMRC’s guidance (AMLG11300, section 13.5) says that if no suspicious activity report is made after due diligence could not be completed, the firm must record the reasons why a report was not considered necessary.

What can the firm say to the client?

The firm can explain that the law requires identity and ownership information before it can act, and that without it the firm cannot continue. That is a statement of the firm’s own obligations. Care is needed once a report has been made. Section 333A of the Proceeds of Crime Act 2002 makes it an offence in the regulated sector to disclose that a disclosure has been made to the NCA or a nominated officer, or that an investigation is contemplated, where that is likely to prejudice an investigation. The maximum penalty on indictment is two years’ imprisonment. Keep the disengagement letter factual and neutral. See tipping off.

Regulation 28(14) and (15) help here: once a firm has applied due diligence and made a disclosure, it need not continue due diligence measures if doing so would amount to tipping off.

What about money the firm already holds?

Regulation 31(2) allows money deposited to be repaid to the person who deposited it. Where a disclosure is required, the firm needs appropriate consent under section 335 of the Proceeds of Crime Act 2002 first. HMRC’s guidance says repayment should be made by the same method and to the same account the money came from, and that where money laundering is suspected a defence against money laundering should be requested before repayment. See defence against money laundering requests.

How might this work in practice?

Illustration only. A practice reviews the due diligence on a longstanding company client after a change of shareholders. The director provides his own passport but refuses to say who now owns the 60% held by an overseas company, saying it is none of the practice’s business. The practice explains the legal requirement in writing and gives ten working days. No information arrives. The client manager reports the facts to the MLRO, noting that the refusal followed questions about large unexplained receipts. The MLRO concludes there are reasonable grounds to suspect, submits a report, and the practice ends the engagement with a neutral letter stating only that it can no longer act. The MLRO’s decision and reasons are recorded on a restricted file.

What mistakes should firms avoid?

Starting work on a promise that ID will follow, then finishing the job before it arrives.
Continuing to act for an existing client who has refused a refresh request because the fees are valuable.
Ending the relationship without considering whether a report is needed, or without recording the decision.
Telling the client a report has been made or hinting at it in the disengagement letter.
Refunding money to a different account or person from the one that paid it.
Treating the regulation 31(3) exception as covering ordinary accounts or tax compliance work.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.