Plenty of accountancy websites now offer to get a new client started in minutes. The money laundering regulations take a different view of when a relationship may begin. The gap between those two positions is designed into the onboarding journey, or discovered during a supervisory visit.
This is a practical account of what the regulations require at the point a client signs up, what that means for the forms and portals on a practice website, and how long any of it may be kept. It is written for accountancy practices and for whoever builds their websites. It is not legal or anti-money-laundering advice. Your supervisor’s guidance and your own MLRO decide how these rules apply to your firm.
What the regulations actually ask for
Under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, customer due diligence is three things, not one. Regulation 28(2) requires a firm to:
“(a) identify the customer… (b) verify the customer’s identity… and (c) assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship or occasional transaction.”
Identify and verify are separate steps, and most website onboarding journeys only do the first. A form that collects a name, an address and a date of birth has identified somebody. Verification is establishing that they are that person, from a reliable, independent source.
Where the client is a company, regulation 28(3) is specific about what has to be obtained and verified: the name, “its company number or other registration number”, and “the address of its registered office, and if different, its principal place of business”. Those are fields, and they belong in the onboarding form rather than in an email exchange afterwards.
The timing rule that contradicts “sign up in minutes”
Regulation 30(2) sets the sequence:
A relevant person “must comply with the requirement to verify the identity of the customer, any person purporting to act on behalf of the customer and any beneficial owner of the customer before the establishment of a business relationship or the carrying out of the transaction.”
There is an exception in regulation 30(3), and it is narrower than it is often treated. Verification may be completed during the establishment of the relationship only where it “is completed as soon as practicable after contact is first established”, where it “is necessary not to interrupt the normal conduct of business”, and where “there is little risk of money laundering and terrorist financing”. Both limbs, plus the risk judgement, and that judgement is the firm’s to make and record.
For a website, the practical consequence is about language as much as mechanics. “Become a client in five minutes” describes something the rules do not allow for most firms. “Start your onboarding in five minutes” describes the same journey accurately, and costs nothing in conversion.
Online verification is expressly contemplated
None of this makes digital onboarding a problem. Regulation 28 says information may be regarded as coming from a reliable, independent source where:
“it is obtained by means of an electronic identification process… and that process is secure from fraud and misuse and capable of providing assurance that the person claiming a particular identity is in fact the person with that identity, to a degree that is necessary for effectively managing and mitigating any risks of money laundering and terrorist financing.”
The test is the quality of the process, not the medium. An identity verification service built for the purpose can meet it. A contact form with a file upload field cannot, and a scanned passport arriving in a shared mailbox is a data protection problem wearing an onboarding costume.
That single distinction settles most of the architecture: the website carries the journey; a purpose-built tool does the verification. What the site should do is make the sequence obvious, keep the client informed, and hand each step to something built to hold it.
How long you keep it, and when you must delete it
Regulation 40 requires records of the due diligence to be kept for five years beginning when the business relationship comes to an end. Then comes the part that catches practices with tidy filing and no retention policy:
“Once the period referred to in paragraph (3)… has expired, the relevant person must delete any personal data obtained for the purposes of these Regulations”, unless retention is required by another enactment or for court proceedings, the data subject consents, or there are reasonable grounds to believe it is needed for legal proceedings.
So the obligation is symmetrical: keep it for five years, then delete it. A CRM that accumulates identity documents indefinitely is not being cautious; it is non-compliant in the other direction, and it is also holding exactly the data a breach would be worst about.
What that asks of the systems around a website is modest: know where identity documents live, record the date the relationship ended, and have a review that acts on it.
What this means for the onboarding journey
- Split the journey into stages a client can see. Enquiry, engagement terms, identity verification, authorisation, information from the previous accountant. A visible sequence with a finish line beats a mystery that gets chased by email.
- Collect the company fields properly. Registration number, registered office and principal place of business are named in the regulations; a form that asks for “business address” alone will produce follow-up work every time.
- Put verification behind the right tool, and link to it from the journey rather than improvising with uploads.
- Never take identity documents by email. Whatever the site does, the answer to “where shall I send my passport?” should not be a mailbox.
- Write the public copy to match the sequence. If verification happens before the relationship begins, the website should say so plainly; clients read it as thoroughness, not friction.
- Give retention a home. One place where identity records live, one recorded end-of-relationship date, one scheduled review.
Our accountants page covers the rest of the site: how practices describe services, the onboarding and document-collection sequences, and what a rebuild involves. The companion post on rebuilding an accountancy website deals with the service model itself, including what Making Tax Digital does to it.
What we would not build for a practice
- A public form that accepts passport or driving licence uploads into an ordinary mailbox or form plugin.
- “Instant” onboarding copy that describes a relationship starting before verification.
- A client record store with no deletion rule. Regulation 40(5) makes indefinite retention a decision, not a default.
- An onboarding tracker separate from the client record, which is the pattern that gets abandoned within a month.
- Any wording about your AML obligations that we wrote ourselves. That comes from the firm and its supervisor, and goes up as given.
Sources and method
- MLR 2017, regulation 28: customer due diligence measures, the body-corporate fields, and electronic identification.
- Regulation 30: timing of verification, and the exception in paragraph (3).
- Regulation 40: record keeping, the five-year period, and the deletion duty in paragraph (5).
What this post does not do. Central Systems is not an AML supervisor, a law firm or a compliance consultancy, and nothing here is legal or regulatory advice. It does not tell any practice when due diligence is triggered, what risk rating a client deserves, when enhanced due diligence applies, or what to do about a suspicion. Those are matters for your MLRO and your supervisory body’s guidance. It does not cover the separate rules for trusts, politically exposed persons, reliance on third parties, or reporting obligations. Regulations are amended; the linked text is authoritative and this page is not.
Questions practices ask us
Can the website verify a client’s identity?
Not by itself, and it should not try. It can route the client into a verification service that meets the standard in regulation 28, show where they are in the process, and record that the step was completed.
Is it acceptable to start work while verification is outstanding?
Regulation 30(3) allows completion during establishment of the relationship in narrow circumstances, including where there is little risk of money laundering. That is a judgement for the firm, recorded at the time, not a default setting for a website to assume.
What should the onboarding form actually collect?
Enough to identify the client and the business, including the registration number and both addresses where there is a company, plus what regulation 28(2)(c) calls the purpose and intended nature of the relationship. Verification evidence belongs in the tool built for it.
How long should we keep identity documents?
Five years from the end of the relationship, then delete unless one of the exceptions in regulation 40(5) applies. The practical problem is usually knowing when a relationship ended, which is a record-keeping decision rather than a website one.
Our practice management software does onboarding. Do we need anything on the site?
Often just the front of it: a clear explanation of the steps, and a route into the system that does the work. The common failure is a website that promises one process and software that runs another.
Does saying all this on the website put clients off?
The opposite, in our experience of building these journeys. A practice that explains why it asks for identification looks like one that knows what it is doing, and the clients who object to being identified are not the clients a practice wants.
Does your onboarding journey match what the rules require?
Send us the page a new client lands on. We will tell you what it collects, where it hands over, what it promises about timing, and whether the sequence on the site matches the one your practice actually runs.