Enhanced due diligence for accountants

Enhanced due diligence (EDD) is the extra layer of checks an accountant must add to normal customer due diligence whenever a client or transaction presents a higher risk of money laundering or terrorist financing. Regulation 33 of the Money Laundering Regulations 2017 lists the cases where it is mandatory, including politically exposed persons, links to FATF call for action countries and unusually complex or unusually large transactions. The firm must then be able to show its supervisor what extra it did and why that was enough.

When is enhanced due diligence mandatory?

Regulation 33(1) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) requires enhanced due diligence measures and enhanced ongoing monitoring, on top of the standard measures in regulation 28, in these cases:

any case the firm has itself identified as high risk in its firm wide risk assessment under regulation 18(1), or which is flagged as high risk in information from its supervisor;
any business relationship with a person established in a FATF call for action country, or any relevant transaction where either party is established in one;
correspondent relationships with credit or financial institutions (rarely relevant to accountants);
where the client or potential client is a politically exposed person (PEP), or a family member or known close associate of a PEP;
where the client has provided false or stolen identification documents or information and the firm proposes to continue acting;
where a transaction is unusually complex or unusually large given the nature of the transaction, there is an unusual pattern of transactions, or the transactions have no apparent economic or legal purpose;
any other case which by its nature can present a higher risk.

The last limb is the one most practices meet day to day. It means EDD is not confined to a closed list: a client that the firm’s own client risk assessment rates as high risk must receive EDD even if none of the named triggers applies. Standard checks are covered in customer due diligence for accountants; this page deals only with what sits on top.

What changed on 30 June 2026?

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621) came into force on 30 June 2026 and changed two of the regulation 33 triggers:

Transactions. Regulation 33(1)(f)(i) now refers to transactions that are “unusually complex or unusually large in each case given the nature of the transaction”. ICAEW’s summary of the updated CCAB guidance explains that this does not create a new obligation but lets firms focus on genuinely unusual activity rather than routine work that happens to be large or technical.
High risk countries. The mandatory country trigger in regulation 33(1)(b) is now limited to FATF call for action countries, defined in regulation 33(3)(a) as those on the FATF list of High Risk Jurisdictions subject to a Call for Action, often called the FATF blacklist. ICAEW notes that firms’ own assessments of risky jurisdictions are unlikely to change, because other high risk countries still fall within the general and risk assessment triggers.

The updated sector guidance also clarifies that its list of general EDD triggers is non exhaustive and non prescriptive.

Which risk factors point to a high risk case?

Regulation 33(6) lists factors a firm must take into account when deciding whether a situation is high risk. Those most relevant to accountancy clients include:

the relationship is conducted in unusual circumstances;
the client is a vehicle for holding personal assets, has nominee shareholders or bearer shares, or has a corporate structure that is unusual or excessively complex for its business;
the client is cash intensive;
the client is not met face to face and there are no safeguards such as a compliant electronic identification process;
payments come from unknown or unassociated third parties;
the service involves nominee directors, nominee shareholders or shadow directors, or forming companies in a third country;
geographical links to countries with weak AML systems, significant corruption, sanctions or support for terrorism.

HMRC’s guidance for supervised businesses at AMLG11600 adds being offered an excessive fee for the level of service provided. Regulation 33(7) is a useful counterweight: the presence of one or more factors does not always mean the risk is high. The decision is a judgement, and it should be written down.

What extra checks does EDD involve?

Regulation 33(5) says EDD may include, depending on the case, seeking additional independent and reliable sources to verify information, taking additional measures to understand the background, ownership and financial situation of the client and other parties, taking further steps to be satisfied that a transaction is consistent with the purpose of the relationship, and increasing monitoring. Two triggers carry fixed minimum content:

Unusual transactions (regulation 33(4)): examine the background and purpose of the transaction as far as reasonably possible, and increase the degree and nature of monitoring to decide whether it appears suspicious.
FATF call for action countries (regulation 33(3A)): obtain additional information on the client and beneficial owner and on the intended nature of the relationship, information on source of funds and source of wealth, the reasons for transactions, senior management approval, and enhanced monitoring with more frequent controls.

PEPs have their own minimum set in regulation 35(5); see politically exposed persons. HMRC’s examples of practical EDD steps include additional identity evidence or electronic verification alongside manual checks, validating documents against an authoritative source, insisting that payment comes from an account in the client’s own name, and more work to understand the history, ownership and finances of the parties. HMRC also points out that certifying a copy document does not by itself amount to EDD.

How should source of funds and source of wealth be evidenced?

HMRC’s guidance at AMLG11630 draws the distinction clearly. Source of funds is where the money for this particular transaction or relationship came from and the activity that generated it; knowing that it came from a UK bank account is not enough. Source of wealth is how the client built up their overall net worth. HMRC suggests evidence such as bank statements showing regular credits, documentation of gifts, audited accounts, share registers or property records, and stresses that the firm should consider whether the explanation is plausible rather than simply collecting documents.

Accountants often hold much of this already: prior year accounts, tax returns and payroll records can corroborate a client’s stated income. Recording that cross check is legitimate evidence, provided the file says which records were reviewed and what they showed.

How do you evidence EDD on the client file?

Regulation 28(16) requires a firm to be able to demonstrate to its supervisor that the extent of its measures is appropriate to the risks. Regulation 40 requires copies of documents and information obtained under regulations 28 and 33 to 37 to be kept for five years from the end of the relationship. In practice a good EDD file shows:

the trigger, with the date it was identified and by whom;
the specific risk it creates for this client;
each extra step taken and the evidence obtained, linked to that risk;
any senior management approval, signed and dated;
the conclusion, the residual risk rating and the planned frequency of review.

HMRC states that if required EDD measures are not taken it will expect an evidence based explanation backed by the firm’s risk assessment, and may impose penalties if none is given. ICAEW’s monitoring reviewers make the complementary point that simply collecting more identity documents does not mitigate a higher risk scenario: the extra work has to address the risk actually identified.

What does EDD look like in practice?

Illustration only. A new client asks a practice to prepare accounts for a UK property company. The sole shareholder is a UK resident, but the company’s start up funds of £400,000 arrived from a relative’s company abroad and there is no clear commercial reason for the arrangement. The engagement partner rates the client high risk under the firm’s methodology. EDD might consist of: verifying the shareholder’s identity by two independent methods; obtaining the loan agreement and the overseas company’s registration details; obtaining bank statements tracing the funds; asking for an explanation of the relative’s business and checking it against public sources; partner sign off before engagement; and quarterly rather than annual review of the client’s transactions. If the explanation does not hold together, the question shifts from EDD to whether a suspicious activity report is needed.

What are the common mistakes?

Treating EDD as a longer identity checklist rather than work aimed at the specific risk.
Rating a client high risk but recording no enhanced steps, which leaves the file inconsistent.
Applying EDD at onboarding but not the enhanced ongoing monitoring regulation 33(1) also requires; see ongoing monitoring.
Relying on an electronic screening tool that checks sanctions and PEP lists but does not verify identity.
Missing the client that becomes high risk part way through the relationship, for example after acquiring an overseas parent.

A firm’s supervisor will test these points on a monitoring visit; see AML supervision for accountants.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.