When a client starts using a new service, do accountants need to update AML checks?
Last updated: June 25, 2026
When an existing client asks for additional work, the practice should check whether its AML understanding still fits the proposed service.
This depends on the service scope, what is already known about the client, and whether the extra instruction creates information gaps.
While the request does not automatically mean full re-onboarding, the decision should still be recorded so the firm can show why the service change did, or did not, require an AML update.
Key takeaways
- A change in service scope should prompt a focused AML judgement.
- Products and services form part of the AML risk assessment under Regulation 18.
- CCAB treats a service change or a fresh engagement as a possible reason to update CDD.
- The decision should be documented clearly, including why further AML checks were or were not needed.
Why a new service can change the AML picture
AML checks are linked to the work the accountancy firm carries out.
If the instruction expands, the practice should consider whether it still understands the purpose and intended nature of the client relationship.
This is consistent with the Money Laundering Regulations, which treat products and services as part of the firm-wide risk assessment and expect the AML record to reflect how the engagement has developed.
CCAB guidance refers directly to a change in service or a new engagement as possible CDD trigger events. It also says firms should assess the related money laundering risks before offering a significantly different service, or when a client selects one.
The focus should be on what the added work changes. Adding routine bookkeeping to an existing accounts client is different from moving into company formation or registered office work, if the service itself may introduce new AML questions.
When the existing AML record may still be enough
The information already held can be sufficient if the additional work is consistent with the client profile and no fresh gaps appear.
For example, an existing personal tax client who asks for simple self-assessment support after a small change in employment income may not need a full AML reset.
However, if the same client later asks for advice involving offshore income or a complex structure, the practice may need further information before deciding whether the AML record is still sufficient
The next step may be to understand the new instruction more clearly, rather than collect identity evidence by default.
HMRC’s position helps avoid unnecessary re-verification, since it states there is no obligation to re-verify identity simply because a file is being revisited. This is unless there are doubts about the adequacy or reliability of the evidence, or relevant customer details have changed.
CCAB also recognises that established-client checks can be lighter than onboarding when the firm already holds enough information for the service being added.
Importantly, if the added service fits the client profile, the file note can stay brief, but it should still record the new work, the information already on file, and why no further CDD was needed.
When should the new service prompt an AML update?
An AML update is more likely if the added service changes what the firm needs to know about the client or the work being carried out. This may involve a revised client risk rating, targeted questions about expected activity, or a closer look at the purpose of the work.
If the new service introduces ownership, jurisdiction, or source-of-funds issues, the practice may need a broader CDD refresh.
| Service scenario | Likely AML response |
|---|---|
| Routine bookkeeping for a client the practice already understands | Brief note confirming why the current AML position remains suitable |
| Payroll with ordinary staff and payment arrangements | Check how the service will operate and record the decision |
| Payroll with unusual payment instructions or unclear worker details | Ask targeted questions before deciding whether an update is needed |
| Company formation or registered office support | Consider whether TCSP risks affect CDD or the client risk assessment |
| International tax or advisory work involving unfamiliar jurisdictions | Consider whether further information or enhanced due diligence is needed |
Payroll is a useful example of how the details of the service change can impact the AML assessment. A known employer adding routine payroll is different from a client suddenly asking the practice to run payments for several new workers whose roles or pay levels do not fit the business.
HMRC’s accountancy-sector material also highlights that exposure can increase when multiple services are provided and the full range of client activity is harder to see.
International tax or advisory work, for instance, can require a closer look if unfamiliar jurisdictions, complex arrangements, or unusual fund flows are involved. Similarly, a move into company administration support can introduce TCSP considerations that were absent from routine accounts or tax compliance work.
Further questions may resolve the issue without changing the client’s overall risk position. Yet, if the client response shows that the new work carries a higher AML risk, the practice should consider whether the enhanced due diligence rules under Regulation 33 apply.
What to record about the service change
The client AML review record should show how the practice dealt with the service change.
Regulation 40 supports keeping CDD and related records, while HMRC links record-keeping to an audit trail of what was done and why.
A concise note should explain the new instruction and how the practice assessed it, including whether the client risk rating changed and what decision was reached. When no AML update is made, the rationale should be clear enough for the MLRO, another colleague, or a supervisor to follow.
Firms should avoid formulaic wording that simply notes the new service without explaining the AML judgement. Even a short entry should show how the actual work now being provided was assessed.
In summary
A new service should be judged by how far it changes the client relationship that the practice has already evaluated. Routine extra work may only need a brief note, while a move into higher-risk or unfamiliar work might require a more comprehensive AML response.
The safest approach is to treat the new instruction as a prompt to check whether the AML record still reflects the work being provided.
If the added service changes the risk position, expected activity, or information the firm needs, the record should be updated before the expanded engagement is treated as settled.
FAQs
Usually, the practice should first look at what the payroll service involves. Fresh ID becomes more relevant if the arrangement introduces new people, unusual payment instructions, or facts that no longer match the client profile.
Firms should check whether the work moves into TCSP territory or changes its understanding of ownership, control, or purpose. If it does, updated CDD or a revised risk assessment is likely to be appropriate.
It should explain what service was added, whether the client risk position changed, and why the practice decided that further AML work was or was not needed.
No. EDD depends on higher-risk features, such as high-risk jurisdictions, complex arrangements, or unusual activity covered by Regulation 33. The nature of the advice should be assessed alongside the client and the facts of the engagement.
References and Source Material
- Money Laundering Regulations 2017 (Regulation 18, 33, 40)
- HMRC, Economic Crime Supervision Handbook (ECSH33310, ECSH33338, ECSH33375)
- HMRC, Risks common to Trust or Company Service Providers
- CCAB, Anti-Money Laundering Guidance for the Accountancy Sector
- ICAEW, Anti-money laundering for smaller practices
