AML client risk assessment template
The risk factors to consider for every new client under the Money Laundering Regulations, how to decide the level of due diligence, and how to record and review the outcome.
Free to copy and adapt. Last updated October 2026.
Client risk assessment · Hartley & Co Ltd
What is an AML client risk assessment?
An AML client risk assessment is the record a UK accountant makes, for each client, of how likely the relationship is to be used for money laundering or terrorist financing. It looks at the client, the services, the countries involved and how the client was taken on, and decides whether simplified, standard or enhanced due diligence is needed and how often the client should be reviewed.
The risk assessment
Complete it for every new client, alongside your firm-wide risk assessment. Follow your AML supervisor's guidance and the accountancy sector guidance for anything this doesn't cover.
1. Client identification
- Identify and verify the clientstrively automates this
- Identify and verify any beneficial owners with more than 25% ownership or controlstrively automates this
- Understand the ownership and control structure, especially if it's complex
- Understand the nature and purpose of the business relationship
- Collect documents for a manual check if the client can't be verified electronicallystrively automates this
2. Client risk factors
- Is the client, or anyone connected to them, a politically exposed person?
- Does the client appear on a sanctions list?
- Is there any adverse media about the client or the people behind it?
- Is the client in a cash-intensive or higher-risk industry?
- Is the ownership structure unusually complex, with no clear reason?
- Has the client been reluctant to provide information or identification?
3. Service risk factors
- Will you handle client money or make payments on the client's behalf?
- Will you provide company formation, registered office or trust services?
- Does the work involve complex or unusual transactions?
- Is the client asking for services that don't fit the size or type of business?
4. Geographic risk factors
- Is the client, or are its owners, based outside the UK?
- Does the business trade with, or have links to, high-risk third countries?
- Do funds come from, or go to, jurisdictions with weaker AML controls?
5. Delivery channel risk factors
- Was the client onboarded without meeting in person?
- Was the client introduced by a third party, and do you know who they are?
6. Outcome
- Record the overall risk rating: low, medium or highstrively automates this
- Record the due diligence level: simplified, standard or enhanced
- For enhanced due diligence, record the source of funds and source of wealth
- Record the reasons for your rating
- Get approval from your MLRO or a senior manager for high-risk clients
- Set a review date, such as every 12 months for low risk and more often for higher risk
How to use it
Assess before you act
Complete the risk assessment and due diligence before the business relationship starts.
Write down your reasons
A rating with no reasons is hard to defend. Note briefly why you've rated each client as you have.
Review when things change
Revisit the assessment at the review date, and whenever something significant changes, such as new owners.
Run AML checks as part of onboarding
In strively, AML checks run in AML HQ once the engagement letter is signed, with each client's results and records kept together.
Frequently asked questions
Do accountants need to do a client risk assessment?
Yes. Under the Money Laundering Regulations, UK accountants must take a risk-based approach, which means assessing the risk of each client relationship as well as carrying out a firm-wide risk assessment.
What risk factors should an AML client risk assessment include?
Client risk, such as politically exposed persons, sanctions and complex ownership; service risk, such as handling client money; geographic risk, such as links to high-risk third countries; and delivery channel risk, such as onboarding without meeting in person.
When is enhanced due diligence needed?
When the risk is higher, for example for politically exposed persons, clients linked to high-risk third countries, or complex or unusual transactions with no clear purpose. It usually includes checking the source of funds and source of wealth.
How often should client risk assessments be reviewed?
On a schedule that matches the risk, such as every 12 months for low-risk clients and more often for higher-risk ones, and whenever something significant changes.
Who supervises accountants for anti-money laundering?
Most accountants are supervised by their professional body, such as ICAEW, ACCA or AAT. Accountants who aren't members of a professional body are supervised by HMRC.
More free templates
Make AML checks part of every onboarding
A 30-minute demo, tailored to your practice, using the kind of enquiries you get every week.
Book a demo