Law Firm AML Client Due Diligence Checklist Template

Record the client, the matter and who does what, then decide whether the work is in scope of the Money Laundering Regulations 2017. The date the instructions were received sets every due date up to the sign-off.

• Record the client, the matter and the people involved — the client’s name, the matter, the date the instructions were or will be received, the expected end of the matter, the fee earner, the compliance contact, the MLRO, the person who signs off, and the type of client
• Decide whether the work is in scope of the regulations — whether the firm is acting as an independent legal professional in a financial or real property transaction, as a trust or company service provider, or as a tax adviser, with the reasons recorded
• Record why the work is out of scope and close this run — after ‘Not in scope: this checklist is not needed’ only: the reasons, who agreed them, and a note to run this checklist if the matter later comes into scope
• Check what the firm-wide risk assessment and policy say about this kind of work — the rating the firm-wide risk assessment gives this type of client and matter, and any steps the policy requires for it
• Understand the purpose and intended nature of the matter — what the client wants done and why, how the instructions reached the firm, whether you met the client, and whether the work makes sense for this client

Assess the client and the matter against the firm-wide risk assessment, record the reasons, and set the level of due diligence. The SRA expects a client risk assessment at the start of every client relationship.

• Assess the client risk factors — who the client is, where they and their owners are based, how they are structured, whether anyone is hiding behind them, and how they came to the firm
• Assess the matter risk factors — the size, complexity, timescale and purpose of the matter, who pays, and whether it fits what you know of the client
• Rate the risk and set the level of due diligence — an overall rating with the reasons written down, and the level of due diligence it calls for: simplified, standard or enhanced

Identify the client and verify who they are from documents or information from a reliable source that is independent of them, along with anyone who acts for them. Only the check for your type of client appears.

• Identify the client and verify their identity — full name, date of birth and address, verified from documents or information from a reliable and independent source, or a secure electronic identification process
• Identify the organisation and verify its details — name, registration number and registered office, and for a company the law it is under, its constitution, its directors and the senior people running it
• Identify the trust and verify the trustees — the trust’s name and type, the trust deed, the trustees who instruct the firm, and the settlor, beneficiaries or class of beneficiaries and anyone with control
• Check anyone who acts for the client — whether anyone gives instructions on the client’s behalf, that they are authorised to, and their own identity verified from an independent source

Applies only when the client is not an individual. Identify who ultimately owns or controls the client, verify them, understand the ownership and control structure and, where it applies, check the official register.

• Identify the beneficial owners — the individuals who own or control more than 25%, who otherwise control the client, or the trust’s settlor, trustees, beneficiaries and controllers
• Verify the beneficial owners — reasonable measures, matched to the risk, so you are satisfied you know who each one is, without relying only on the public register
• Understand the ownership and control structure — how the client is owned and controlled through each layer, why it is structured that way, and whether that makes sense for its business
• Collect the register excerpt and report any material discrepancy — an excerpt from Companies House, the trust register or the register of overseas entities before the relationship starts, and any material discrepancy reported

Screen the client, the beneficial owners and the people acting for them for politically exposed persons and sanctions, search for adverse media, and check for links to high-risk countries. A match adds the steps it needs.

• Screen for politically exposed persons, family members and close associates — the client and each beneficial owner checked, and the result recorded with the source used
• Check the client, owners and counterparties against the UK Sanctions List — the client, anyone who controls or owns more than 50% of it, the people acting for it and the other parties to the matter, with the date and result
• Resolve the possible sanctions match — after a possible match only: compare dates of birth, addresses and other identifiers, record the outcome, and take no money until it is resolved
• Stop, freeze any funds and report the designated person — after a confirmed match only: no funds taken or paid, any funds or assets held frozen, a report to OFSI (or OTSI for trade sanctions), a suspicious activity report considered, and the SRA told where its rules require
• Search for adverse media on the client and its owners — searches on the client and beneficial owners at a depth that suits the risk, with the results judged for source, relevance, timing and seriousness
• Check for links to FATF call for action countries and other high-risk places — where the client, its owners and the other parties are established, and whether any is in a country on FATF’s list of high-risk jurisdictions subject to a call for action
• Apply enhanced due diligence for the PEP — after a PEP result only: the level of risk and the extent of enhanced measures assessed, and adequate measures taken to establish source of wealth and source of funds
• Apply the measures for a FATF call for action country — after a Yes only: more information on the client and beneficial owner and on the relationship, source of funds and wealth, the reasons for the transactions, and enhanced monitoring planned

Find out where the money for this matter comes from and how the client came to have it, to a depth that suits the risk. Take no money other than for fees and disbursements until it is done.

• Establish the source of funds for the matter — the amount, currency and remitting account, and how and from where the client got the money, with evidence that matches the risk
• Check any third party paying into the matter — who else is contributing, their relationship to the client, why they are paying, and their own source of funds where the risk calls for it
• Understand the client’s source of wealth — how the client built up their overall wealth, recorded from what they tell you for low or standard risk, and evidenced for high risk

Record what the level of due diligence means for this matter, then look again at the risk rating now that screening and source of funds are done. Simplified due diligence is a reduced form of the checks, not no checks.

• Record why simplified due diligence applies and what is adjusted — after a low-risk rating only: why the risk is low with reference to the firm-wide assessment, which measures are adjusted in extent, timing or type, and the monitoring that stays in place
• Apply enhanced due diligence and plan enhanced monitoring — after a high-risk rating only: the extra measures taken, such as further independent sources, more on the client’s background and finances, and closer monitoring of the matter
• Review the risk rating now the checks are done — whether screening, the source of funds or anything else changes the rating, and if it does, the answer on Phase 2 changed so the right tasks appear

Consider whether anything gives grounds for suspicion, then the person named on the first task signs off that CDD is complete before the firm acts. Nothing after the sign-off can be completed until it is done. If CDD cannot be completed, the firm stops.

• Consider whether anything gives grounds to know or suspect money laundering — everything found so far weighed by the fee earner, with any knowledge or suspicion reported internally to the MLRO and nothing said to the client about it
• Make an internal report to the MLRO — after a Yes only: the client, the matter, what was found and why it is suspicious, given to the MLRO and recorded, with the matter paused
• Decide whether to report to the NCA and whether consent is needed — after a Yes only: the MLRO’s decision on a suspicious activity report, whether privilege applies, and whether a defence against money laundering is needed before the firm does anything more
• Finish the missing due diligence and come back to the sign-off — after ‘Not yet’ only: what was missing, the checks completed, and the decision on the sign-off changed to Approved before it is completed
• Stop: do not act, take or pay money, and consider a disclosure — after ‘CDD cannot be completed’ only: no transaction carried out, the relationship not started or ended, and the MLRO deciding whether a disclosure is required
• Close the matter with the client without tipping them off — after ‘CDD cannot be completed’ only: the client told the firm cannot act, any money returned only to where it came from and only as the MLRO allows, and the file kept
• Sign off that CDD is complete before the firm acts — identity, beneficial owners, screening, source of funds and the right level of due diligence all done, any internal report dealt with, and the decision recorded

Keep the checks up to date while the matter runs, check the money that arrives against what you were told, screen again before completion, and keep the records for five years after the relationship ends.

• Set how the matter will be monitored — who watches the matter, how often the client and matter risk assessment is looked at, and what would trigger fresh checks
• Check the money received against the source of funds — each payment into client account matched to the expected funds by amount, sender and account, with anything unexpected reported to the MLRO
• Review the risk assessment if anything has changed — new parties, a change in ownership or control, new sources of funds or a change in the matter, with the assessment updated and fresh checks done
• Screen again before completion or before money is paid out — the client, owners and other parties checked again against the UK Sanctions List and for PEPs before completion or before funds are released
• Keep the CDD records for five years after the relationship ends — the CDD documents, risk assessments and transaction records filed, the date the five years end recorded, and personal data deleted after that unless an exception applies