AML client reviews: how often accountants should refresh customer due diligence

Anti-money laundering compliance is one of the areas supervisors look at most closely when they visit accountancy practices. A common finding is not that due diligence was never done, but that it was done once, at the start of the relationship, and never updated.

What the rules require

Under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, accountants must:

• carry out customer due diligence (CDD) before establishing a business relationship;
• monitor the relationship on an ongoing basis, including scrutinising transactions and keeping CDD information up to date; and
• apply CDD again at appropriate times to existing clients, on a risk-sensitive basis, and whenever relevant circumstances change.

The Regulations do not set a fixed review period. Your supervisor – such as ICAEW, ACCA, AAT or HMRC – expects you to set one in your policies according to risk, and to follow it.

Setting a risk-based cycle

Many practices use a pattern like this:

Whatever pattern you choose, write it into your AML policy and apply it consistently.

Triggers for an early review

A review should also happen whenever something material changes, for example:

• a change of directors, shareholders or people with significant control;
• a change in the nature or scale of the business;
• unusual or unexpected transactions;
• new services, such as company formation or acting as registered office;
• doubts about information previously obtained.

What a review should cover

1. Confirm identity details are still current, including beneficial owners.
2. Refresh the client risk assessment and record the reasoning.
3. Check sanctions and politically exposed person (PEP) status.
4. Update your understanding of the source of funds where relevant.
5. Record the date and outcome, so you can evidence the review to your supervisor.

Tracking reviews in Deadlio

In Deadlio, each client has an AML / CDD card with the Last AML / CDD review date and an AML review cycle in years. Leave the cycle blank to use your practice default, set in Account. The Overview counts clients with no AML review recorded, and the client list flags reviews that are overdue. After a review, Mark done records today’s date and starts the next cycle.

Related guides

• Confirmation statement deadline
• Self Assessment deadlines
• Auto-enrolment re-declaration
• See it in practice: The AML monitoring visit that found reviews years out of date
• All deadline guides

This guide is general information for accountancy practices and is not legal advice. Follow your own AML supervisor’s guidance. Last reviewed October 2026.