Anti-Money Laundering Checks


Has the KYC been signed off by the engagement principal? 


Principals do NOT need to sign/review annually (although annual review is encouraged).


Often there will be a scan of an old PDF with a partner signature on file - if this is the case then there is evidence of initial approval and the approving engagement principal's (EP) initials can be added to the live version of the KYC. But in the absence of this, the current / 'new' engaging EP needs to sign to confirm they are happy with the risk assessment. If the process is followed properly, EP approval only takes place at the start and, if applicable, when the risk assessment changes. The EP typing 'reviewed by xx [initials] on dd/mm/yy' is evidence of review on either the Excel KYC or newer ICAP report, we do not need a scanned signature.


ICAP reports saved down should be named ‘KYC’ or something similar to make them easier to identify within M-Files.


Date of last KYC review?


This should be performed each year, as well as whenever there are changes (such as to ownership or directors) or when a new service is provided. If you initial the KYC review you are saying you've done a full review of the KYC information and it is accurate.


Detail sufficient? 


Does the KYC provide sufficient information so an uninformed reader can feel like they 'know your client'? The detail should include, but is not limited to:


  • Who the client is and what services we are providing them
  • All Directors / key individuals are named and it is clear which we need to verify and why
  • Beneficial ownership is clearly identified and evidenced
  • Source of funds / wealth is documented properly – this needs to be a genuine explanation of how the business is funded, or where the individuals’ funds have come from.  For example ‘Directors loans’ is NOT sufficient to explain how a business is funded. 

AML/KYC supporting documents filed in M-files correctly? 


All AML and KYC documents should be filed in the Anti-money laundering folder on M-files


The overall file should also give a clear, stand-alone understanding of the client relationship which is easy to follow for an independent reviewer.


Company search completed?


For the company search, we're not insisting that evidence of the search is saved (commonly the Experian search is saved or a Companies House snapshot), but if the evidence is not saved, then the KYC should comment on what was looked at. The flowcharts state for normal and enhanced risk 'obtain full company search from Companies House including latest confirmation statement and PSC register' so if there is a comment that these had been reviewed and confirmed the shareholdings / directors were consistent with information provided by client, that would be adequate.


Risk assessment 


In most cases following the Excel flowcharts or by answering the ICAP questions will give a clear risk assessment. It is important that we are detailed enough in our client due diligence to be able to answer the questions correctly otherwise, this could lead to getting the risk assessment wrong, for example understanding if a client operates in a red light country. Where we have assessed the risk as other than normal, the KYC should be clear why.


Has ID been verified/Smart Search carried out? 


All clients should have a Smart Search performed except in limited situations such as being assessed as simplified risk. Please refer to flowcharts for guidance on whether ID is required as well.


In the rare instance where the client was taken on before 1 April 2004 ensure the Longstanding Client form is complete and signed for directors in post before this date.


Date of Engagement Letter? 


Must be within the last 3 years


LOE covers services provided?


Ensure adhoc services included as well as specific services and that the LOE covers the work being carried out. Any services provided where the fee is over £1,000 should have a specific LOE in place and not rely on the 'ad hoc' services schedule.


LOE addressed correctly? 


Ensure the LOE is addressed to the correct legal entity / individuals. For example that we have not engaged with Mrs X personally to prepare accounts for a limited company.


LOE signed by client? 


Ensure the copy of the LOE held on m-files is signed