AML checklist for small accountancy practices: turn awareness into everyday action

A useful AML checklist for a small accountancy practice asks whether people can apply the firm's arrangements, not just whether they have a certificate. Start with supervision and responsibilities, review risk assessments and client checks, make the reporting route clear, then check training evidence and follow-up actions. This is a practical review aid, not a complete statutory checklist or a declaration of compliance.

Use it if you run a small practice, manage a bookkeeping team or want to discuss gaps with the person responsible for AML. If you are an independent bookkeeper, start with our guide to AML for bookkeepers and small practices to distinguish supervision, training and CPD.

1. Check the business's supervision position

Can you identify the appropriate supervisor and confirm that your business's current services are covered? Are changes in activities or ownership being considered, rather than relying on what was true when the practice started?

HMRC's registration guidance includes professional bookkeeping within accountancy services and explains situations where HMRC registration is not needed. Do not assume every payroll role, internal finance employee or professional-body member has the same position. Check your actual activities and arrangements.

Action to record: who will confirm the position, what evidence they will check and when they will resolve any uncertainty.

2. Make responsibilities visible

Who is the nominated officer? Who receives an internal concern? What happens if they are unavailable? Where appropriate to the size and nature of the practice, who has senior responsibility for compliance?

For a regulated sole trader without employees, HMRC states that the trader acts as their own nominated officer. That makes knowing the external reporting responsibilities particularly important. A reminder to 'tell the MLRO' is not a usable process when that person is you.

Action to record: the current reporting contact or route, how staff find it and any role-specific learning required. Keep confidential operational details in the firm's approved systems.

3. Connect the risk assessment to the work

Does the practice's risk assessment reflect its clients, services, delivery channels and other relevant risks? Do its policies, controls and procedures follow from that assessment, or are they documents nobody uses?

ICAEW's smaller-practice guidance describes a proportionate, risk-based approach spanning risk assessment, due diligence, monitoring, training, record keeping and reporting. Proportionate means appropriate to the business, not optional because the team is small.

Action to record: one area where the documented approach needs updating or better explanation. Assign an owner rather than simply writing 'review AML'.

4. Check that client onboarding is understood

Can the people onboarding clients explain how the practice identifies and verifies them, establishes relevant ownership or control information and understands the purpose of the relationship? Do they know when to refer an unusual or higher-risk situation for further consideration?

HMRC notes that providing accountancy services virtually does not remove customer due diligence obligations. An online-only practice still needs an appropriate process.

Action to record: test a fictional onboarding situation with a colleague. Ask what they would check, where they would record it and who can resolve uncertainty. Use your approved procedures, not an improvised list of documents.

5. Look beyond the first client check

Would your team recognise a change in ownership, an unexplained transaction pattern or activity inconsistent with the client's business? Is there a route for updating the relevant information and considering what the change means?

For example, a fictional client that normally trades locally starts receiving payments from unrelated companies. The change needs context and appropriate handling. It is not an automatic finding of money laundering, and neither dismissing it nor accusing the client is a substitute for the firm's process.

Action to record: identify how ongoing monitoring works in practice and who acts on changes. Do not use a real customer's information in an informal training exercise.

6. Rehearse reporting without exposing real concerns

Ask a new colleague: 'You see something that does not fit the client's explanation. What do you do next?' A confident answer should include recording facts, following the internal route and respecting confidentiality, not personally investigating or telling the client that a report might be made.

The nominated officer considers concerns and makes external reports where appropriate. Staff awareness and nominated officer responsibilities are different learning needs. Use current supervisor and National Crime Agency guidance for actual reporting decisions.

Action to record: practise a fictional scenario and fix any uncertainty about the route. Never copy suspicious activity reports or sensitive client records into a personal CPD reflection.

7. Review who needs what training

HMRC's AML training guidance explains the regular training requirement for relevant employees and agents, the need to cover money laundering, terrorist financing and proliferation financing, and the written training record requirement. The relevant role and the firm's risk exposure matter.

Check new starters, client-facing colleagues, managers and agents where relevant. Consider whether a change in duties, policy or risk requires an update. Do not turn a course provider's suggested annual review date into a universal legal deadline.

Action to record: the learning need, intended audience, suitable activity and review trigger. Combine general awareness with firm-specific procedures and specialist learning where needed.

8. Keep learning evidence separate from confidential case files

A practical training record can capture the learner, date, provider, topics, assessment outcome where applicable and follow-up needs. Check your supervisor's requirements for the exact record and retention arrangements. A folder of certificates may not explain whether the training was appropriate or applied.

Personal CPD is related but different. You can record the learning and an anonymised reflection in Passport, while keeping the practice's training and operational records in its approved systems. Individuals must decide how the learning meets their professional-body requirements.

Action to record: check one training record for missing information, then agree how the team will keep future records current.

A simple follow-up plan

Use these four fields in your existing task system or review notes:

• Gap: what needs clarification or improvement?
• Owner: who has the authority to resolve it?
• Next action: what specific check, update or learning will happen?
• Review date: when will you confirm the action worked?

For example: 'New starters cannot find the reporting route. Practice manager to include the approved procedure in induction and run a fictional scenario at the next team meeting. Check understanding afterwards.' This is a practical improvement, not evidence that the whole practice is compliant.

When awareness training would help

If the gap is basic understanding, the WorkplaceHero AML awareness course covers accountancy-focused client checks, red flags, responsibilities and escalation through eight modules and practical scenarios. The course page sets out the syllabus, assessment, certificate and current pricing so you can assess its suitability.

It does not provide AML supervision, specialist nominated officer training, legal advice or a guarantee of regulatory compliance. You remain responsible for matching learning to your practice's activities and current supervisory requirements.

Sources and scope

UK guidance checked on 11 November 2026. This review aid draws on the linked HMRC guidance and ICAEW smaller-practice helpsheet. It is deliberately not an exhaustive account of the Money Laundering Regulations or all related obligations, including sanctions and specialist reporting decisions. Check current legislation, your supervisor's guidance and specialist advice where needed.