Take a client on with the file your supervisor will ask to see.
Engagement letter, identity and verification, the risk assessment, the PSC check against Companies House, the 64-8 and agent authorisations: each step in the order the Money Laundering Regulations put them, dated and signed by the person who did it, as the record a firm must hold for five years after the relationship ends.
The steps and what each rests on are the regulation's, not the software's: an onboarding file is what ICAEW, ACCA, AAT or HMRC asks to see.
Three things to know first.
- The order is the regulation's
- Customer due diligence before the work starts (reg 27 and 28), the risk assessment that decides how much (reg 28(12), reg 18, reg 33 for enhanced), politically exposed persons (reg 35), records kept five years after the relationship ends (reg 40).
- Every step names a person
- Who verified the identity, who rated the risk, who signed the engagement letter, and when. The file is a record of people doing their duties, not boxes a program ticked.
- The proposal becomes the client
- A signed proposal makes a prospect a client in the books and on the board, starts the services' jobs, and opens the client's portal. One signature, no re-keying.
The onboarding file, step by step.
Proposal and engagement letter
The services, the fees, the terms and the firm's letter of engagement, sent as a link the client signs from their phone with no account. The signed PDF is kept with the signer's name, time and address.
Identity and verification
Who the client is and who owns and controls it, the documents seen or the check run, recorded with the person who did it and the date.
The risk assessment
The factors as the firm's own assessment lists them, ticked by a person; the rating the rules give; and what enhanced due diligence it calls for, if any.
The PSC check
Persons with significant control read from Companies House and set beside what the client told you, so a difference is seen before the work starts.
Agent authorisations
The 64-8 and the agent services authorisations the firm needs for HMRC, tracked per tax, so a return is never prepared for a client the firm cannot yet file for.
The trail
Each step dated and signed, the documents attached, the file complete or not at a glance: the record reg 40 asks the firm to hold for five years after the relationship ends.
From the first call to the board.
Day 1
The proposal goes out
Services, fees and the engagement letter, as a link. The firm's price list fills the figures; a person edits and sends.
Day 1
The client signs
From their phone, with no account to create. The signed PDF lands on the file; the prospect becomes a client in the books and on the board.
Day 2
Due diligence
Identity and verification, the PSC check, the risk assessment. Each step signed by the person who did it.
Week 1
Authorisations and connections
The 64-8 and agent services authorisations requested and tracked; the books connected; the client's portal opened.
Done
The file is complete
Every step dated and signed, nothing outstanding. The agent may now work the client; a client the firm keeps by hand is marked so.
The regulation behind the file.
| Step | What it rests on |
|---|---|
| Customer due diligence | MLR 2017 reg 27 (when) and reg 28 (what: identify and verify the client, its beneficial owners, and the purpose and nature of the relationship). |
| Risk assessment | MLR 2017 reg 28(12) and (13): the extent of due diligence on a risk-sensitive basis; reg 18, the firm's own assessment; reg 33, enhanced due diligence. |
| Politically exposed persons | MLR 2017 reg 35. |
| Record keeping | MLR 2017 reg 40: five years after the relationship ends. |
| Engagement letter | The bodies' practice assurance (ICAEW, ACCA, AAT) and PCRT: the services, the responsibilities, the fees, the terms. |
| Agent authorisation | HMRC's 64-8 and the agent services account's digital handshake, per tax. |
Straight answers.
- Does the agent do the due diligence?
- No. A person identifies and verifies the client, rates the risk and signs each step. The agent prepares the proposal and the letter, reads Companies House for the PSC check, and keeps the file in order.
- Does a client need an account to sign?
- No. The proposal is a link that opens on their phone; they read, sign and get the PDF. The firm gets the signed copy with the signer's details.
- Where is the file kept, and for how long?
- On the client's record, in London. Reg 40 asks the firm to hold it for five years after the relationship ends, and the file is built to be kept and shown for that long.
- Does it cover a supervisor's visit?
- The file is built to be shown: each step, who did it, when, and what it rests on. Ask us for a sample file as a supervisor would see it.
Take the next client on properly.
Send us your engagement letter and your risk factors. We set the steps up to match, on the demo client first.