The AML monitoring visit that found reviews years out of date

The situation

Pennant Accounts is a sole practitioner with two part-time staff and around 120 clients. Every new client went through a thorough customer due diligence (CDD) check at engagement: ID, address, a risk assessment and a signed engagement letter.

The practice’s AML policy said reviews would take place “periodically, based on risk”. In practice, nobody tracked when each client was last reviewed.

What went wrong

The practice’s AML supervisor carried out a monitoring visit and sampled twenty client files. In most of them, the only CDD on file was from the start of the relationship – in several cases five or six years earlier. Two clients had changed their directors and shareholders since then. One had started a new line of business with large cash takings.

There was no record that any of these changes had been considered, and no evidence of ongoing monitoring.

What it cost

• An action plan from the supervisor with a deadline to bring every client’s CDD up to date, and a follow-up visit.
• Weeks of evenings re-checking IDs, beneficial owners and risk ratings across the whole client list.
• The worry of a less favourable outcome if the follow-up visit found the same problems.

How Deadlio would have caught it

1. A review cycle for every client. In Deadlio, each client has a Last AML / CDD review date and a review cycle in years – for example annual for high-risk clients and every three years for low-risk ones. The practice default is set once in Account.
2. Gaps are counted, not hidden. The Overview shows how many clients have no AML review recorded, and the client list flags reviews that are overdue.
3. Evidence for the supervisor. Each review is recorded with its date, and Mark done starts the next cycle, giving a clear, consistent trail.
4. Register warnings as prompts. Deadlio checks Companies House daily and flags status changes such as a proposed strike-off – a useful prompt to look again at a client’s due diligence.

Lessons for any practice

• “Periodically, based on risk” needs real dates attached to it.
• Record the date and outcome of every review, not just the initial check.
• Treat changes in ownership, control or business activity as triggers for an early review.

Related guides

• AML client review cycle
• Confirmation statement deadline
• Auto-enrolment re-declaration
• All deadline guides