An AML client file is the record that shows your supervisor who the client is, who owns and runs it, why you rated the risk as you did, and that you kept checking — each point with its source and the date you read it. Regulation 28(16) of the Money Laundering Regulations 2017 puts the burden on you: you must be able to demonstrate that the measures you took were appropriate to the risk. The file is how you demonstrate it, because a reviewer reads what is written, not what you remember.
- What an AML client file is, and why the file carries the proof
- 1. Identification of the client
- 2. Beneficial owners and the ownership chain
- 3. Purpose, risk, verification and enhanced due diligence
- 4. Sanctions screening and ongoing monitoring
- 5. Closing the file and keeping it
- FAQ
What an AML client file is, and why the file carries the proof
An AML client file is the dated record that demonstrates why your customer due diligence was appropriate for the risks you identified. Under regulation 28(16), you must be able to demonstrate this to your supervisory authority. Regulation 27(1)(a) applies CDD when a business relationship is established, with further triggers where suspicion or doubts arise.
The file should be one coherent record for each client. It should show the order in which you identified the client, understood ownership, assessed purpose and risk, verified relevant facts, and decided what further work was needed. A reviewer should not have to reconstruct the decision from disconnected emails or an undated screenshot.
The central question is not whether the file contains many documents. It is whether the documents support the decisions made. A Companies House extract can support corporate identity, but it cannot explain the purpose of the engagement or why you selected a particular risk rating.
A useful practical rule is: every material fact should have a source, a date and an explanation of its relevance. EntityWatch follows this approach when it reads Companies House and writes a due diligence note with a source and date on every fact. Its rules propose the risk class; you approve it, and the signed version goes to the audit trail.
For the reviewer’s perspective, see what an AML supervisor looks at in a client file.
1. Identification of the client
The identification section must establish the customer’s legal identity and verify it. Regulation 28(2)(a)-(b) requires you to identify and verify the customer. For a body corporate, regulation 28(3)(a) refers to its name, company or registration number, registered office and, where different, principal place of business. The file must distinguish register facts from information only you can obtain.
For a UK company, record at least the legal name, Companies House number, current status, registered office and directors. Add a clear source statement, such as “read on Companies House on [date]”. If the client operates from a principal place of business different from its registered office, record that separately and explain how it was established.
Regulation 28(3)(b) also concerns the law to which the body corporate is subject, its constitution and the full names of the board and senior persons responsible for operations. Regulation 28(5) provides an exception for a company listed on a regulated market for the measures in regulation 28(3)(b), 28(3A) and 28(4). Identification under regulation 28(3)(a) and the remaining applicable measures still need attention.
If another person acts for the client, regulation 28(10) requires you to verify that person’s authority and identity. The register may show directors, but it does not tell you who is instructing the firm or whether that person is authorised for the engagement. Record that evidence in the file rather than treating a director listing as proof of authority.
2. Beneficial owners and the ownership chain
The file must show how you understood ownership and control, not merely that you downloaded a PSC entry. Regulation 28(3A) requires reasonable measures to understand the ownership and control structure. Regulation 28(4) requires identification and reasonable verification of the beneficial owner. Regulation 28(9) says relying solely on the PSC register does not satisfy regulation 28(4).
Start with the PSC excerpt and its date. Regulation 30A(1) requires an excerpt before establishing a relationship with a company subject to the PSC regime, or a record that there is nothing on the register. Follow each corporate PSC through the ownership chain until you reach the relevant individuals or reach a documented difficulty.
The file should explain what you did beyond the register. That may include reviewing the client’s ownership information, constitutional documents or other reliable evidence appropriate to the case. If the structure is complex, record the chain in plain language and identify where control is exercised. Do not convert an unclear register into a conclusion that no beneficial owner exists.
Regulation 28(6)-(8) allows treatment of a senior managing official as the beneficial owner only after all possible means have been exhausted. Keep written records of every action and difficulty. If there is a material discrepancy, record what it was, how you assessed it and whether it was reported to Companies House under regulation 30A(2).
For a field-by-field approach to the risk decision, see what an accountant’s AML client risk assessment should record. For Irish clients, the position on access to beneficial ownership information is different and should be documented accordingly; EntityWatch’s guide to the Irish RBO and the client file explains that distinction.
See how EntityWatch builds the file from Companies House
3. Purpose, risk, verification and enhanced due diligence
The file must explain why the relationship exists, how risk was assessed, what was verified and why any enhanced measures were selected. Regulation 28(2)(c) requires assessment, and where appropriate obtaining information, about the purpose and intended nature of the relationship. Regulations 28(12), 28(13), 28(18), 28(19) and 33 set the framework for risk, verification and enhanced due diligence.
Record the services you provide, how the client came to the firm, expected activity and any explanation for a structure that is not straightforward. This information comes from the engagement and the client, not from Companies House. If the purpose is absent from the file, a reviewer cannot assume it was obvious or understood.
The risk assessment should show the factors considered, their sources, the resulting rating, the person who approved it and the date. Regulation 28(13) includes the purpose, the size of assets or transactions, and the regularity and duration of the relationship. Preserve earlier ratings when the risk changes, so the reviewer can see what changed and why.
Verification under regulation 28(18)(a) must be based on documents or information from a reliable source independent of the person. Regulation 28(18)(b) recognises documents issued or made available by an official body as independent even when the client provides them. Regulation 28(19) addresses electronic identification processes that are secure from fraud and misuse. Record the fact checked, source, date and extent of the check.
Enhanced due diligence and enhanced ongoing monitoring apply to high-risk cases identified by the firm or supervisor under regulation 33(1), including relevant PEP cases and relationships with a person established in a “FATF call for action country” — the term that replaced “high-risk third country” from 30 June 2026 (S.I. 2026/621). Your file should state the trigger, the additional steps, the decision-maker and the review date. It should not simply say “EDD completed”.
4. Sanctions screening and ongoing monitoring
A defensible screening record identifies what was screened, when it was screened, what was compared and how a possible match was resolved. The file should also show how you monitored the relationship against the risk assessed at onboarding. A possible match is not itself a conclusion that the client is sanctioned; the firm must document its review and decision.
Sanctions compliance is a separate legal duty from customer due diligence, so the record should say which lists were used. Since 28 January 2026 the UK Sanctions List published by the FCDO is the only list of UK designations; OFSI’s Consolidated List is no longer updated (GOV.UK).
For each screening event, record the client and relevant connected names, the list or source checked, the date, the entry compared and the result. If there was a possible match, record the identifiers considered, such as date of birth, address, nationality or corporate details where available. State why the result was or was not the client, who cleared it and when.
The same discipline applies to ongoing monitoring. Keep evidence of reviews, material changes to ownership or management, changes in activity, unusual transactions and information that affects the risk rating. A review note should explain what was checked and what conclusion followed, rather than merely saying “no change”.
Monitoring frequency should follow the risk assessment and the nature of the relationship. A high-risk relationship normally needs more active review than a low-risk one, but the file must show the reasoning in the particular case. If a new fact changes the risk, record the old rating, the new rating, the trigger and the approval.
EntityWatch’s guide to ongoing monitoring evidence can help structure the record. EntityWatch can read Companies House, follow the PSC chain and write a note with a source and date on each fact. The adviser remains responsible for reviewing the result, approving the risk class and deciding what action is required.
5. Closing the file and keeping it
Closing the file is part of the AML record, not an administrative afterthought. Regulation 40(3) requires the CDD records to be kept for five years from the date you know, or have reasonable grounds to believe, that the business relationship has come to an end. After that period, personal data should be deleted unless an exception in regulation 40(5) applies. Record the end date and retention decision clearly. Where the client company has itself been dissolved, see what the AML file needs before you close it.
At closure, document when and why the relationship ended, the final risk position, the last monitoring activity and any unresolved issue. Preserve the evidence supporting the final decision. If there was an outstanding discrepancy, suspicion, sanctions concern or enhanced-monitoring matter, the closure note should point to the relevant record without disclosing a suspicious activity report where disclosure would be prohibited.
A supervisor should be able to follow the file from onboarding to closure without relying on individual staff memories. Use consistent names, dates and version control. Keep signed approvals with the underlying evidence, and make sure that later changes do not overwrite the earlier record.
The one-page checklist below separates information commonly available from an official register from information the firm must obtain and write itself.
| File section | What the file should show | Regulation | Main source or responsibility |
|---|---|---|---|
| Client identity | Name, company number, status, registered office, directors and date checked | 28(2)-(3) | Companies House; the firm records its check |
| Authority | Who instructs the firm and evidence of authority and identity | 28(10) | The firm and the person acting for the client |
| Ownership | PSC excerpt, date, ownership chain and verification beyond PSC data | 28(3A), 28(4), 28(9), 30A | Companies House plus client and other reliable evidence |
| Purpose | Services, expected activity, origin of relationship and structure rationale | 28(2)(c) | The firm and the client |
| Risk | Factors, sources, rating, approval date and historic ratings | 28(12)-(13), 18(1) | The firm’s assessment |
| Verification | Fact checked, source, date and method | 28(18)-(19) | Official body or other reliable independent source |
| EDD | Trigger, additional measures, approval and review date | 33 | The firm’s assessment and evidence |
| Screening | Names, lists, date, possible match analysis and clearance | Sanctions regulations | The firm’s screening record |
| Monitoring | Review performed, changes found, outcome and updated rating | 28(11), 30A(2A) | The firm’s ongoing review |
| Closure | End date, final review and retention decision | 40 | The firm |
FAQ
These questions address the points most likely to arise when a supervisor samples a UK accountancy or tax practice’s client files. The short answers follow the regulations cited above, but the file should always show how you applied them to the particular client and risk.
Is the Companies House PSC register enough to identify beneficial owners?
No. Regulation 28(9) says you do not meet regulation 28(4) by relying solely on the PSC register. Use it as a starting point, record the excerpt and date under regulation 30A(1), and record what else you did to understand and verify ownership. If you cannot establish ownership after exhausting possible means, record every action and difficulty before considering the senior managing official provisions in regulations 28(6)-(8).
How long must I keep a client file after we stop acting?
Five years from the date the relationship ended under regulation 40(3). After that, delete personal data unless an exception in regulation 40(5) applies. The file should state the relationship end date and the retention decision so the calculation can be checked.
Does a listed company need the same file?
Not in every respect. Regulation 28(5) says the measures in regulation 28(3)(b), 28(3A) and 28(4) do not apply to a company listed on a regulated market. Identification under regulation 28(3)(a), authority checks and the other applicable requirements still need to be addressed. Record why the exception applies.
What should the file say when a sanctions screen returns a possible match?
Record the names screened, the list and date, the entry compared, why it is or is not the client, who cleared it and when. Do not describe the client as sanctioned merely because a screening result requires review. Keep the underlying comparison and decision with the file. The step-by-step version is in how to clear a possible sanctions match.
Do I need to write the purpose of the relationship if it seems obvious?
Yes. Regulation 28(2)(c) requires you to assess it, and regulation 28(13)(a) makes purpose a risk factor. No register holds the purpose of your engagement. Record the services, expected activity, how the client came to you and any explanation for a non-standard structure.
What is the practical next step?
Enter a Companies House number in EntityWatch. It reads the register, follows the PSC chain and writes the due diligence note with a source and date on every fact. Rules propose the risk class; you approve it, and the signed version goes to the audit trail. If you are still choosing a tool, our comparison of AML software for UK accountants explains what identity-check tools and client-file tools each do and cost. Write your first client note free for up to five companies.
Last reviewed 28 September 2026. Author: AddonNordic.
This article explains the regulations as they stood on 28 September 2026 and is not legal advice.
This content was generated with artificial intelligence.