An AML decision record shows who decided, what they decided, which facts they relied on and where those facts came from, why they decided it, and when. Write it at the time, not when the inspection letter arrives, and never overwrite it: if the decision changes, record a new one and keep the old. EntityWatch does this for client risk decisions: the rules propose a class, you set it and sign, a departure from the proposal needs a written reason, and the signed version goes into an append-only audit trail. It is free for up to five companies.
Get started free: write your first client note
Illustration: the left panel is example data, not a real client. The right panel is the EntityWatch dashboard for Tesco Stores Limited (Companies House 00519500), approved on 18 September 2026; the approver’s email address is hidden.
By Martin Nymann, AddonNordic ApS, the company behind EntityWatch. Updated 12 October 2026.
- What must an AML decision record show?
- Which decisions should you write down?
- How do you record a decision that departs from your policy?
- How do you correct a decision once it is recorded?
- How long must you keep decision records?
- What does a decision record look like in EntityWatch?
- Frequently asked questions
What must an AML decision record show?
It must let a reviewer who was not in the room see the decision, the reasons and the evidence without asking you. That is the test the regulations set: under regulation 28(16) of the Money Laundering Regulations 2017, you must be able to demonstrate to your supervisor that the extent of your due diligence was appropriate to the risk. A rating on its own does not demonstrate anything. The reasoning behind it does.
A record that holds up has six parts:
- The decision. Accept the client, rate them medium, apply enhanced due diligence, clear a possible match, end the relationship.
- Who made it. A named person, and the senior manager where your policy or the regulations require approval.
- The facts relied on. Each with its source and the date it was read, for example the Companies House entry read on a given day.
- The reason. One or two sentences that connect the facts to the decision. “Low risk” is a conclusion; “UK trading company, owners identified on the PSC register, no screening match, service is annual accounts” is a reason.
- When. The date of the decision, recorded at the time.
- What happens next. The review date or the event that would reopen it.
Regulation 28(12) says the extent of your measures must reflect your own firm-wide risk assessment and your assessment of the risk in the particular case, and regulation 28(13) lists factors you must take into account, including the purpose of the relationship and its regularity and duration. Your record should name the factors you actually weighed.
Which decisions should you write down?
Every decision that changes what you do for a client, or that a supervisor could question later. The table covers the ones that come up most often in an accountancy practice.
| Decision | What the record should add | Where the duty comes from |
|---|---|---|
| Taking on the client and setting the risk class | The factors weighed and the class chosen | MLR 2017 reg. 28(12)-(13) |
| Rating a client differently from your policy | The written reason for the departure | MLR 2017 reg. 28(16); your own policy under reg. 19 |
| Applying enhanced due diligence | The trigger, the extra steps taken and who approved continuing | MLR 2017 reg. 33; reg. 33(5)(e) lists senior management approval among the measures |
| Clearing a possible sanctions or PEP match | What you compared, which list, who cleared it and when | Your screening procedure |
| Ending the relationship | The end date and why it ended | MLR 2017 reg. 40(3), which starts the retention clock |
| Deciding whether to report an internal suspicion | The nominated officer’s reasons, either way | ICAEW guidance for nominated officers |
On the last row, keep the nominated officer’s record separate from the ordinary client file. ICAEW’s guide for nominated officers lists, among its expectations, “a procedure for recording the reasons for submitting; or not submitting an internally reported suspicion”, and expects internal and external reports to be stored securely and confidentially.
For the step-by-step on one of the most common decisions, see how to clear a possible sanctions match and what to record.
Get started free: write your first client note
How do you record a decision that departs from your policy?
Write the reason at the moment you depart, in the same record as the decision. A policy that says “remote onboarding is medium risk” and a file that says “low” with no explanation looks like the policy is not being followed, even when the judgement was sound.
Good departure reasons are specific and checkable:
- “Rated low despite remote onboarding: identity verified by electronic identity check on 3 October 2026, client is a subsidiary of a listed group, service limited to payroll.”
- “Rated high despite a clean screen: ownership runs through two overseas holding companies and the client could not explain the structure.”
Under regulation 19 your policies, controls and procedures must be recorded in writing, approved by senior management and kept up to date. If departures keep happening for the same reason, that is a sign the policy needs changing, and the change itself must be recorded under regulation 19(1)(c)(ii).
How do you correct a decision once it is recorded?
Add a new version and keep the old one. Never edit the original. An inspector looking at a risk rating that was changed from high to low wants to see both: what you knew when you rated it high, what changed, and who decided to lower it. A spreadsheet cell that has been overwritten shows only the final answer, which is exactly the gap the figure above illustrates.
In practice:
- date the new decision and name the person making it,
- say what changed (new facts, a corrected error, a different service),
- keep the earlier record readable, marked as superseded.
The same applies to ongoing monitoring. A review that found nothing is still a decision worth recording. See what counts as evidence of ongoing monitoring.
How long must you keep decision records?
Five years from the date you knew, or had reasonable grounds to believe, that the business relationship had ended, under regulation 40(3). Records of transactions within the relationship need not be kept for more than ten years. The decision records belong to the client file and follow the same clock, which is why the end date of the relationship has to be written down too. If the client company has itself been dissolved, see what the AML file needs before you close it.
What does a decision record look like in EntityWatch?
EntityWatch builds the record around the client risk decision, from the official register:
- The note identifies the company, follows the ownership chain and screens the company and its people, with the source and the date read on every fact.
- The rules propose a risk class. You set the class. If you choose a different class from the proposal, the approval asks for your reason, and it cannot be signed without one.
- You sign. The signed version is copied into an append-only audit trail with your name and the time. To change it, you write a new version; the earlier versions stay listed.
- Investigations. Where something looked wrong, you record what you examined and what you concluded. If you notify the authority, you do that yourself in your own name; EntityWatch records that you did, never the notification itself.
- The inspection report prints the file for one company in the order a reviewer reads it. Exporting the audit trail is included from the Comply plan.
What EntityWatch does not do: it does not verify a person’s identity documents, and it does not decide for you. The decision and the reason are yours; the product makes sure they are written down, dated and kept. For the full contents of the file around each decision, see the AML client file, section by section, and for what a reviewer checks, what your AML supervisor looks at in a client file. Details of each step are on how it works, and plans are on pricing.
Frequently asked questions
Is a risk rating in a spreadsheet enough?
Not on its own. Regulation 28(16) requires you to be able to demonstrate that your measures were appropriate to the risk, so the file needs the reasons and the evidence behind the rating, who decided and when.
Do I have to record decisions where nothing changed?
Record them where the decision was part of your procedures, such as a periodic review. A dated line saying what was checked and that no change was found is the only way to show the review happened.
Can I edit an old risk assessment when the client’s circumstances change?
Record a new assessment and keep the old one. The earlier record shows what you knew at the time, which is what an inspector will judge the original decision against.
Where should the record of a decision not to report a suspicion be kept?
With the nominated officer, stored securely and confidentially, not in the general client file. ICAEW expects a procedure for recording the reasons for submitting or not submitting an internally reported suspicion.
Get started free: write your first client note
This article is general guidance for UK accountancy practices, not legal advice.
This content was generated with artificial intelligence.