AML for bookkeepers and accountants in practice: supervision, CDD and what inspectors find

Who counts as an accountancy service provider

You are in scope as an external accountant if you provide accountancy services to other people by way of business (MLR reg 11(c)), or as a tax adviser if you give “material aid, or assistance or advice” on other people’s tax affairs (reg 11(d)). Bookkeeping, payroll and completing tax returns all fall within these definitions.

The MLRs do not define “accountancy services”. The accountancy sector guidance from the Consultative Committee of Accountancy Bodies (CCAB AMLGAS) does: any service “which involves the recording, review, analysis, calculation or reporting of financial information”, provided other than under a contract of employment (1.2.2).

AMLGAS is approved by HM Treasury, and courts must take account of it. The 2026 edition reflects the law as at 1 July 2026 and was published on 5 August 2026. HMRC’s AMLG2000 simply points accountancy service providers (ASPs) to it.

Who supervises you: professional body or HMRC

Every accountancy service provider needs an AML supervisor. Under MLR reg 7, that is your professional body supervisor if you are eligible, such as ICAEW, ACCA, AAT, ICB, IAB, IFA, CIOT or ATT, and HMRC if you are not. Failing to register was behind most of HMRC’s penalties on accountancy firms in April to September 2025.

Eligibility differs by body. ACCA and ICB supervision comes with a practising certificate or licence; CIOT and ATT supervision is opt-in. Check with your own body, or use our AML supervisor finder.

If HMRC supervises you, its fees from 1 December 2025 are a one-off £300 application fee, £400 per premises when you apply and £400 per premises every year with your annual declaration, plus £40 for each approval check on a beneficial owner, officer or manager (BOOM). Our HMRC AML fees calculator works out your total.

Risk assessments: firm-wide and for each client

You need a firm-wide risk assessment and a risk assessment for each client, and both should fit your actual practice. Inspectors still find them generic. ICAEW’s firm-wide risk assessment findings rose to 5.2% of firms reviewed in 2025/26, and ACCA’s thematic review found assessments that did not sufficiently consider firms’ activities, client base and geography.

HMRC’s AMLG3700 says the 2025 national risk assessment rates ASP services as high risk for money laundering and low for terrorist financing. It names “payroll, bookkeeping, insolvency and tax advice” as attractive to launderers. Your firm-wide assessment should say how those risks apply to your services and clients.

ACCA’s common findings include third-party templates and software used without tailoring. One ICAEW member was excluded and fined £15,000, plus £8,750 costs, for failing to supply a firm-wide risk assessment, a client risk assessment and CDD evidence. Our guide to client risk assessments for small firms has a method and a form.

Customer due diligence in practice

CDD means identifying and verifying your client and any beneficial owners, understanding the work and keeping that picture up to date. It is where inspectors find most problems: ongoing CDD was ICAEW’s top finding in 2025/26 at 7.8% of firms reviewed, and CDD for new clients rose from 3.0% to 4.2%.

The basics are in our guide to customer due diligence; higher-risk cases are covered in the EDD checklist. HMRC’s red flags for accountancy service providers (AMLG3700), including bookkeeping and payroll work, include:

• pressure to rely on records you cannot verify
• falsified payroll instructions
• reluctance to give supporting information
• a client stopping you from reporting to HMRC directly
• requests for services for an entity declared dormant, without a valid business reason

Sanctions sit alongside CDD. Accountancy, tax advice and audit firms are “relevant firms” with a duty to report to the Office of Financial Sanctions Implementation (OFSI), and that duty comes from the sanctions regulations, not the MLRs. One fiduciary, bookkeeping and accounting firm was fined £300,000 in 2025 for refunding an overpayment to a designated person in 2018. See our sanctions screening guide.

Digital identity services and the DVS register

CCAB’s July 2026 guidance is firm on this point. Section 5.5.12 says a digital identity service that is not on the digital verification services (DVS) register cannot reliably be deemed suitable for MLR identity verification, so the firm will need paper documents instead. ACCA says firms should ensure any such service is certified and on the register.

The exact wording of AMLGAS 5.5.12 is that non-listed services “cannot reliably be deemed suitable for identity verification in compliance with the MLRs, and the firm will need to obtain paper documents rather than relying on an electronic verification service that does not appear on the register”. Section 5.5.13 adds that you should make sure the service is on the register and document that it can be relied upon. Where the provider’s brand is not listed but the software it uses is, you may need the provider’s confirmation, ideally in your contract. This is the case for AML Buddy: AML Buddy is not a separate entry on the register, and its identity checks run through GBG (GB Group plc), whose certified services are listed under GB Group PLC. If you need that confirmation for your file, email support@amlbuddy.uk.

ACCA’s 2025/26 report lists, as a common finding, firms relying on third-party electronic verification “without having a sufficient understanding of the checks”. Its expectation: “Where firms rely on a digital verification service… they should ensure that the service is certified and appears on the digital verification services register.”

What to do: before you rely on any electronic service for identity verification, check the register, keep a record of the check and make sure you understand what the service does. Where a service is not listed, follow 5.5.12 and obtain documents.

What inspectors found in the latest reports

The professional bodies’ latest reports point to the same weak spots: CDD, client identification, risk assessments, training and policies. ICAEW rated 15.5% of 1,608 reviews non-compliant in the year to 5 April 2026, down from 20.0%. ACCA’s common findings were record keeping, untailored templates, unevidenced CDD and training.

ICAEW’s most common findings in 2025/26, as a share of firms reviewed: ongoing CDD 7.8%, client identification 5.7%, client risk assessments 5.5%, firm-wide risk assessment 5.2%, AML training 5.0%, compliance review 4.9%, policies and procedures 4.9%, verification 4.2%, new-client CDD 4.2% and PSC discrepancy reporting 3.2%. It issued 53 fines totalling £1,052,619, from £350 to £735,000.

• ACCA (2025/26): record keeping and evidence; untailored third-party templates and software; CDD, client risk assessment and ongoing monitoring not evidenced; training.
• AAT (2025/26): 352 reviews, of which 106 (30%) were non-compliant, up from 24% in 2024/25. About 40% of AAT-supervised firms are sole practitioners.
• ICB (2024/25): 35 of 55 compliance reviews were non-compliant; 17 fines totalling £74,192 and 12 exclusions. 69% of ICB practices are sole traders.

If an inspection is coming, our HMRC inspection guide has a preparation checklist.

HMRC penalties: registration comes first

HMRC’s list for April to September 2025 shows 113 named penalties on accountancy service providers, totalling £495,220. HMRC recorded 106 of them as breaches of regulation 56, failing to apply for registration on time. The largest, £52,000, went to an umbrella company for not registering, so payroll-only work is no safe harbour.

The other penalties were 4 under reg 21, 2 under reg 57 and 1 under regs 18 and 21. If you are not supervised yet, register before you trade. Every published list is summarised in our HMRC AML fines tracker.

Companies House ACSPs: supervision and two record clocks

To register as a Companies House authorised corporate service provider (ACSP), you must already be registered with an AML supervisor and stay registered. Companies House checks your name and membership number against your supervisor’s record. If you verify identities as an ACSP, you keep those records for 7 years, not the MLRs’ 5.

Companies House can suspend an ACSP while it investigates the agent’s AML supervision, filings or identity verification process, and publishes a list of ceased and suspended ACSPs about every 2 weeks. You may use a commercial provider for identity verification, but “it is still for you to decide” and you must be able to show why its steps meet the standard.

Existing directors verify with the company’s next confirmation statement filed during the transition, which ends on 17 November 2026; see our 17 November deadline guide and Companies House guide for accountants.

The FCA move: what changes and when

The government decided in October 2025 that the FCA will become the AML supervisor for accountancy, legal and trust and company service providers. The FCA does not expect to begin taking on supervision until autumn 2028, and expects to complete the move around 2030. Nothing changes for your firm now.

Keep your current supervisor, registration and fees. Track the dates on our AML deadlines page and read our guide to the FCA as single AML supervisor.

Checklist for a small practice

Most findings above come down to evidence. A small practice can cover the basics with ten steps: confirm scope and supervision, tailor your risk assessments and policies, complete and record CDD before work starts, check any electronic ID service, screen for sanctions and keep records for the right period.

1. List your services and confirm which are in scope; document the rationale for any that are not.
2. Confirm your supervisor and registration, including BOOM approvals.
3. Write a firm-wide risk assessment that reflects your own services, clients and geography.
4. Review your written policies, controls and procedures, and record the review.
5. Complete a client risk assessment and CDD before work starts, and keep the evidence.
6. Diary ongoing CDD reviews.
7. Check the DVS register for any electronic ID service you rely on, and document why it can be relied upon.
8. Screen clients against the UK Sanctions List and know how to report to OFSI.
9. Keep training records.
10. Apply both record clocks if you are an ACSP: 7 years and 5 years.

Free tools: our templates and the AML health check. Sector overview: the accountants hub.

AML Buddy offers pay-per-check client checks at £5.40 a check inc. VAT, with no subscription.

This guide is general information, not legal advice. Your supervisor’s guidance and CCAB AMLGAS decide what is right for your firm.