When your supervisor reviews your practice, they pick a sample of client files and check three things: that you identified the client and the people behind it, that you rated the risk and wrote down why, and that you kept the file up to date. ICAEW says it selects “a risk-based sample of client files and CDD documentation”, and the number depends on your size and your client base. What you tell the reviewer in the meeting matters less than what is written in those files, with dates.
- What happens to a sampled client file
- Identifying the client and the people behind it
- The risk assessment: re-performed, not just read
- Verification that matches the risk
- Keeping the file current: the most common finding
- PSC discrepancies: the question small firms miss
- Run this on five of your own files
- FAQ
What happens to a sampled client file
A reviewer does not assess a client file in isolation. ICAEW describes a process that includes an opening meeting, a brief review of the procedures manual, compliance reviews and client file reviews. The reviewer selects a risk-based sample, records findings at the closing meeting and expects the firm to respond to each finding.
The same Money Laundering Regulations 2017 apply when ACCA, AAT, CIOT/ATT, ICB or HMRC supervises the firm. The detailed review process may differ, but your file still needs to demonstrate that your measures are appropriate.
Regulation 28(16) of the Money Laundering Regulations 2017 says that a firm must be able to demonstrate to its supervisory authority that the extent of its customer due diligence measures is appropriate. That makes evidence central to the review.
A reviewer may work through the file in this order:
- Identify the legal entity and the people behind it.
- Re-perform the risk assessment using the file and available sources.
- Test whether verification addressed the risks identified.
- Check whether customer due diligence was updated during the relationship.
- Compare the PSC register with information held by the firm.
Your file should answer each question without relying on an explanation given only in the meeting.
Identifying the client and the people behind it
The first test is whether the file identifies the customer, its beneficial owners and its ownership and control structure. In ICAEW’s 2024/25 monitoring reviews, 11.9% of firms reviewed had ineffective client identification. Some had not identified all beneficial owners; others had not understood the client’s business or where it operated.
ICAEW also describes reviewers carrying out basic open-source checks and finding information the firm did not know. The relevant legal framework is regulation 28(2)–(4) of the Money Laundering Regulations 2017.
For a UK company, the file should normally show the following (each part is explained in what the AML client file must contain, section by section):
- Registered name and Companies House number.
- Company status and registered office. If the register shows the client as dissolved, close the file with the register’s date.
- Officers and persons with significant control, or PSCs.
- The date when the Companies House information was read.
- The ownership chain through any corporate PSC.
- The nature of the business and where it operates.
The purpose of the relationship should also be understandable from the file. A registry extract on its own does not explain what the client does or why the relationship exists.
EntityWatch writes the customer due diligence note from Companies House and puts a source and a read date on every fact, including the chain through any corporate PSC. For what a current file looks like after onboarding, see ongoing monitoring of clients: what counts as evidence.
What the file must show: the registered entity, the relevant people, the ownership chain, the business activity, the purpose of the relationship and the date each source was checked.
The risk assessment: re-performed, not just read
A reviewer may re-perform your client risk assessment from the know-your-client information and open sources. ICAEW’s 2024/25 monitoring reviews found ineffective risk assessment documentation in 12.6% of firms reviewed. The issue was not limited to the rating: firms had failed to document risks that reviewers identified, even when staff could discuss them.
Regulation 28(12)–(13) requires customer due diligence to reflect the firm-wide risk assessment under regulation 18(1), including factors such as the purpose of the relationship.
Your file should record:
- Each relevant risk factor.
- The source for that factor.
- The rating assigned.
- The reasoning behind the rating.
- The person who made or approved the decision.
- Any difference between the standard process and the work actually performed.
A risk label without written reasons is difficult to defend. The reviewer needs to see how the facts led to the conclusion.
A practical risk note might connect the client’s ownership, geography, services, customer base and delivery model to the final rating. It should distinguish facts from assumptions and record unresolved questions rather than hiding them.
EntityWatch supports a documented client risk assessment, but rules do not replace your judgement. The rules can propose a risk class; you approve it. If you choose a different class, record the reason in writing. See the related guide on what to record in an AML client risk assessment.
What the file must show: the risk factors, their sources, the rating, the reasoning and the person who approved the assessment.
Verification that matches the risk
Verification is effective only when it addresses the risk you identified. ICAEW’s 2024/25 monitoring reviews found ineffective verification in 10.2% of firms reviewed. One example involved carrying out more identity checks on a beneficial owner when the actual risk concerned transactions involving a high-risk third country.
The file should connect three things:
| File question | Evidence to look for | What the reviewer is testing |
|---|---|---|
| What risk was identified? | Written risk factor and source | Whether the concern was specific |
| What verification was performed? | Documents, checks or reliable source records | Whether the work addressed that concern |
| Why was it sufficient? | Written conclusion and approval | Whether the evidence supports the decision |
Do not confuse identity verification with registry checks. EntityWatch does not verify identity documents. Your firm must complete that separate step with its own provider or in person, as appropriate.
A stronger file explains why the selected evidence was proportionate. If the concern is ownership, the file should address ownership. If it is geography, the evidence should address geography. More documents do not automatically mean better verification.
What the file must show: the identified risk, the evidence gathered for that risk and a written explanation of why the evidence was sufficient.
Keeping the file current: the most common finding
ICAEW names keeping customer due diligence current as the most common finding of its 2024/25 monitoring reviews: 11.6% of firms reviewed were not performing and updating CDD through the relationship. ICAEW raises the issue when there is no evidence of updated CDD on at least one sampled client file, including cases where firms considered changes but did not record the review.
Regulation 28(11) requires ongoing monitoring of the business relationship, including scrutiny of transactions where necessary and keeping documents, data and information up to date.
Examples of trigger events identified by ICAEW include:
- A new service for an existing client.
- Significant changes to key office holders.
- The introduction of a politically exposed person.
- A suspicious activity report.
Record checks that found nothing as well as checks that found a change. A blank file does not show that someone reviewed the client. It shows only that the evidence is missing.
Each review should state the date, what was checked, the result and any follow-up. For UK clients, EntityWatch re-reads Companies House on a schedule and records every check with its date and result, including the checks that found nothing, so the file shows the review happened.
See how EntityWatch re-reads Companies House and records every check.
What the file must show: the date of every review or check, what was checked, the result and the action taken where something changed.
PSC discrepancies: the question small firms miss
A reviewer may ask whether you compared the PSC register with what you learned independently. Under regulation 30A of the Money Laundering Regulations 2017, a relevant person must report a material discrepancy in beneficial ownership information to the registrar. For companies, that registrar is Companies House.
ICAEW identifies common discrepancies involving:
- Name.
- Nature of control.
- Date of birth.
- Nationality.
- Country of residence.
- Correspondence address.
- Notified date.
The file should show that the comparison happened, what the result was and what you did if a material discrepancy existed. A procedure that exists only in the policy manual is not enough if the sampled file contains no evidence of the comparison.
EntityWatch puts the PSC register as read, with its date, into the note, so the comparison has a fixed starting point. It does not decide whether a difference is material or file the report for you. Your firm remains responsible for reviewing the information and taking the required action.
Read ICAEW’s guidance on reporting discrepancies in the PSC register and record the outcome in the client file.
What the file must show: the PSC comparison, the result, the decision on materiality and, where applicable, the report and date.
Run this on five of your own files
You can test your readiness tonight by opening five client files and checking whether another reviewer could reconstruct your decisions without asking you to explain them. Use the same checklist for each file. Missing evidence is the item to fix first, not necessarily the item with the highest risk label.
For each of five files, tick whether you can find:
- A Companies House extract or equivalent register evidence, with the date read.
- The client’s registered name, number, status and registered office.
- All identified beneficial owners and an explanation of how you identified them.
- The ownership and control chain, including any corporate PSC.
- The nature of the business, where it operates and the purpose of the relationship in your own words.
- Each risk factor, its source, the rating and the written reason.
- The person who approved the risk assessment.
- Verification evidence that addresses the specific risks identified.
- The date and result of the latest CDD review or point-in-time check.
- Evidence of checks that found no change.
- Any trigger event and the action taken after it.
- A PSC comparison and the outcome of any discrepancy review.
- Sanctions and PEP screening results, with the date and the names screened. A possible name match needs a recorded review and decision.
- A dated record of each version of the file and who approved it.
Use a simple status for each item: present, incomplete or missing. Then fix the oldest missing evidence first. Do not recreate a historical check as if it happened earlier. Record what you are doing now and why.
EntityWatch is built around this evidence problem: the note is written from the register with its sources, you approve the risk class, and each approved version is signed into an audit trail. Its coverage is published country by country.
FAQ
The practical answer to most review questions is the same: document the decision in the client file. A reviewer may sample files rather than inspect every relationship, but any sampled file must demonstrate proportionate identification, risk assessment, verification and ongoing CDD. The following answers address the questions small practices most often face.
How many client files will the reviewer look at?
ICAEW describes a risk-based sample. The number varies with the size of the firm, the risks in its client base and the services it provides. There is no single number that applies to every firm. Prepare every file as though the reviewer could select it.
Is it enough to explain my risk assessment in the meeting?
No. ICAEW treats documentation as ineffective where the firm has not documented risks identified by the reviewer, even if the firm can discuss those risks. Regulation 28(16) requires the firm to be able to demonstrate that the extent of its measures is appropriate. Put the reasoning in the file.
How often should I update customer due diligence?
Update CDD on a risk basis and when a trigger event occurs. ICAEW notes that some firms review low- and normal-risk clients every three years and high-risk clients every year, but that approach works only when procedures also capture trigger events. Record the date, scope and result of each review.
Do I have to report a difference between the PSC register and what I found?
You must consider whether a difference is a material discrepancy. Regulation 30A requires a relevant person to report a material discrepancy in beneficial ownership information to the registrar. For companies, this means Companies House. Keep the comparison, decision and any report date in the file.
How long do I keep the client file?
Under regulation 40(3), records must generally be kept for five years from when you know or have reasonable grounds to believe that the business relationship has ended. Regulation 40(4) caps the obligation for certain records at ten years. Apply the retention rules to the relevant record and keep your rationale documented.
Can beneficial ownership be monitored everywhere?
No. Beneficial ownership monitoring is available only where the official register publishes the relevant information. EntityWatch supports ownership monitoring in the United Kingdom through Companies House. It does not claim ownership coverage where a register is legally closed or does not publish owners in a monitorable form.
What happens after a possible sanctions match?
In EntityWatch a possible match is routed to your review, with the names that were screened, and is never recorded as a confirmed hit. Your firm assesses it and records the decision.
Next step: write your first client note free. Enter a Companies House number; EntityWatch reads the register, follows the PSC chain, screens sanctions and PEP lists, and writes the note with a source and date on every fact. Rules propose the risk class and you approve it. Free for up to five companies. Then hold it against one of the five files you opened tonight.
This is not legal advice.
This content was generated with artificial intelligence.