What does taking on a new client cost you today?
Two costs, and neither of them is what the client sees.
The first is the time between the engagement letter being signed and the first piece of billable work being done. In most practices that week is spent chasing: chasing the client for the passport copy, the proof of address, the company registration number, the beneficial owner's name and documentation. Some of that chase is done once. More of it is done twice when the first version that arrived has expired, or was the wrong document, or was photographed in such poor light that it cannot be used.
The second cost is the file that is never quite complete. The engagement is live, work has started, and the customer due diligence file has two items outstanding that nobody has had time to resolve. Those items stay outstanding until there is an inspection or until a partner asks, and by then the record does not reflect what the practice actually knows about the client.
The legal position is this: external accountants providing services by way of business are designated persons under Section 25 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010. That means a full customer due diligence process is required before establishing a business relationship, including identity verification, beneficial ownership identification, and an individual risk assessment rating for each client. The Anti-Money Laundering Compliance Unit's Guidelines for Designated Persons, published by the Department of Justice in March 2024, state at Section 4.2.10 that "as required under Section 55(4) of the Act all records relating to the history of services and transactions carried out shall be retained for a period of not less than 5 years." Automating the assembly of the file does not change that retention obligation or move it off the designated person. It means the file is actually there when the five years runs.
What exactly gets automated?
Five things.
The right checklist for each risk tier. Standard customer due diligence requires different documentation from enhanced due diligence. The checklist the client receives is the one that matches the risk level you assigned, not a generic list that over-asks every client and confuses the ones who needed a simpler process.
Chasing the client for what is missing. A daily list of what is outstanding, what was asked for and when, and how long it has been since the last response. The chase goes out in the firm's voice, on the timeline you set, and stops the moment the outstanding item arrives. Nothing chases an item that has already been received.
Extracting the data from what arrives. The name, address, date of birth and document details from the identification documents; the company name, registration number and director details from the company documents. Extracted, checked against what the client told you it was, and filed. Not rekeyed into the system by someone who is trying to do three other things at once.
Assembling the file. One record per client, holding the complete CDD documentation, the risk rating, the source of the rating, the date it was assigned, and the date it was last reviewed. Formatted the way a regulator would expect to see it.
Flagging when documents expire. A passport has an expiry date. So do some company documents and director information checks. The system reads those dates and flags them before they run out rather than after, so the ongoing monitoring obligation is met as a standing process rather than as a crisis when an inspection is scheduled.
What still needs a person?
Three things, and the first is not negotiable.
The risk rating and the decision to accept the client. The AMLCU Guidelines are explicit that each customer must have an individual risk assessment rating assigned to them, for example low, low-medium, medium, medium-high or high risk. The system can assemble the information that goes into that decision. The decision itself stays with the practice. No automation we build replaces the judgement call about whether to take a client on, and any system that claims to make that call is describing something a designated person cannot delegate.
Beneficial ownership where the chain is not straightforward. A sole trader's beneficial owner is obvious. A private company with a nominee shareholder holding on behalf of a discretionary trust with three individual beneficiaries is not, and tracing it requires judgement and sometimes direct questioning of the client. The system holds and organises what is found. A person works through what is not.
Screening data from a licensed provider. Sanctions screening and politically exposed person checks depend on watchlist data we do not supply and do not hold. That data comes from a licensed provider the practice engages. We connect the onboarding process to the result of that check. We do not perform the check ourselves, we do not represent the completeness of any watchlist, and the practice must satisfy itself about the provider it uses.
How is the result measured?
Against four numbers, taken before the build starts and for the last three months of onboardings.
Days from signed engagement letter to complete AML file. The headline. Take the last ten new clients and note when the letter was signed and when the file was finally complete. The average and the longest are both useful.
Outstanding items per client at day seven, day fourteen and day twenty-one. A client who is still missing documents at day twenty-one is a client who has not been chased effectively, or a client who has a reason for not providing them that needs a conversation.
Proportion of files complete at the next annual review. The ongoing monitoring obligation means a complete file at onboarding is not enough if nothing is reviewed afterwards. A file complete at annual review is the correct target.
Chases sent per client to get the file complete. This is the most diagnostic number. If the average is seven chases per client, the problem is in the checklist or the timing, not in the clients. If it is one, the checklist is probably too short.
What could go wrong?
A file that looks complete but has a gap. A document received, extracted and filed, but the beneficial owner behind the corporate structure was never identified because the question was never asked clearly enough. The file is full and the record is wrong. The checklist for each risk tier needs to be owned by the partner who signs the accounts, not written once and forgotten.
Documents that have expired. A passport used for identification three years ago expired two years ago. The file looked fine until someone checked. The flagging system is only as good as the expiry dates it can read, and some older documents do not include a machine-readable date. Where a date cannot be extracted reliably, the file gets a review date rather than an automated flag.
Wrong risk tier assigned at the outset. A client rated standard when enhanced was warranted means the file was assembled to the wrong specification. The consequence is not just a gap in the record: it is a gap in the CDD that was applied. The rating needs to be reviewed as part of the annual file review, not only at onboarding.
A client whose circumstances change after the file was complete. A client who becomes a politically exposed person after onboarding is now subject to enhanced due diligence requirements that were not in the original file. The ongoing monitoring obligation exists precisely because circumstances change. The system flags the scheduled review; it cannot flag a change it has not been told about.
How long does it take to put in?
One to two weeks.
A session on the practice's risk tiers, the document requirements for each, and the CDD process currently used so the build matches what the firm already knows about its clients rather than starting from scratch. A connection to the engagement letter system and to the email address where client documents arrive. A parallel run against the last six new clients before anything goes live, so the output can be checked against the files as they actually exist.
Then we hand it over. No retainer, the checklists are yours to update as requirements change, and adding a new client to the process costs nothing. If you want to understand where this sits against the other workflows worth automating in the practice, that conversation is the opportunity review, and it starts with the last ten engagement letters and how long each one took to reach a complete file.