B · Registrations & compliance
Client Due Diligence for Accountants: CDD, EDD and ID Checks
Last updated:
Quick answer
Client due diligence (CDD) is the process of identifying a client and verifying their identity before providing accountancy services, required under the Money Laundering Regulations 2017. Most clients need standard CDD; higher-risk clients such as PEPs or complex structures need enhanced due diligence (EDD); and records must be kept for at least five years after the relationship ends.
Key takeaways
- CDD must be completed before establishing a business relationship, not afterwards.
- There are three levels: simplified (SDD), standard (CDD) and enhanced (EDD), chosen by risk.
- For companies and trusts you must identify beneficial owners with 25%+ ownership or control, not just the person you deal with.
- Politically exposed persons (PEPs) and their family members always require enhanced due diligence.
- Records of ID checks and supporting evidence must be kept for five years after the relationship ends.
What is client due diligence?
CDD is the set of checks a firm must carry out to identify a client, verify that identity using reliable documents or electronic verification, and understand the purpose and nature of the relationship.
Under the Money Laundering Regulations 2017, CDD must be applied when you establish a business relationship, carry out an occasional transaction above the relevant threshold, or when you suspect money laundering or doubt previously obtained identification information.
It is not a one-off box-ticking exercise. You need to understand who you are dealing with, who owns and controls the entity, and whether the relationship makes sense given what you know about the client.
What are the different levels of due diligence?
Firms apply simplified due diligence for genuinely low-risk situations, standard CDD for the majority of clients, and enhanced due diligence where the risk assessment identifies higher risk factors.
| Level | When used | Typical checks |
|---|---|---|
| Simplified (SDD) | Genuinely low-risk clients only, e.g. certain listed companies or public bodies | Basic identification, reduced ongoing monitoring — must still be justified in writing |
| Standard (CDD) | Most clients | Identity verification, beneficial ownership check, purpose of relationship, source of funds understanding |
| Enhanced (EDD) | PEPs, high-risk jurisdictions, complex or unusual structures, no face-to-face contact | Additional source of funds/wealth evidence, senior sign-off, more frequent monitoring |
What documents or checks count as identity verification?
Firms typically use a combination of government-issued photo ID, proof of address and, increasingly, electronic identity verification services rather than relying on paper documents alone.
- Passport or driving licence for individuals
- Recent utility bill, bank statement or council tax bill for address verification
- Companies House details for corporate clients, including officers and PSCs
- Electronic ID verification (eIDV) tools, which many firms now use instead of, or alongside, physical documents
Whatever method you use, keep a copy or a clear record of what was checked, when, and by whom — the record is what a supervisor will ask to see, not just your recollection that it was done.
Who counts as a beneficial owner?
For a company, a beneficial owner is generally anyone with more than 25% of the shares or voting rights, or who otherwise exercises significant control, and each one must be identified.
For trusts, the beneficial owners include the settlor, trustees, beneficiaries and anyone else exercising control. For partnerships, it is generally anyone with more than a 25% share of capital, profits or voting rights. Cross-check against the Companies House People with Significant Control register where relevant, but do not treat that register as conclusive on its own — verify independently where the structure is complex.
What extra steps are needed for PEPs?
A politically exposed person, their family members and known close associates must always be treated as higher risk and subject to enhanced due diligence, regardless of any other factors.
This means obtaining senior management approval before taking on the relationship, establishing the source of wealth and source of funds, and conducting more frequent ongoing monitoring. Being a PEP does not mean you cannot act for them — it means the file needs to show the extra scrutiny was applied.
What does ongoing monitoring involve?
CDD does not end at onboarding — firms must keep client information up to date and review transactions and instructions against what is known about the client throughout the relationship.
- Re-verifying identity documents when they expire or on a periodic review cycle
- Watching for transactions or requests inconsistent with the client's known business
- Re-running risk ratings when a client's circumstances change materially
- Screening for sanctions and PEP status on a recurring basis, not just at onboarding
How long do CDD records need to be kept?
Records of the checks carried out and the evidence obtained must be retained for five years after the business relationship ends.
This applies to copies of identity documents, the risk assessment for that client, and evidence of any transactions monitored. After five years the records should generally be deleted unless there is a legal reason to keep them, in line with GDPR data minimisation principles.
When should you refuse or exit a client relationship?
If you cannot complete satisfactory due diligence, or if ongoing monitoring raises unresolved concerns, you should not proceed with, or should terminate, the relationship and consider whether a suspicious activity report is required.
Refusing to act, or disengaging, needs to be handled carefully so as not to tip off a client where a SAR has been or will be filed. This is an area where taking advice from your professional body or MLRO before acting is sensible.
How Remindoo helps
Client due diligence generates a lot of paperwork, and the risk is that it lives in emails and separate folders rather than against the client it relates to. Remindoo lets you record AML checks, risk levels and review notes on the client record itself, alongside Companies House sync data for company clients, so beneficial ownership and officer information is pulled through rather than retyped. Standardised onboarding requests mean the documents you need for ID verification are requested consistently for every new client rather than depending on memory. Because the risk level and notes sit on the same record you use day to day, ongoing monitoring becomes a case of checking a client's existing record rather than searching for a due diligence file that may or may not have been kept up to date.
Frequently asked questions
Do I need to redo CDD for existing long-standing clients?
Yes, on a risk-based cycle. The regulations require ongoing monitoring, so even long-standing clients should have identity information reviewed periodically, particularly if their risk profile or circumstances change.
What is simplified due diligence and can I always use it?
Simplified due diligence is a reduced level of checking for genuinely low-risk situations, such as certain public authorities. It cannot be applied by default — you must justify why the client qualifies as low risk.
Do sole traders need beneficial ownership checks?
Beneficial ownership as a concept applies to companies, trusts and partnerships. For an individual sole trader you still verify their identity, but there is no separate ownership layer to check.
Can I rely on another firm's CDD checks?
In limited circumstances you can rely on CDD carried out by certain regulated third parties, but you remain legally responsible for it being adequate, so most firms prefer to complete their own checks.
What is source of funds versus source of wealth?
Source of funds is where the money for a specific transaction came from; source of wealth is the broader origin of a client's overall wealth. EDD typically requires evidence of both.
Do I need to screen every client for sanctions?
Yes, sanctions screening should be part of your standard onboarding process for all clients, since sanctions obligations apply irrespective of money laundering risk level.
What if a client refuses to provide ID documents?
If you cannot complete due diligence, you should not proceed with the relationship, and in some circumstances should consider whether the refusal itself is suspicious and warrants a report.
Start your free Remindoo trial
Set up deadlines, onboarding and workflows for your new practice with a 60-day free trial.
Sources
Last updated 23 September 2026. General guidance, not legal or regulatory advice. Check with your professional body.
