Quick answer
An AML client risk assessment is a documented judgement of how likely a client is to expose the firm to money laundering or terrorist financing. Accountants assess client, service, geographic and delivery-channel risk, assign a risk level, apply matching due diligence and review it during ongoing monitoring.
Written by Waqas Sagar ACA FCCA, Founder of Accotax and Remindoo · Last updated · 6 min read · Part of AML and compliance guides
Why the risk assessment matters
An AML client risk assessment is required under the Money Laundering Regulations 2017 for firms providing accountancy services. It decides how much due diligence you apply and how often you review the client.
Supervisors look for a reasoned, recorded assessment, not a tick box.
Where firms go wrong
The most common failings are assessments done once and never updated, generic reasons copied between clients and no link to the firm-wide risk assessment.
Step by step
Identify and verify the client and beneficial owners. Consider risk factors: the client's business, sources of funds, the countries involved, whether you meet face to face and the services you provide.
Assign a risk level, record your reasons and apply simplified, standard or enhanced due diligence to match. Set a review date, sooner for higher risk.
Re-assess when something changes, and keep records for five years after the relationship ends.
| Area | Lower risk | Higher risk |
|---|---|---|
| Client | Long-established UK trading company | Complex ownership, cash-intensive |
| Geography | UK only | High-risk third countries |
| Delivery | Met in person | Non-face-to-face without checks |
| Service | Payroll | Handling client money, company formations |
Linking to your firm-wide assessment
Your client assessments should reflect the risks your firm has identified overall. Follow your supervisor's guidance, such as that from ICAEW, ACCA or HMRC, for the factors they expect.
How Remindoo solves this
Remindoo includes built-in digital ID and AML checks alongside a manual AML risk assessment. Results and evidence are saved on the client card, each check appears on the client timeline, and documents are collected through the document portal.
- Manual AML Risk Assessment
- Digital AML
- Client Card
- Client Timeline
- Document Portal
Frequently asked questions
How often should client risk be reviewed?
As part of ongoing monitoring, and whenever something significant changes. Many firms review high-risk clients at least annually and lower-risk clients less often, in line with their firm-wide risk assessment and supervisor guidance.
What is enhanced due diligence?
Enhanced due diligence is extra checking for higher-risk clients, such as obtaining more information on source of funds and wealth, and closer ongoing monitoring. It is required in specific cases under the regulations.
Can AML checks be done digitally?
Yes. Digital identity verification is widely used by UK accountants and is built into Remindoo. The firm still needs to make and record the risk judgement.
How long must AML records be kept?
Generally five years after the business relationship ends, under the Money Laundering Regulations 2017.
