New HMRC and CCAB guidance puts the focus on practical risk assessments, documented decisions and effective anti-money laundering controls.

For UK accountants, anti-money laundering (AML) compliance is about much more than checking a client's passport.

The latest HMRC and Consultative Committee of Accountancy Bodies (CCAB) guidance reinforces the importance of understanding your clients, identifying risks and demonstrating that your firm's procedures work in practice.

In a recent webinar, AML specialist David Winch examined the updated guidance and its implications for accountants, bookkeepers and tax advisers.

His central message was clear: having AML procedures is not enough. You need to demonstrate that they are appropriate, regularly reviewed and consistently followed.

Here are the key areas accountants should consider.

1. Review your firm-wide AML risk assessment

Your firm-wide risk assessment should reflect the actual risks facing your practice.

HMRC's updated guidance places considerable emphasis on the relationship between a firm's identified risks and its policies, controls and procedures.

This means looking beyond standard templates.

Your assessment should consider:

• The types of clients your firm serves.
• The services you provide, including any trust or company services.
• How clients communicate and interact with your practice.
• Geographic risks and relevant international connections.
• Risks associated with money laundering, terrorist financing and proliferation financing.
• The controls you use to manage identified risks.

David Winch highlighted the importance of tailoring documentation to your firm's circumstances.

A generic template may provide a useful starting point, but it should not replace your professional judgement.

2. Make your client risk assessments meaningful

One recurring theme was the danger of treating client risk assessments as a tick-box exercise.

A client classified as low risk should have a documented explanation supporting that assessment.

Equally, identifying a high-risk client does not automatically mean you must stop acting for them.

Instead, the assessment should inform the additional due diligence and monitoring required.

David explained that supervisors may question firms where almost every client is classified as low risk without convincing supporting evidence.

He also highlighted the value of recording comments alongside electronic risk assessment forms.

These comments demonstrate your knowledge of the client and the reasoning behind your decisions.

3. Understand the difference between identification and verification

The updated CCAB guidance provides further detail on customer due diligence (CDD), including identification and verification.

These are related but distinct activities.

Identification involves establishing who a person is.

Verification involves checking that information using appropriate evidence.

For company clients, accountants must also consider beneficial ownership and the individuals who control the business.

David highlighted the importance of distinguishing directors from beneficial owners when determining whose identity must be verified.

The applicable requirements should be checked carefully against the current CCAB guidance rather than assuming every director and shareholder requires identical checks.

Electronic identity verification also deserves attention.

Accountants should understand what their chosen verification service checks, which information sources it uses and whether it meets the relevant requirements.

4. Keep client due diligence under review

AML compliance does not end when a new client is accepted.

A client's circumstances, ownership, activities and risk profile can change during the professional relationship.

During the webinar, David suggested that annual reviews can fit naturally into an accountancy practice's existing work cycle.

For example, preparing annual accounts or tax returns provides an opportunity to reconsider whether your understanding of a client remains accurate.

However, changes during the year may require an earlier review.

Accountants should consider whether new information affects the client's risk rating or requires further enquiries.

Sanctions screening and politically exposed person (PEP) considerations may also need reassessment as circumstances change.

5. Demonstrate that your AML procedures work

Written policies are important, but they do not prove that a firm is applying them.

David emphasised that the effectiveness of AML controls depends on what happens in practice.

For practice owners and money laundering reporting officers (MLROs), this means considering how procedures are communicated, monitored and tested.

Relevant questions include:

• Are staff following the firm's documented AML procedures?
• Are client files being reviewed appropriately?
• Are risk assessments updated when circumstances change?
• Are identified weaknesses addressed and recorded?
• Can the firm explain departures from relevant guidance?

David also distinguished between the compliance oversight role and the nominated officer's responsibility for suspicious activity reporting.

In smaller practices, these responsibilities may be handled by the same person, but the underlying duties still need attention.

6. Pay attention to the updated CCAB guidance

The CCAB guidance remains particularly important for accountants supervised by professional bodies.

David explained that much of the existing guidance remains familiar, but the revisions include points worth reviewing.

These include customer due diligence, enhanced due diligence, beneficial ownership and electronic identity verification.

He also discussed the relevance of HMRC's guidance for firms supervised by other bodies.

Although firms should follow the requirements and guidance relevant to their own supervisory arrangements, HMRC's discussion of sector risks can provide useful context.

What should you do next?

The central lesson from the webinar is that AML compliance requires evidence of informed, risk-based decisions.

Accountants should be able to explain their firm's approach, show how client risks are assessed and demonstrate that procedures operate effectively.

For practice owners, a useful starting point is to review three connected areas: the firm-wide risk assessment, client due diligence procedures and evidence of ongoing monitoring.

These documents and activities should support each other.

If they do not, the updated guidance provides a timely reason to review how your firm manages AML compliance.

For a more detailed examination of the changes and their practical implications, watch David Winch's CPDStore session:

The HMRC and CCAB New AML Guidance for Accountants – October 2026

Frequently asked questions about the 2026 HMRC and CCAB AML guidance

What changed in the HMRC and CCAB AML guidance in 2026?

The 2026 guidance updates address several areas relevant to accountants, including risk assessments, customer due diligence, beneficial ownership and electronic identity verification.

HMRC's guidance also discusses the relationship between identified risks and the policies, controls and procedures used to manage them.

The updated CCAB guidance provides further detail for the accountancy sector.

Accountants should review the sections relevant to their services and supervisory arrangements, rather than assuming every change applies equally to every practice.

Do accountants need a firm-wide AML risk assessment?

Yes. Accountancy practices subject to the UK Money Laundering Regulations must assess the money laundering and related financial crime risks facing their business.

A firm-wide risk assessment should reflect the practice's clients, services, operating arrangements and relevant risk factors.

It should also connect to the firm's documented policies, controls and procedures.

Using a standard template does not remove the need to tailor the assessment to the practice.

The important point is that the assessment reflects actual risks and supports proportionate controls.

How often should accountants review customer due diligence?

Customer due diligence must be kept up to date through ongoing monitoring, with reviews appropriate to the client's risk and circumstances.

An annual review can be a practical approach for accountancy firms because it aligns with existing accounts preparation and tax compliance work.

However, an annual timetable should not prevent earlier action.

Changes in ownership, business activities, financial circumstances or other relevant information may require a reassessment.

Firms should document reviews and explain any resulting changes to the client's risk rating or due diligence requirements.

Is every accounting client considered low risk?

No. Client risk ratings should reflect the circumstances of each relationship.

A client may be assessed as low, medium or high risk depending on the relevant factors and the firm's assessment methodology.

David Winch cautioned against classifying nearly every client as low risk without adequate supporting reasons.

A high-risk assessment does not automatically mean the firm must refuse the engagement. It may instead require enhanced due diligence and additional monitoring.

Accountants should document why a particular risk rating was selected and what action follows from it.

What is the difference between identification and identity verification under AML rules?

Identification means establishing who an individual is, while verification means checking that information against appropriate evidence.

For company clients, accountants also need to consider beneficial ownership and control.

The precise verification requirements depend on the individual's role and the applicable rules.

Electronic identity checks can assist, but accountants should understand what their chosen service verifies and whether it satisfies the relevant requirements.

An electronic check should not be treated as sufficient merely because the software returns a successful result.

Do sole practitioners need to maintain AML policies and procedures?

Yes. Sole practitioners carrying out regulated accountancy services remain subject to applicable AML obligations.

Operating without employees does not remove the need to assess risks, conduct appropriate client due diligence or maintain relevant records and controls.

David Winch emphasised that sole practitioners should not assume their size makes them unlikely to face supervisory scrutiny.

Their compliance arrangements should be proportionate to their practice, but they still need to demonstrate how relevant AML requirements are met.

Continue your AML CPD

Watch David Winch's webinar on the HMRC and CCAB New AML Guidance for Accountants for further discussion of risk assessments, customer due diligence, supervisory expectations and the practical implications for UK accounting practices.

The contents of this article are meant as a guide only and are not a substitute for professional advice. The author/s accept no responsibility for any action taken, or refrained from, as a result of the material contained in this document. Specific advice should be obtained before acting or refraining from acting, in connection with the matters dealt with in this article. The information at the time of publishing was accurate and could be subject to final changes.