When an Existing Client Review Raises AML Suspicion
When an existing client review uncovers an unexplained transaction, inconsistency, or gap in the supporting evidence, accountancy firms must decide whether standard enquiries can resolve the matter or whether it should be escalated as a suspicion.
The outcome can affect work already underway, particularly when a filing or piece of advice is linked to the concern. In some cases, a material change in client circumstances might also explain why the review has moved beyond routine monitoring.
Responsibility for the assessment depends on the practice’s structure. In a firm with a dedicated money laundering reporting officer (MLRO), staff report the facts and follow the instructions given.
However, a sole practitioner must make and document the same AML judgments directly, with a defined process for urgent work and new information.
Key takeaways
- Initial enquiries need to remain within the normal scope of the engagement, with the material received assessed against the concern.
- An unresolved concern requires prompt referral through the practice’s formal escalation process.
- The AML record should show the MLRO’s independent decision and the grounds for it.
- Reporting a suspicion and deciding whether to retain the client are separate matters.
- Work connected to the AML matter should continue only within the scope authorised by the MLRO.
- A secure and complete record should retain the original referral, decisions, and later developments.
Suspicion threshold in an existing client review
An anomaly does not prove money laundering, and proof is unnecessary before a reporting duty can arise.
Suspicion requires a factual basis for believing that criminal property or money laundering could be involved. Vague unease is insufficient, with the National Crime Agency (NCA) describing the threshold as a possibility that is “more than fanciful”.
Staff within the practice can make limited enquiries using information already available through client work.
A previously undisclosed payment to a connected party, for example, can justify asking what it relates to and requesting the normal supporting document. When a coherent, evidenced explanation resolves the AML concern, the record should explain the enquiry and the basis for the conclusion.
Practical takeaway: Enquiries must stay within the work ordinarily undertaken and should not involve accusing the client.
Reporting the concern promptly to the MLRO
The internal procedure should provide one clear reporting route to the MLRO or nominated officer, with cover for absence.
Seeking an initial view from an appropriate colleague can help, although it does not by itself satisfy the internal reporting requirement. Commercial sensitivity or the value of a longstanding client must not delay the report.
The report also needs enough detail for the MLRO to understand the issue and any urgent decision. It should set out the relevant facts and explain why the client’s explanation, including any corroborating material, has not resolved the concern.
Any imminent activity or deadline affected by the concern should also be included.
Facts and assumptions should be separated, and responsibility for the external reporting decision rests with the MLRO.
If there is no separate nominated officer, the person responsible still needs a process for reaching and documenting that decision.
MLRO assessment and reporting decision record
The MLRO should assess the report alongside relevant information already held across the practice. The exercise needs to remain controlled and should not prompt an expanded client investigation.
The MLRO’s assessment must address whether the reporting threshold is met and whether any defined future act may require a defence against money laundering (DAML), with instructions provided to those handling the engagement while the matter remains unresolved.
This judgement should remain independent of fee and client-retention pressures. A client partner can supply context, yet a person focused mainly on preserving the relationship should not have a commercial veto.
Precautionary reporting is also inappropriate if the required suspicion has not formed. HMRC’s internal supervision guidance states that compliance officers may examine the information considered and the steps taken when an internal concern does not lead to an external report.
Accountancy firms should also remember that the reasoning must be recorded whether an external suspicious activity report (SAR) is submitted or not; ICAEW’s thematic review specifically expects documented reasons for non-reporting decisions and secure retention of submitted reports.
Practical takeaway: Legal professional privilege and the accountancy reporting exemption can be difficult to apply. Specialist advice may be needed where either genuinely arises.
Continuing client work after a suspicion report
Submitting a SAR does not automatically end the engagement or stop every workstream. The practice must make its own decision about retaining the client after considering the risks. This might require a CDD refresh and senior approval if ethical or professional barriers arise.
Crucially, even if the NCA acknowledges a SAR, the practice still has to decide whether the client or transaction can be accepted based on its own AML and professional-risk assessment.
Future acts requiring a defence against money laundering
A DAML is related to a clearly identified future act that could otherwise amount to dealing with criminal property or participating in an arrangement concerning it. It is not general permission to keep acting, and not every SAR requires a defence request.
If a request has been made, the specified act must not proceed while the relevant notice or moratorium restrictions prevent it. Furthermore, a granted defence neither confirms that the property is legitimate nor displaces the practice’s wider legal, professional, and risk-based assessment of whether to carry out the act.
Other work can continue only if the MLRO is satisfied that it can be performed lawfully and without facilitating the suspected activity.
Staff working on the matter require explicit instructions on what work can continue and how client contact should be handled. Any later information should be referred back through the same AML process before the firm takes further action.
The same instructions should also control how the client is updated. Client communications should be centrally controlled and kept neutral when delay or non-performance could attract questions.
Staff must not reveal that a suspicious activity report has been made or suggest that an investigation may be under way.
Record retention after existing client suspicion
The retained material should include the internal report and a complete account of the MLRO’s reasoning. It should also show any external action taken and any later development that changed the legal position or the practice’s response.
Access to this material needs to be restricted, so keeping them separately from routine client working papers can reduce inadvertent disclosure.
In addition, as there is no single officially prescribed period for keeping these records, the practice needs a documented AML policy that balances retention considerations with data-protection requirements.
The firm-wide risk assessment should then reflect any record-keeping risks that affect how the practice stores and protects SAR-related material.
In summary
A structured response creates a clear record from the first unexplained fact to the action taken. The case record should show the evidence considered and who authorised each step, including how the engagement was affected.
This structure gives staff a defined scope for any continuing work and a controlled way to manage client contact. It also allows the assessment to be revisited promptly if later information changes the position.
FAQs
A reasonable explanation can still leave the concern open if the expected supporting information is missing or does not match the facts. The AML assessment should then focus on whether the gap can be resolved within the standard engagement process. If the response remains incomplete or inconsistent, the issue should be escalated under the firm’s written procedure.
The agreed cover arrangements should direct the AML concern to the person authorised to act in the MLRO’s absence. Note that an informal discussion with another partner does not count as a formal referral. If a filing or other client activity is due soon, instructions from the authorised person are needed before any decision is made on whether to continue.
The answer depends on whether the filing is connected to the activity that caused concern and whether completing it could assist that activity. As such, the MLRO’s confirmation of what work can continue is needed before the relevant work proceeds.
The firm’s response should be coordinated and framed in neutral language that does not reveal the reporting process or suggest that an investigation is taking place. Staff communications need to remain within the MLRO’s instructions on what can be discussed. Any explanation given to the client must remain consistent with the firm’s current position about the work.
The practitioner’s written account should set out the facts that prompted the concern and how the decision was reached. Their account should state whether a report was made and how the decision affected ongoing client work. The record needs to be updated whenever later evidence alters the AML assessment or any resulting action.
Any subsequent information should be referred to the MLRO so the earlier assessment can be reconsidered. This applies whether the information strengthens the concern or provides a credible explanation. Fresh instructions are needed before any affected activity continues, with the firm’s record indicating whether the additional material altered or confirmed the original decision.
References and Source Material
- HMRC, Risks common to accountancy service providers
- Money Laundering Regulations 2017
- CCAB, Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector
- Proceeds of Crime Act 2002, Part 7
- HMRC, Economic Crime Supervision Handbook (ECSH33600 – Checking internal reporting and suspicious activity)
- HMRC, Accountancy sector guidance for money laundering supervision
- ICAEW, AML Thematic Review: 2025 Suspicious activity reports
