Sending work to an offshore team does not move any responsibility away from the UK firm. The firm stays answerable to its clients, its professional body, HMRC and the ICO for confidentiality, data protection, anti money laundering compliance and the quality of what is delivered. Letting overseas staff of another organisation access client files is usually a restricted transfer under UK GDPR, so the firm needs a transfer mechanism, a processor contract, tight access controls, a documented review of the work and clear disclosure to clients and insurers.

Who is responsible when work is done offshore?

The UK firm, in every respect that counts. ACCA states that it has no specific regulations on outsourcing and offshoring, but that its Code of Ethics and Conduct applies: professional competence and due care requires reasonable steps to ensure that those working under the accountant’s authority have appropriate training and supervision, and section 220 requires an accountant who uses the work of others to judge what steps are needed, considering the reputation, expertise and resources of the provider and whether it is subject to professional and ethics standards. ACCA’s guidance on professional indemnity says the firm is still liable to clients for outsourced work, whether it is outsourced domestically or overseas.

ICAEW’s helpsheet on using a subcontractor makes the same point from a different direction. Where the firm keeps responsibility for the client and passes the work on as its own, the firm is the subcontractor’s client, and issues such as confidentiality, conflicts and the technical quality of the work remain the firm’s concern. That framing applies equally to an offshore provider.

Does sending work offshore breach client confidentiality?

Not if it is handled properly, but it does engage the duty. ICAEW’s Code of Ethics, paragraph R114.1, requires an accountant to take reasonable steps to ensure that personnel under the accountant’s control, and individuals from whom advice and assistance are obtained, comply with the accountant’s duty of confidentiality. R114.3 allows disclosure where it is authorised by the client and not prohibited by law. In practice that means:

  • telling clients in the engagement letter that work may be carried out by an overseas provider, and naming the countries where possible;
  • signed confidentiality agreements with the individual offshore staff as well as the provider, which ACCA’s data protection guidance suggests considering;
  • a route for clients who object, such as keeping their work in the UK team.

The wider duty is explained in confidentiality for accountants.

Is remote access from abroad a data transfer?

Usually, yes. The ICO’s guidance says a transfer includes making personal information accessible to a separate organisation outside the UK, for example by allowing remote access to your systems. A transfer is restricted where UK GDPR applies, the firm initiates the transfer, and the receiver is located outside the UK and is a separate legal entity. An offshore provider, including a subsidiary company, is a separate legal entity, so a model where offshore staff log in to the firm’s cloud system is still caught even though the data never leaves the UK servers.

A restricted transfer is allowed if the destination is covered by UK adequacy regulations. The ICO’s list includes the EEA countries, Andorra, Argentina, the Faroe Islands, Gibraltar, Guernsey, the Isle of Man, Israel, Jersey, New Zealand, Switzerland, Uruguay and the Republic of Korea, with partial adequacy for Canada, Japan and the United States. India, the Philippines, Pakistan and South Africa, which are common offshoring locations, are not on it. For those, ACCA’s guidance says the firm needs an Article 46 mechanism such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, plus a transfer risk assessment of whether local laws could undermine those protections.

Alongside the transfer rules, Article 28 of UK GDPR requires a written contract with the provider as processor, covering processing only on documented instructions, confidentiality, security, use of sub processors, assistance with individuals’ rights, deletion at the end of the contract and audits. The firm’s privacy notice should mention overseas providers. The broader framework is in data protection for accountancy practices.

What security controls should the firm insist on?

ACCA’s cyber security guidance on outsourcing says that with remote access the focus shifts from storage to controlling what overseas staff can do once inside the firm’s systems. Its list of technical measures includes multi factor authentication, a VPN, encryption in transit and at rest, role based access limited to what is strictly necessary, audit logging, and, in sensitive cases, disabling copy and download. It recommends requiring breach notification within tight timeframes regardless of local law, prohibiting unauthorised sub processing, and seeking evidence such as ISO 27001 or SOC 2 certification.

Supplier oversight is a known weak spot. In ICAEW’s 2026 Practice Assurance monitoring report on cyber security among larger firms, 36% set minimum security requirements for suppliers but only 25% had them in their contracts, and only 32% had exercised a right to audit or require reporting from suppliers. More on the controls themselves is in cyber security for accountancy practices.

Access to HMRC systems needs separate thought. The HMRC Standard for Agents expects agents to access client data in HMRC systems only with authorisation and through their agent services account, and to keep credentials safe from unauthorised use. Offshore staff should never be given a client’s own Government Gateway details.

How does anti money laundering work with an offshore team?

ACCA’s guidance is clear that the firm cannot delegate liability under the Money Laundering Regulations 2017. Customer due diligence must be carried out and documented by the firm, not the provider. Only the firm’s MLRO can submit a suspicious activity report, so offshore staff must be trained to report concerns internally. Records held or processed abroad must be retrievable promptly for the supervisor. ACCA also suggests keeping work for higher risk clients in the UK team and reflecting the arrangement in the firm’s own policies and firm wide risk assessment. ICAEW treats a subcontractor as a quasi employee for these purposes and expects the firm to provide AML training and include the subcontractor in its screening procedures.

How should quality be controlled?

ACCA points to the self review threat in its Code and says members using outsourcing need to review the work produced. AAT’s Practice Assurance Standards expect work, including that of subcontractors, to be adequately supervised and reviewed before it is finalised. A workable model is to define each outsourced task with a checklist, send work back with written review points, track error rates by preparer and keep judgement areas, client contact and final sign off in the UK. HMRC’s Standard for Agents also expects reasonable steps to make sure third party input used in acting for a client provides accurate results.

What about insurance and sanctions?

ACCA warns that insurers expect disclosure of outsourcing, that failure to disclose could result in a claim being disputed, and that some policies exclude claims from outsourced work unless conditions on due diligence and supervision are met. It suggests checking whether the policy’s territorial limits extend to where the outsourced staff are based. ICAEW notes that for the anti subrogation clause to extend to a subcontractor, the insurer must be told the subcontractor’s name and status. ACCA also flags sanctions risk, as the status of providers in volatile jurisdictions can change quickly. See professional indemnity insurance for accountants.

How might a firm set this up?

Illustration only. A practice engages a provider in India to prepare bookkeeping and year end working papers. It updates its engagement letters and privacy notice, signs an Article 28 contract and the UK International Data Transfer Agreement, records a transfer risk assessment and gives the provider’s named staff accounts in its cloud software with multi factor authentication, no download rights and access only to assigned clients. Offshore staff complete the firm’s AML and confidentiality training. A UK manager reviews every file before it reaches the client, and the broker is told about the arrangement before renewal.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.