For accounting firms, effective AML and KYC compliance increasingly depends on how well the requirements are embedded into the ordinary client onboarding and engagement process. The main practical challenge is not simply collecting identification documents, but ensuring that firms correctly identify relevant services, determine who must be verified, apply appropriate risk assessment, document decisions, and maintain secure records.
Key impacts on accounting firms
Service scoping is the starting point
Not every accounting service will necessarily require the same level of AML/KYC attention. Firms should first identify which services fall within their applicable compliance framework and distinguish them from routine services that do not trigger additional procedures.
Particular care may be required for services involving entity formation, registered office arrangements, restructuring, transactions and certain other corporate services. Borderline cases should be documented and escalated rather than resolved informally.
The practical objective is to avoid two extremes: applying full AML procedures unnecessarily to every engagement, or overlooking services that should be subject to enhanced controls.
Compliance should be linked to the relevant matter or entity
The AML/KYC procedures may need to be applied at the level of the specific engagement, entity or transaction rather than simply at the overall client level.
This is especially relevant where a client group includes multiple companies, trusts and individuals. A firm may provide a relevant service to only one or several entities within the wider group. Accordingly, the compliance process should identify the specific entity involved and the individuals connected to that entity who require verification.
This approach can reduce duplication and unnecessary client requests while still ensuring that the relevant compliance obligations are addressed.
Existing clients and new clients may require different workflows
New clients can generally be incorporated into a standard onboarding process that includes identification, verification and risk assessment at the appropriate point.
Existing clients present a different challenge. Long-standing relationships may already contain substantial client information, but additional checks may still be required when a new relevant service is introduced or when another trigger occurs.
Firms may therefore need a separate process for:
- reviewing existing or legacy clients;
- identifying which existing relationships require further action;
- conducting risk assessments in batches where appropriate; and
- documenting the basis on which no further action is required for other clients.
Automation can improve consistency, but judgement remains essential
Technology can support the onboarding process by identifying potentially relevant services, triggering verification requests, recording results and maintaining an audit trail.
However, automated systems should not determine the compliance outcome without professional review.
A practical control is to require staff to confirm:
- whether the service is actually within scope;
- which individuals require verification;
- whether standard or enhanced procedures are appropriate; and
- whether any exception or escalation is necessary.
This is particularly important for complex groups, where the individual accepting an engagement may not be the director, beneficial owner or other person who requires verification.
The AML/KYC should form part of the engagement workflow
An effective onboarding process should connect AML/KYC procedures with the wider client acceptance and engagement process.
This may include linking:
- client identification;
- engagement acceptance;
- verification checks;
- beneficial ownership information;
- risk classification;
- approval decisions;
- supporting documentation; and
- ongoing monitoring.
Embedding these steps into the normal workflow can reduce missed actions and improve accountability.
Importantly, technology supports the process but does not replace the firm’s own policies, risk assessments, procedures and professional decisions.
Practical issues for firms and clients
Repeated document requests
One of the most common sources of client frustration is being asked to provide the same information several times.
This can occur where the same person is connected with multiple entities or engagements. Firms should therefore design their systems to reuse valid verification information where permitted and avoid issuing duplicate requests unnecessarily.
Identifying the correct person for verification
The person who receives or signs an engagement proposal is not always the person who should be subject to the AML/KYC checks.
Firms should distinguish between:
- engagement contacts;
- directors;
- beneficial owners;
- trustees;
- authorised representatives; and
- other relevant persons.
Incorrectly identifying the person to be checked can increase costs, delay onboarding and create unnecessary client friction.
Timing of verification
Firms need a clear policy on when AML/KYC checks are carried out.
Depending on the applicable requirements and the firm’s risk approach, verification may occur:
- before engagement acceptance;
- as part of the engagement acceptance process; or
- immediately after acceptance but before the relevant service is commenced.
The key point is that timing should be determined by compliance requirements and risk considerations, not simply by administrative convenience.
Risk assessment and documentation
Completing an identity check does not, by itself, complete the AML/KYC process.
Firms should also document:
- the nature of the client or engagement;
- the relevant risk factors;
- the resulting risk classification;
- any additional procedures performed; and
- the basis for accepting, escalating or declining the relationship.
This documentation is important for internal review, regulatory inspection and audit trail purposes.
Privacy and information security
AML/KYC procedures involve highly sensitive personal information, including identity documents and ownership information.
Firms should ensure that:
- access is restricted to appropriate personnel;
- identity information is stored securely;
- documents are not circulated unnecessarily;
- permissions are reviewed regularly; and
- retention practices are consistent with legal and regulatory requirements.
Use of AI and digital tools
AI can assist with tasks such as reviewing service lists, developing internal procedures and identifying areas requiring further assessment.
However, firms should apply appropriate safeguards when using AI tools, particularly where confidential or personally identifiable information is involved.
Internal policies should clearly address what information may be entered into AI systems and what remains subject to human review.
Action points
Accounting firms reviewing their AML/KYC onboarding process should consider the following:
- Review and classify the firm’s service catalogue.
- Identify services that may trigger additional AML/KYC requirements.
- Establish procedures for resolving borderline or uncertain cases.
- Determine which persons must be verified for each relevant service.
- Separate new-client onboarding from legacy-client remediation where necessary.
- Build verification and risk assessment into the engagement workflow.
- Introduce human review points before relying on automated outcomes.
- Reduce duplicate requests for information.
- Maintain a complete audit trail of verification and risk decisions.
- Restrict access to sensitive compliance information.
- Train staff involved in client acceptance and engagement setup.
- Periodically review the process for exceptions, delays and client friction.
Practical AML/KYC compliance is best treated as part of the firm’s broader client acceptance and engagement management framework.
The most effective approach combines clear service scoping, targeted verification, documented risk assessment, appropriate use of technology, secure handling of information and consistent staff judgement.
The objective should be to make compliance a controlled and repeatable part of the onboarding process without creating unnecessary complexity for either staff or clients.