Which AML Client Checks Can an Accountant Automate With AI?

An accounting practice can automate the collection and filing around client due diligence: identity capture through a verified service, company-register look-ups, screening searches, reminders and record-keeping. AI can also draft risk-assessment notes. The decisions stay manual: the risk rating, any enhanced due diligence, hit resolution, suspicion reports and the MLRO's sign-off.

The reason is simple. Under a risk-based regime, the firm must be able to justify its judgements to its supervisor, and software cannot give that justification for you. The useful question is therefore not "can AI do AML?" but "which steps are fact-gathering, which are judgement, and where does the record show a named person decided?" Sorted that way, a practice's onboarding falls into eight steps, judged here against the sector guidance for accountants (July 2026 edition, based on the law as of 1 July 2026). It is a practical map and not legal advice; your supervisory body and your MLRO decide what your own procedures require.

Follow me on Instagram@sagnikteaches

The map: eight steps from enquiry to file closure

Keep this table in your procedures, not just in your head. It also doubles as the vendor brief: any tool that claims to do a step in the "human" column is selling you something your supervisor will expect a person to own. For the form, document-request and reminder side of step 1, automating client onboarding in a small accounting practice covers the set-up.

Connect on LinkedInSagnik Bhattacharya

Step 2 in detail: identity verification you can rely on

This is the step where automation has the clearest payoff, because it is mechanical. The accountancy-sector guidance says firms may use electronic identification on its own or alongside paper evidence on a risk-based approach, and it asks firms to understand the system they use: does it draw on multiple sources, are the sources reviewed regularly, are there data-quality controls, and can results be stored or printed with the provider, source and date? A single source such as the electoral register is generally not enough without extra controls.

Subscribe on YouTube@sagnikteaches

The current guidance makes a point many practices miss. It says individuals' identities can be verified with certified and registered digital identity services, and that, to be relied on for these checks, a digital verification service must be on the government register of services certified against the digital verification trust framework. A service that is not certified cannot reliably be treated as suitable, and the firm will need paper documents instead. It also says to document that you checked, and that where the provider's brand is not on the register but the software it uses is, you may need to seek confirmation from the provider, and should consider writing that confirmation into the contract.

So the practical rule for step 2: before you buy or renew an identity tool, look it up on the register, record the date, and save the confirmation. Do not rely on a vendor's marketing line that it is "AML compliant". AI adds nothing here; the benefit is in the workflow (a link sent to the client, the result saved to the file), and it works without a language model.

Step 3 in detail: company checks and the discrepancy duty

Looking up a company, its directors and its persons with significant control is a look-up task, and an automated pull from the company register saves retyping. What the data means is for you. The guidance says that if you find a material discrepancy between what you gather and what the relevant register shows, you must report it to the registrar of companies, and it defines a material discrepancy as one that may reasonably be linked to money laundering or terrorist financing or to concealing details of the client's business. Whether a difference in a name, a nature-of-control entry or a date of birth crosses that line is a judgement. Timing matters too: the guidance says a material discrepancy should be reported as soon as reasonably practicable, normally within 15 working days of establishing that it exists, which leaves room to raise it with the client first in case it is an innocent error. A reminder set on the day a difference is spotted is a sensible piece of automation; the decision that it is material is not.

AI can help in a narrow way: you can give it the register extract and your own file notes, both anonymised or with only the entity name if your terms allow, and ask it to list differences. Ask for a list, not a verdict.

Compare the two lists of people with significant control below.
List A is from the public register extract. List B is from our
client questionnaire. Return a table of: names in A not in B,
names in B not in A, and any pair that looks like the same person
with a spelling or ordering difference. Do not say whether any
difference is significant or reportable.

Illustrative output: "In A not in B: [Person 3] (25-50% shares). In B not in A: none. Possible match: A lists '[initial]. [surname]' and B lists '[first name] [surname]'." The assistant has done the clerical comparison in seconds. The person decides whether the initial and the full name are the same individual, and treats the missing 25-50% holder as a difference to raise with the client before deciding whether anything is reportable.

Step 4 in detail: screening searches and what to do with the hits

PEP and sanctions screening is the other step where automation pays off, since checking a name against specialist databases by hand is slow and error-prone. The guidance says firms must have appropriate systems to determine whether a client or beneficial owner is a politically exposed person, a family member or a known close associate, that where specialist databases are used the firm must understand how they are populated and make sure flagged individuals actually fall within the regulatory definitions, and that a PEP should be handled case by case with enhanced due diligence proportionate to the risk. It also says that refusing a relationship solely because someone is a PEP is contrary to the spirit of the international standards.

Automated search, then, is sensible. What you must not automate is the decision about the hit. Expect many hits to be false positives, such as a common name that matches a listed individual with a different birth year and nationality. Each hit needs a competent person to compare identifiers and record the outcome.

Here AI's role is notes, not decisions. A reasonable use is a template for the hit log, filled by the person.

If you use AI to tidy handwritten or rough notes into this layout, keep names out of the prompt or use a tool approved for client data. The decision lines remain the screener's.

Step 5 in detail: the client risk assessment draft

This is where AI is tempting and where the limits matter most. The guidance puts ultimate responsibility for identifying the risks, and for building risk-based procedures for taking on clients, on the board member or senior manager responsible for compliance; it expects the practice's risk assessment at least annually, with new risks considered as they appear, and client-level assessments follow from it. AI can help structure a client assessment from facts you hold. It should not choose the rating.

Take a four-partner practice onboarding a new client: a small property-letting company owned by two individuals, paying fees from a company account, with an overseas accountant providing earlier years' accounts. Give the assistant the facts without names:

Client facts (no names): property-letting company, two individual
owners, domestic directors, fees paid from the company bank
account, previous accounts prepared by a firm abroad, rental
income from 14 residential properties, no cash, services
requested: accounts and tax returns.

Using the risk factors we apply (client type, geography,
service, delivery channel, transaction patterns), list for each
factor the facts that point to higher risk, the facts that
point to lower risk, and any information we have not yet
obtained. Do not assign an overall rating.

Illustrative output: "Client type: private company, simple ownership (lower). Geography: domestic directors (lower); previous accountant abroad (ask why the change; neutral until known). Service: compliance work, no handling of client money (lower). Delivery: face to face (lower). Information not yet obtained: source of funds for property purchases; reason for leaving previous accountant; confirmation of beneficial owners against the register." The last list is the most useful part, because it becomes the follow-up request to the client. The rating is entered by the person and approved by the MLRO where your procedures require it.

The guidance also expects client information to be kept up to date through event-driven reviews (a change in the client's identity or beneficial ownership, for example) and periodic reviews set by the client's risk. That is a calendar and trigger job, which brings us to step 7.

Step 7: ongoing monitoring that software can run

Ongoing monitoring means keeping client information up to date and reviewing activity for anything inconsistent with what you know of the client. The mechanical part, who is due for a refresh and which changes have been notified, is a listing task. A practice management system or even a spreadsheet with a few formulas can produce "clients whose last CDD review is over twelve months old" and "clients with a change of director or address since last review". AI can draft the reminder email or the questions for a review call. A person judges whether what the client says fits the picture. See how to clean messy data if your client list needs tidying before any of this will work.

A useful example of a trigger rule: a client who was a small sole trader now asks for advice on moving funds into a new overseas company. That is a material change in the nature of the work, and the rule should say a review happens before the work starts. The rule can be automated as a flag in the job-creation form; the review cannot.

What stays strictly manual

• Enhanced due diligence. Source of funds and wealth, higher-risk jurisdictions and PEPs call for individual judgement and, usually, senior approval.
• Suspicion. The guidance describes internal reports to the MLRO and external reports by the nominated officer to the financial intelligence unit. Never route these through a chatbot, and be careful about who sees a draft, because you must not tip off the client.
• The MLRO's sign-off. The guidance says the MLRO retains ultimate responsibility even when parts of the work are delegated or outsourced.
• Refusing or exiting a client. The decision, and the non-engagement record.
• Deleting records. The guidance says CDD records must be kept for five years after the relationship ends. Software can flag the date; a person approves deletion.

Questions to put to a vendor of AML software

Vendor pitches blur the line between automation and judgement, so use a fixed list. If a vendor will not answer in writing, note it. One step comes first: the guidance asks businesses to consider how new business practices, including new technology, could increase money-laundering risk, so record the tool and its risks in your practice's risk assessment before it goes live.

1. Is your digital verification service on the government register of certified services, and can you give written confirmation including the software you use?
2. Which data sources does the screening use, how often are they refreshed, and how are PEPs and associates defined?
3. Do you show the identifiers behind each hit so a person can compare them?
4. Does the tool assign a risk rating? Can we change the rating and record who did?
5. Can every result be exported with provider, source and date?
6. Where is client data stored and is it used to train any model?
7. What audit trail records who did what, when?
8. What happens to our data and records if we leave?

For the wider vendor checklist, questions to ask before buying AI that touches client data and third-party AI risk: ask suppliers where your data goes go deeper.

A worked comparison: manual onboarding against automated onboarding

Say a practice of twelve staff onboards 20 new clients a quarter. A manual process, with a form by email, ID copies by post or in person, register look-ups typed into a file note, a name search on a screening site and a written risk note, takes roughly 90 minutes of staff time per client, so 30 hours a quarter. After automation (an online onboarding form, a certified identity check link, an automated register pull, batch screening, a risk-note template, reminders), the elapsed time drops sharply, and staff time may fall to about 40 minutes per client, mostly on the judgement steps: 13 hours a quarter. The saving, about 17 hours, comes from the clerical steps. The time left is the time you want people spending. Check against your own timings; software and subscriptions also cost money, so compare the saved hours with the annual fee before buying.

Writing it into your procedures

A procedure that mentions AI should say, in plain words, which steps use which tool and who owns the decision. An illustrative paragraph: "Identity is verified through [service], which we have confirmed is on the government register of certified services on [date]. Screening is run through [service]; every hit is resolved by a senior member of staff, who records the identifiers compared. Risk assessments may be drafted using an approved assistant from facts held on file; the risk rating is assigned by the engagement partner and approved by the MLRO where the client is rated high risk. AI is not used to prepare or decide suspicion reports." Update it when you change tools, and tell staff.

The same thinking applies to engagement letters: if you use AI in client work, say so honestly, as covered in how to mention AI use in client contracts and proposals.

A filled-in client file, step by step

To see the pieces together, take an illustrative new client for a three-partner practice: a one-director consultancy company that wants bookkeeping and annual accounts. The file might look like this once the process has run.

1. Onboarding form (automated): sent on enquiry; returned in two days; one reminder auto-sent after 48 hours.
2. Identity (automated): director verified through a certified service; result PDF saved with provider, date and source; register listing of the provider checked and noted.
3. Company check (partly automated): register extract pulled automatically; one person with significant control listed, matching the questionnaire; no discrepancy.
4. Screening (automated search, human conclusion): one possible sanctions hit on the director's name; the screener compares year of birth and nationality, records a false positive, no escalation.
5. Risk assessment (AI-drafted facts, human rating): single-owner company, simple services, domestic bank account; rated lower risk by the engagement partner; filed with the date of next review.
6. Engagement letter and file closed for onboarding: signed by the partner and the client; the file index shows each document and its retention date.

Total staff time might be forty minutes, of which perhaps ten are the false-positive check and the risk rating. If any step had raised a concern, say a complex ownership chain or a source-of-funds question, the file would switch to the manual path for enhanced due diligence, and the MLRO would be told. Designing the "switch to manual" trigger is as important as the automation: write down which answers send a file off the fast track.

Sole practitioners and very small practices

The guidance says a sole practitioner with no relevant employees need not appoint a nominated officer, because they make any external reports themselves, and need not run regular independent reviews unless their supervisory authority requires it. The duties themselves remain. In a very small practice, the person who prepares and the person who approves can be the same, which weakens the control. The workable answer is to make the automation do more of the repeatable evidence (timestamped identity results, saved register extracts, hit logs with identifiers) so that the single decision-maker has a clear trail. Even where it is not required, a short periodic review with an outside colleague or adviser is worth having, and worth writing down. Do not use AI as a stand-in for the second pair of eyes; it can prepare the pack for review, but it cannot be the reviewer.

Training staff on the line between tool and decision

A tool is only as safe as the habits around it. A fifteen-minute briefing covers most of it: what each tool does, what it must never be given, the rule that hits and risk ratings are always decided by a named person, and how to raise a concern internally. Add two examples to the briefing, such as the false positive above and a case where a hit was real, so staff see both outcomes. Repeat it when tools change and keep attendance in the training record, since the guidance expects relevant employees to be trained.

Where it goes wrong in practice

The "verified" badge nobody checked. A practice uses an identity app for two years before someone notices the provider was not on the register. Fix: record the register check at purchase and at each renewal.

The batch screen nobody reads. Hits accumulate in a dashboard. Fix: a named owner, a weekly slot and a rule that unresolved hits block engagement.

The model-written risk rating. A tool outputs "low risk" and staff copy it. Fix: the rating field is completed by a person, and the tool's output is reference only.

Other regulated sectors face the same file-keeping problem; organising estate agents' AML due diligence files with AI shows a parallel file structure you can borrow.

The over-shared prompt. Someone pastes a passport scan into a public chatbot to "read the details". Fix: written rule, an approved tool for any document handling, and a short briefing.

If you want help mapping your onboarding and shaping the questions for a vendor, that is what my AI implementation consultation covers: get in touch. The eight-step table above is enough to start a conversation with your MLRO this week.

Questions practice managers ask about automating AML

Can AI approve a client as low risk?

It can draft a risk assessment from facts you supply, but the rating and the decision to take the client are for a person and, where your procedures require it, the MLRO. The supervising body expects the business to justify its risk-based approach, and a tool's score is not a justification on its own.

Does a screening hit mean the client is a problem?

No. A hit is a prompt to investigate. Many hits are name matches with a different person. Someone competent must compare dates of birth, locations and roles, record the outcome and escalate genuine matches. Automating the search is sensible; automating the conclusion is not.

Is an identity app enough on its own?

The current accountancy-sector guidance says digital verification services should be on the government register of certified services if you rely on them for identity verification. Check your provider's listing, document that you checked it, and keep paper documents as the fallback where it is not listed.

What can I send to an AI chatbot?

As little as possible. Client identity documents and financial details should stay in your secure systems. Use AI for templates, procedure drafts and anonymised or placeholder text, and for tools you have vetted under your data-protection terms. Ask your supervisory body or adviser if unsure.

How long must I keep the checks?

The accountancy-sector guidance says CDD records, including non-engagement documents and ongoing monitoring records, must be retained for five years after the relationship ends. Automating the filing and the deletion date is a good use of software, with a person approving deletion.

Further reads

• Conveyancing Client Onboarding With AI: ID, Forms and Reminders — ID checks, forms and reminders in another regulated practice.
• AI Engagement Letters for Accountants: Faster Drafts, Clear Scope — Draft engagement letters that match your onboarding checks.
• What Is Automation in Accounting? Bank Feeds, Capture and AI Agents — Automating bank feeds and document capture in accounting.
• Payroll Year-End Checklist: Where AI Helps and Where It Misleads — Where AI helps and misleads at year end.
• How Much Time and Money Does AI Staff Training Take? — How much time and money staff AI training takes.
• How to Evaluate an AI Implementation Proposal or Quote — How to judge an AI vendor proposal or quote.
• AI Powered Bookkeeping Platform: How a Practice Chooses One — A test-file method for picking an AI bookkeeping platform: three real client months each, scored on accuracy, review time and cost per client.
• Companies House ID Verification: A Client Chaser Workflow for Accountants — A tracking sheet, a five-status chase sequence and email templates for getting every director and PSC verified, with AI kept away from ID documents.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector (CCAB, July 2026, based on the law as of 1 July 2026), sections on sole practitioners, MLRO responsibilities, risk assessment, CDD, electronic and digital verification, PEPs, material discrepancies, training and record keeping.