Relying on another firm's due diligence

Regulation 39 of the Money Laundering Regulations 2017 lets an accountancy firm rely on certain other regulated businesses to carry out parts of customer due diligence, but the relying firm remains liable for any failure. Reliance only works if the firm obtains the information immediately and has an arrangement giving it copies of the underlying documents on request, and it never covers ongoing monitoring or the firm’s own risk assessment.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What does regulation 39 actually allow?

Regulation 39(1) permits a relevant person to rely on a “third party” to apply the customer due diligence measures in regulation 28(2) to (6) and (10), and the discrepancy reporting measures in regulation 30A. In plain terms, those are:

identifying and verifying the client (regulation 28(2)(a) and (b));
assessing the purpose and intended nature of the relationship (regulation 28(2)(c));
for a company client, obtaining and verifying its name, number and registered office, and taking reasonable measures on its constitution and directors (regulation 28(3));
identifying beneficial owners and understanding ownership and control (regulation 28(3A) to (6));
verifying anyone acting on the client’s behalf (regulation 28(10)).

The same sentence of regulation 39(1) adds that, notwithstanding the reliance, the relevant person remains liable for any failure to apply those measures. Reliance moves the work, not the responsibility. The underlying requirements are explained in our guide to customer due diligence for accountants.

Who can you rely on?

Regulation 39(3) limits the third party to:

another relevant person subject to the Regulations under regulation 8, such as a UK bank, law firm or accountancy practice;
a business in a third country that is subject to customer due diligence and record keeping requirements equivalent to the fourth money laundering directive, and supervised for compliance in an equivalent way;
organisations whose members consist of such persons.

Regulation 39(4) prohibits reliance on a third party established in a “FATF call for action country”, wording substituted by the Money Laundering and Terrorist Financing (Amendment) Regulations 2026. Regulation 39(5) relaxes this for a branch or majority owned subsidiary that fully applies group wide policies under regulation 20 or equivalent rules.

ICAEW, which supervises many firms, takes a cautious line in its published AML “fact or fiction” guidance: reliance on another party’s due diligence is possible but unlikely, needs a written agreement, and the other party must be a regulated entity in the UK.

Run an accountancy or bookkeeping practice? Solar Protect runs fee protection schemes for practices, so the cost of dealing with an HMRC enquiry into a client is covered rather than written off.

See how our accountant schemes work or call 01795 841 310.

What must you obtain and agree?

Regulation 39(2) sets two conditions that must both be met when you rely:

Immediate information. You must immediately obtain from the third party all the information needed to satisfy the regulation 28 requirements on the client, the beneficial owner and anyone acting for the client. A promise to send it later is not enough.
Arrangements for documents. You must enter into arrangements that let you obtain immediately on request copies of the identification and verification data and other relevant documents, and that require the third party to keep them for the period in regulation 40. That period is five years from the date the business relationship ends, or the occasional transaction completes.

ICAEW adds that the third party must agree to give your firm access to its due diligence documents, and that you need to be able to prove the conditions were met, including the agreement, because a monitoring reviewer may ask for evidence.

What does reliance not cover?

Regulation 39 is tied to regulation 28(2) to (6) and (10) and regulation 30A. It does not extend to:

Ongoing monitoring under regulation 28(11), meaning scrutiny of the client’s transactions and keeping due diligence up to date. See ongoing monitoring.
Your own risk assessment. Regulation 28(12) requires the extent of due diligence to reflect your firm wide risk assessment and your assessment of risk in the particular case. ICAEW stresses that even where reliance conditions are met, you are still responsible for assessing the client’s risk. See client risk assessment.
Enhanced due diligence under regulation 33, which is not among the measures listed in regulation 39(1). Where a client is high risk, the extra steps are yours; see enhanced due diligence.
Suspicion reporting. Nothing in regulation 39 passes on your own obligations to report knowledge or suspicion.

Why does liability stay with the relying firm?

Because the regulation says so, twice: regulation 39(1) for reliance and regulation 39(7) for agents and outsourcing. The consequences of a failure fall on you, and Schedule 6 lists both the due diligence measures in regulation 28 and the reliance conditions in regulation 39(2) and (4) as relevant requirements. Under regulation 86, contravening a relevant requirement is a criminal offence, punishable on indictment by up to two years’ imprisonment, a fine or both. In deciding whether an offence was committed, the court must consider whether the person followed relevant guidance issued by the FCA or by a supervisory authority or appropriate body and approved by the Treasury, and regulation 86(3) provides a defence for someone who took all reasonable steps and exercised all due diligence.

A relying firm that cannot produce the client’s verification documents when its supervisor asks, because the third party has merged, closed or simply does not reply, will struggle to show it took all reasonable steps.

How is reliance different from outsourcing?

Regulation 39(7) allows due diligence to be carried out through an agent or an outsourcing service provider, provided the arrangements state that the relevant person remains liable. An outsourcing service provider is someone who performs a process that the firm would otherwise do itself and who is not its employee (regulation 39(8)). An electronic verification provider or a firm that collects identity documents for you is usually doing outsourced work: you receive the evidence and you assess it. Reliance, by contrast, means accepting another regulated firm’s completed checks without repeating them.

Group reliance has its own rule. Regulation 39(6) treats the regulation 39(2) conditions as met where the third party is in the same group, the group applies equivalent programmes, and those are supervised at group level.

A professional clearance letter from a previous accountant is not reliance either. It tells you about professional reasons not to act; it does not hand over due diligence. See professional clearance.

How might it work in practice?

Illustration only. A firm of solicitors introduces a property company to an accountancy practice for bookkeeping and tax returns. The solicitors have already identified and verified the company, its directors and its two beneficial owners.

The practice confirms the solicitors are a UK firm subject to the Regulations.
Before taking the client on, it receives the full due diligence information: names, verification details, ownership structure and the purpose of the relationship.
Both firms sign a reliance agreement under which the solicitors will provide copies of documents immediately on request and keep them for five years after the relationship ends.
The practice carries out its own client risk assessment and screens the owners for politically exposed person status, then sets a monitoring cycle.

Two years later a supervisory review asks for a copy of one owner’s passport. The solicitors provide it the same day. Had they not, the practice would have had a gap in its records, and that gap would be the practice’s problem.

What mistakes do firms make?

Calling a verbal assurance from a lender or solicitor “reliance” with no written arrangement.
Receiving a summary rather than all the information needed under regulation 28.
Relying on an unregulated introducer, or on a business in a FATF call for action country.
Skipping the firm’s own risk assessment because the client “has been checked”.
Not recording the decision to rely in the firm’s procedures. Regulation 19(3)(d) requires reliance to be covered in written AML policies, controls and procedures.

Supervision arrangements for accountants are covered in AML supervision for accountants.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.

Relying on another firm’s due diligence