Every client should carry a documented AML risk rating, usually low, normal or high, that reflects both the firm wide risk assessment and the facts of that client, as regulation 28(12) of the Money Laundering Regulations 2017 requires. The rating is driven by the high and low risk factors in regulations 33(6) and 37(3), and decides whether simplified, standard or enhanced due diligence applies. The file must record why the rating was given, who approved it and when it was last reviewed.
Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.
What does the law require of a client risk assessment?
The Money Laundering Regulations 2017 (MLRs) do not prescribe a scoring system, but they set the inputs and the test:
- Regulation 28(12): how a firm carries out customer due diligence, and how much it does, must reflect its firm wide risk assessment under regulation 18(1) and its assessment of the level of risk in the particular case, and may differ from case to case.
- Regulation 28(13): in assessing the risk in a particular case the firm must take account of, among other things, the purpose of the relationship or transaction, the size of the assets or transactions involved, and the regularity and duration of the relationship.
- Regulations 33(6) and 37(3): lists of customer, product, service, transaction, delivery channel and geographical factors pointing to higher or lower risk. Both regulations add that a factor being present does not always mean the risk is high, or low (regulations 33(7) and 37(4)).
- Regulation 28(16): the firm must be able to show its supervisor that the extent of its measures is appropriate to the risks.
The client rating therefore sits beneath the practice’s firm wide AML risk assessment and feeds into customer due diligence.
Which risk categories should a firm use?
ACCA’s technical factsheet on identifying client risk says every client must be risk categorised so the firm knows what level of due diligence to complete, and suggests categories such as low, normal or medium, and high. It expects most clients to be normal, describes low risk as a rare exception, and says it is expected that a firm will have some high risk clients. A high rating is not an accusation: it shows the firm has spotted high risk factors and is managing them, and it does not mean the client is suspected of money laundering.
ICAEW’s methodology adds that a firm’s own experience can move a rating. A firm with no experience of clients in a particular country may treat them as normal or high even if other firms would say low, while a firm that knows a sector well may rate a client as normal but still carry out additional checks.
Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.
What makes a client high risk?
Some situations force enhanced due diligence whatever the score. Under regulation 33(1) these include a high risk identified in the firm’s own assessment or by its supervisor, a business relationship with a person established in a FATF “call for action” country (narrowed to that list from 30 June 2026), a politically exposed person or their family or close associate, false or stolen identity documents, and transactions that are unusually complex or unusually large or have no apparent economic or legal purpose.
Beyond those triggers, regulation 33(6) lists factors to weigh, including:
- a relationship conducted in unusual circumstances;
- a company or trust used as a vehicle for holding personal assets, nominee shareholders or bearer shares;
- a cash intensive business;
- a corporate structure that is unusual or excessively complex for the business;
- non face to face relationships without safeguards such as a compliant electronic identification process;
- payments from unknown or unassociated third parties;
- services involving nominee directors or shareholders, or forming companies in a third country;
- countries with weak AML systems, significant corruption or criminal activity, or subject to sanctions.
ACCA’s examples of high risk clients add high net worth individuals, foreign PEPs, high value businesses such as jewellers and car dealerships, and sectors such as money services, import and export, charities, gambling, precious metals and oil and gas.
When can a client be rated low risk?
Regulation 37(3) lists lower risk factors, including a client that is a public administration or publicly owned enterprise, a company listed on a regulated market, and an individual or business resident or operating in the United Kingdom or a country with effective AML systems. ACCA’s low risk examples are public administrations and listed companies. Under regulation 37, simplified due diligence is permitted only where the firm has determined the relationship presents a low degree of risk, having taken account of its firm wide assessment, its supervisor’s information and those factors. It may adjust the extent, timing or type of checks but must still carry out enough monitoring to detect unusual or suspicious transactions.
A UK address on its own does not make a client low risk. Most local owner managed businesses will sit at normal.
How does this work for three typical clients?
Illustration only. A practice applies its own rules to three new clients.
| Client | Key facts | Rating and reason recorded |
|---|---|---|
| Self employed electrician | UK resident, met in person, accounts and tax return only, income through a business bank account. | Normal. No high or low risk factors; standard CDD; review at the annual return. |
| Restaurant company | Largely cash takings, payroll service required, owner introduced by another client. | High. Cash intensive business and payroll service; enhanced checks on source of funds, analytical review of takings against purchases, MLRO approval at take on. |
| Listed company | Shares listed on a UK regulated market, tax compliance work only. | Low. Regulation 37(3)(a)(iv) factor and no high risk factors; simplified checks, with monitoring continuing. |
The point of the table is the third column. A rating with no reason is hard to defend.
What should the client file record?
ACCA says the rationale for each rating should be clearly documented in the client file, signed off by a partner, senior manager or the money laundering reporting officer, and that periodic reviews should be documented even when the rating has not changed. Records of CDD documents and information must be kept under regulation 40 for at least five years from the date the firm knows, or has reasonable grounds to believe, the business relationship has ended.
ICAEW’s supervision reports show why this is needed. In one case a firm had rated a client with operations in a high risk third country as normal risk and had not applied the full enhanced measures; it had to review its whole client base. In another, the firm had correctly concluded that clients were high risk but had not documented its assessment of those risks, and was found non compliant and referred for further investigation.
How often should ratings be reviewed?
Regulation 28(11) requires ongoing monitoring, including keeping CDD information up to date, and regulation 27(8) requires CDD to be reapplied to existing clients at appropriate times on a risk based approach and whenever the firm becomes aware that circumstances relevant to its risk assessment have changed. No fixed interval is set. A common approach is to review high risk clients more often than others; in one ICAEW case study the firm’s remedial procedures committed to reviewing higher risk clients at least every six months and standard risk clients annually. ACCA also expects the client risk process itself to be reviewed regularly for emerging issues and regulatory change.
What are the common mistakes?
- Rating almost every client low to justify lighter checks.
- Rating the client but ignoring the risk in the service, such as payroll, company formation or handling client money.
- Failing to update the rating when a client starts trading overseas or changes ownership.
- Treating a high rating as a reason to file a report. Suspicion, not the rating, triggers a suspicious activity report.
- Continuing to act when CDD cannot be completed. Regulation 31 requires the firm to stop, end any existing relationship and consider whether a report is needed.
Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.
Related Accountapedia entries
- Enhanced due diligence for accountants
- Simplified due diligence: when it is allowed
- Ongoing monitoring of clients for AML
- High risk third countries and AML
- Source of funds and source of wealth checks
- Can HMRC assess a year you were never asked to file
Related cover: Professional indemnity insurance for accountants and What professional indemnity insurance covers. For the whole practice, see insurance for accountants and fee protection schemes for your clients.
Sources
- legislation.gov.uk: SI 2017/692, regulation 28
- legislation.gov.uk: SI 2017/692, regulation 33
- legislation.gov.uk: SI 2017/692, regulation 37
- legislation.gov.uk: SI 2017/692, regulation 27
- legislation.gov.uk: SI 2017/692, regulation 40
- legislation.gov.uk: SI 2017/692, regulation 31
- ACCA: Tf ACCA identifying client risk 0124
- ICAEW: Icaew firm wide risk assessment methodology
- ICAEW: Icaew aml report highlights need for customer due diligence
- ICAEW: 2026 ccab aml guidance for the accountancy sector
Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.