Customer due diligence (CDD) is the set of checks the Money Laundering Regulations 2017 require before an accountant takes on a client: identify the client and any beneficial owners, verify those identities from reliable independent sources, and understand what the relationship is for. The checks must then be kept up to date through ongoing monitoring. If CDD cannot be completed, the firm must not act and must consider whether a suspicious activity report is needed.

Which accountancy work is covered?

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) apply to auditors, insolvency practitioners, external accountants and tax advisers. Regulation 11 defines an external accountant as a firm or sole practitioner who by way of business provides accountancy services to other persons, and a tax adviser as one who by way of business provides material aid, assistance or advice in connection with the tax affairs of other persons. Bookkeeping, payroll, accounts preparation and tax returns for clients all fall within that net. Every such business must also be supervised for anti money laundering purposes; see AML supervision for accountants.

The rules were amended by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, in force from 30 June 2026, and the accountancy sector’s CCAB guidance was reissued in 2026 to match. This page reflects the amended text.

When must CDD be carried out?

Regulation 27(1) requires CDD when a firm:

  • establishes a business relationship, which covers almost every recurring accounts or tax client;
  • suspects money laundering or terrorist financing;
  • doubts the truth or adequacy of identification documents obtained earlier.

Regulation 27(2) also requires CDD for an occasional transaction of £12,000 or more, a figure now expressed in sterling following the 2026 amendments. For existing clients, regulation 27(8) requires CDD at appropriate times on a risk based approach, when the client’s circumstances relevant to the risk assessment change, and when the firm has a legal duty in the calendar year to contact the client to review beneficial ownership information.

Timing is set by regulation 30(2): verification must happen before the business relationship is established. Regulation 30(3) allows it to be completed during the establishment of the relationship only if that is necessary not to interrupt the normal conduct of business, there is little risk of money laundering, and verification is completed as soon as practicable.

What does CDD actually involve?

Regulation 28 sets the content:

  • Identify and verify the client and assess the purpose and intended nature of the relationship (regulation 28(2)).
  • For a company, obtain and verify its name, company number and registered office address (and principal place of business if different), and take reasonable measures to establish the law it is subject to, its constitution, and the full names of its directors and senior managers (regulation 28(3)). The firm must also take reasonable measures to understand its ownership and control structure (regulation 28(3A)).
  • Identify beneficial owners and take reasonable measures to verify them (regulation 28(4)). For a company, regulation 5 defines a beneficial owner as any individual who ultimately owns or controls, directly or indirectly, more than 25% of the shares or voting rights, or who otherwise exercises control.
  • Check authority of anyone acting for the client, and identify and verify that person (regulation 28(10)).

“Verify” means checking against documents or information from a reliable source independent of the person concerned (regulation 28(18)). Electronic identification can qualify if the process is secure from fraud and misuse (regulation 28(19)).

Two points catch firms out. First, regulation 28(9) says a firm cannot meet the beneficial ownership requirement by relying solely on the register of people with significant control at Companies House. Second, regulation 30A requires the firm, before establishing a relationship with a company, LLP or other registrable entity, to collect an excerpt of that register (or confirm there is nothing on it) and to report any material discrepancy it finds. ICAEW has also confirmed that a director’s Companies House identity verification cannot be relied on to satisfy the MLRs.

What evidence of identity is acceptable?

The 2026 CCAB guidance adds a section, based on JMLSG guidance, setting a hierarchy of reliable and independent documents with a passport as the preferred form of evidence. Where a firm uses a digital verification service, that service should be certified against the UK Digital Verification Services trust framework; an uncertified service cannot be relied on alone. ICAEW reviewers have also noted that many electronic tools mainly screen for sanctions, politically exposed persons and adverse media rather than verifying identity, so firms need to know what their software actually checks.

Regulation 39 allows reliance on another regulated firm to carry out CDD, but the relying firm stays liable for any failure, must obtain the CDD information immediately, and must have arrangements to get copies of the underlying documents on request.

When is enhanced due diligence needed?

Regulation 33(1) requires enhanced due diligence (EDD) and enhanced ongoing monitoring where:

  • the firm’s own risk assessment, or information from its supervisor, identifies a high risk;
  • the client or a party to the transaction is established in a FATF “call for action” country (since 30 June 2026 this mandatory trigger covers the FATF blacklist only, not the grey list);
  • the client or beneficial owner is a politically exposed person (PEP), or a family member or known close associate of one;
  • the client has provided false or stolen identification and the firm proposes to continue;
  • a transaction is unusually complex or unusually large given its nature, there is an unusual pattern of transactions, or a transaction has no apparent economic or legal purpose;
  • any other case that by its nature can present a higher risk.

For PEPs, regulation 35(5) requires senior management approval and adequate measures to establish source of wealth and source of funds. Under regulation 35(3A), the starting point for a domestic PEP is a lower level of risk than for a non domestic PEP.

Can a firm do less for low risk clients?

Yes, within limits. Regulation 37 permits simplified due diligence where the firm determines that the relationship presents a low degree of risk, having considered its own risk assessment and the listed risk factors. The firm must still meet regulation 28 but may adjust the extent, timing or type of measures, and it must keep enough monitoring in place to spot anything unusual. Whatever level is applied, regulation 28(16) requires the firm to be able to show its supervisor that the measures were appropriate to the risks.

What does ongoing monitoring involve?

Regulation 28(11) requires scrutiny of transactions throughout the relationship, including source of funds where necessary, to check they fit what the firm knows of the client, and keeping CDD records up to date. The 2026 CCAB guidance clarifies that source of funds checks are needed when a transaction appears inconsistent with the firm’s knowledge of the client, its business and risk profile. ICAEW’s view is that firms do not need fresh passports simply because the copy on file has expired, if the client’s circumstances and risk profile are unchanged.

All of this sits under the firm wide risk assessment required by regulation 18, which must be kept as an up to date written record unless the supervisor says otherwise.

What does CDD look like for a typical new company client?

Illustration only. A firm is asked to prepare accounts for Alpha Ltd. The shares are held 60% by Ms A and 40% by Beta Holdings Ltd, which is wholly owned by Mr B.

  1. Obtain and verify Alpha Ltd’s name, number and registered office, and note its directors.
  2. Take a copy of Alpha Ltd’s PSC register entry, as regulation 30A requires.
  3. Identify beneficial owners: Ms A (60%) and Mr B, who indirectly controls 40%. Both exceed 25%, so both are identified and verified.
  4. Record why the company wants the service, its trade and expected turnover.
  5. Risk assess. If Mr B turns out to be a senior foreign official, the relationship needs EDD and partner approval before work starts.
  6. If the PSC register shows only Ms A, that is a material discrepancy to report.

What if CDD cannot be completed, and how long are records kept?

Regulation 31(1) says that if the firm cannot apply CDD it must not carry out transactions for the client, must not establish the relationship, must terminate any existing relationship, and must consider whether a disclosure is required under the Proceeds of Crime Act 2002. Regulation 31(3) disapplies this where a professional adviser who is a member of a qualifying professional body is ascertaining the client’s legal position or acting in legal proceedings. See suspicious activity reports for accountants.

Regulation 40 requires CDD records and supporting transaction records to be kept for five years from the date the firm knows, or has reasonable grounds to believe, that the business relationship has ended. After that, personal data obtained for MLR purposes must be deleted unless an exception applies.

Common failings found on monitoring visits include relying on personal knowledge of the client instead of evidence, not updating CDD after a change of ownership, and starting work before checks are finished. CDD is also a natural part of the engagement letter process and of the professional enquiry to the previous adviser.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.