KYC for accounting firms: what you actually have to collect
The rules tell you what to verify. They don't tell you where it sits in your onboarding, who chases the documents, or what to say to a client of eleven years who asks why you suddenly need their passport. That's this page.
Updated 2 August 2026
What to collect, by client type
| Client type | Broadly what's required | Where the work actually is |
|---|---|---|
| Individual client | Full name, date of birth, residential address, verified from reliable and independent documentation or data. | The identity check most firms already do informally. The change is that it has to be documented and retained. |
| Company | Company name, registration details and registered office, plus identification of beneficial owners — generally those controlling 25% or more, or otherwise exercising control. | Beneficial ownership is where the work is. A two-layer structure means tracing through to the humans at the end. |
| Trust | Trust name and type, trustee details, and identification of the settlor, beneficiaries or classes of beneficiary, and anyone with effective control. | The most time-consuming category by a distance, and the one clients find most intrusive. Budget for the conversation. |
| Anyone acting for a client | Verification of the person's authority to act, as well as their identity. | Easy to miss when a bookkeeper or family member has always been the contact. |
Your existing book: the relief, and its limit
The single most useful thing to know is that you do not have to verify your entire client base from scratch. Clients you already acted for as at 1 July 2026 fall under pre-commencement customer relief.
That is a timing concession, not an exemption. Those clients enter your process the moment a trigger occurs:
- You begin providing a designated service to a pre-commencement client for the first time.
- The client’s circumstances change in a way that alters their risk profile — new structure, new jurisdiction, new controllers.
- Something about the engagement stops making sense to you. This one is judgement, and it is the one that matters most.
Which means the relief mostly buys you sequencing. Rather than verifying two thousand clients in July, you verify them as they come to you — provided you have a process that reliably notices when a trigger has occurred.
Making it survive contact with a real practice
- 1
Put verification before the engagement letter, not after.
Firms that bolt CDD on at the end discover the awkward case after they have already committed to the work. Making it a gate rather than a step means a refusal costs you a prospect, not a client and a written-off job.
- 2
Decide who owns the chasing.
Verification stalls on documents clients do not send. If that chase sits with the partner it will not happen; if it sits with an administrator with a clear script and a deadline, it will. This is a workflow decision, not a compliance one.
- 3
Write the client-facing explanation once, properly.
You will send it hundreds of times. It should say what you need, why the law now requires it, and what happens if they do not provide it — in language that does not sound like you are accusing them of laundering money.
- 4
Decide in advance what a refusal means.
Some clients will decline on principle. Knowing beforehand whether that ends the relationship, and who makes that call, prevents it being decided badly under time pressure with a fee at stake.
- 5
Treat your oldest unverified clients as higher risk, not lower.
The instinct is that a client of fifteen years is obviously fine. In AML terms, a long relationship with no formal verification and no documented source of funds is a weaker position than a new client you onboarded properly last month — not a stronger one.
Frequently asked questions
- What is customer due diligence for accountants?
- Customer due diligence, often called KYC, is the process of identifying who your client actually is and verifying that identity from reliable, independent sources before you provide a designated service. For individuals it covers name, date of birth and address. For companies and trusts it extends to beneficial ownership — the people who ultimately own or control the entity — and to the authority of anyone acting on the client's behalf. It also has to be documented and retained, which is the part most firms were not previously doing.
- Do I need to verify clients I have acted for over many years?
- Not immediately. Pre-commencement customer relief means clients you already acted for as at 1 July 2026 do not need retrospective verification. They enter your process when a trigger occurs afterwards — most commonly when you first provide them a designated service, or when their circumstances change in a way that alters risk. Worth noting: a long relationship with no documented verification is a weaker AML position than a properly onboarded new client, not a stronger one.
- What do I need to collect for a trust client?
- Generally the trust name and type, trustee details, and identification of the settlor, the beneficiaries or classes of beneficiary, and anyone exercising effective control. Trusts are the most demanding category to verify and the one clients push back on hardest, because it means naming people who consider their involvement private. Firms with a lot of trust work should expect this to be the bulk of the workload.
- What happens if a client refuses to provide identification?
- If you cannot complete customer due diligence, you cannot provide the designated service. That is the practical consequence, and it means the decision is really a client-relationship decision: whether refusal ends the engagement entirely or only the designated-service part of it. Firms should decide their position before the situation arises rather than under pressure with a fee at stake. A refusal that seems deliberate rather than merely inconvenient may also raise reporting considerations.
- Can I outsource KYC verification?
- You can use third-party providers and electronic verification services to carry out the checks, and most firms with volume will. What you cannot outsource is the obligation — the reporting entity remains accountable for the outcome, for the adequacy of the process, and for the records. Choosing a provider does not close the question of who in your firm is responsible when something is missed.