The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 set out the legal framework for customer due diligence in the UK. For accountants, bookkeepers, and tax advisers, CDD is not a background compliance concern. It sits at the centre of every new client relationship.
This guide works through what the regulations actually require, how to carry out each step in practice, and what is at stake if you do not.
Who Does CDD Apply To?
The MLRs apply to “relevant persons” – a defined category of businesses and individuals operating in sectors that are considered higher risk for money laundering and terrorist financing.
For the accounting profession, this includes accountants, tax advisers, auditors, insolvency practitioners, bookkeepers, and trust and company service providers. If your work involves preparing or carrying out financial transactions on behalf of clients, handling client money, or advising on tax or business structuring, you are within scope.
This is not optional compliance. Being a relevant person under the regulations creates a legal obligation to have policies, controls, and procedures in place, and to apply them consistently.
When Does CDD Apply? (Regulation 27)
- Establish a business relationship
- Carry out an occasional transaction of €15,000 or more (or €10,000 in cash for high-value dealers)
- Suspect money laundering or terrorist financing, regardless of transaction value
- Have doubts about the veracity or adequacy of documents or information you previously obtained
What CDD Requires You to Do (Regulation 28)
Regulation 28 sets out the specific measures that must be applied once the obligation to carry out CDD is triggered. There are six distinct requirements. Each one is a separate legal duty.
When Must Verification Be Completed? (Regulation 30)
How to Apply a Risk-Based Approach
The regulations do not require the same level of scrutiny for every client. They require a risk-based approach, meaning the depth of CDD must reflect the money laundering and terrorist financing risk each client presents. There are three levels.
Ongoing Monitoring: What It Means in Practice (Regulation 28(11))
Record Keeping: What to Keep & For How Long (Regulation 40)
Regulation 40 imposes a separate and distinct obligation on record-keeping. Many firms apply CDD correctly but fall short on documentation.
You must keep copies of all documents and information obtained to satisfy your CDD requirements. This includes identity documents, evidence of beneficial ownership, risk assessments, EDD reports, and records relating to any material discrepancies found and reported on beneficial ownership registers (Regulation 30A).
You must also retain sufficient supporting records for each transaction subject to CDD or ongoing monitoring to enable reconstruction of that transaction.
The retention period is five years, beginning from the date the transaction is complete (for occasional transactions) or the date the business relationship ends. Under Regulation 40(4), there is a maximum retention period of ten years for transaction records within an ongoing relationship.
Once these periods have expired, Regulation 40(5) requires you to delete any personal data obtained for the purposes of the regulations unless you have a specific legal basis to retain it, such as for court proceedings or with the customer’s explicit consent. Data protection obligations run alongside these requirements to ensure personal data is handled appropriately.
What Happens If You Do Not Comply (Regulation 76)
Part 9 of the MLRs sets out the enforcement framework. The consequences of non-compliance are not theoretical. The FCA and HMRC both have the power to act.
Under Regulation 76, a designated supervisory authority, either the FCA or HMRC, can impose a civil penalty of whatever amount it considers appropriate on any person who has contravened a relevant requirement. There is no statutory cap on the fine.
In addition to financial penalties, the supervisory authority can publish a public statement censuring the firm or individual. Where an officer of a business was knowingly involved in the contravention, a penalty may be imposed directly on that individual, not just on the firm.
Regulation 77 goes further. If a firm fails to comply with a relevant requirement or repeatedly fails to provide required information on funds transfers, the FCA can suspend or cancel its permissions and registrations altogether.
Two things are worth noting. First, the penalty can be avoided only where the firm can show it took all reasonable steps and exercised all due diligence to ensure compliance. Good intentions are not a defence; clear documentation of your policies and the actions you took is. Second, Regulation 76(6) requires supervisory authorities to consider whether the firm followed relevant guidance issued by the FCA or approved by the Treasury when determining whether a contravention occurred.
Tools to Help You Stay Compliant
Managing CDD manually is time-consuming and leaves room for error. Across a growing client base, keeping identity documents current, running sanctions checks, and maintaining audit-ready records becomes a significant administrative burden.
FigsFlow is built specifically for accountants, bookkeepers, and tax advisers in the UK. Its AML module covers the full CDD workflow in one place.
Client identity documents are verified in under a minute. Checks run automatically against sanctions lists, PEP databases, watchlists, and the Amberhill database. Companies House verification for company directors is built in. The platform covers Customer Risk Rating, Enhanced Due Diligence, and Firm-Wide Risk Assessment, with a complete audit trail and AML report generated at the end of each check.
AML checks start from £3 per ID check on a pay-as-you-go basis, or £2.10 per check with the £8 per month plan that includes risk assessment tools. There are no hidden per-check fees. PEP screening, sanctions, liveness, and Companies House verification are all included in a single price.
Start a free 30-day trial or book a demo at figsflow.com.
Conclusion
CDD under the MLRs 2017 is not a one-time exercise. It is an ongoing obligation that covers who you take on, what you know about them, how you monitor them, and how long you keep the evidence.
The regulations are specific. The penalties for getting it wrong are real. And the good news is that the process, when handled properly, does not need to take over your day.
Know your triggers. Apply the right level of scrutiny. Keep your records. And review your clients regularly. That is what navigating CDD in practice actually looks like.
Frequently Asked Questions
The four key Customer Due Diligence (CDD) requirements are:
Verify the customer’s identity.
Identify the beneficial owner(s).
Understand the purpose of the business relationship.
Continuously monitor the relationship and transactions.
Customer Due Diligence (CDD) refers to the process of verifying the identity of clients and assessing potential risks to prevent financial crimes like money laundering and terrorism financing.
Customer Due Diligence (CDD) involves verifying a customer’s identity and understanding their business relationship. For example, a bank verifies a client’s identity with a passport and utility bill before opening an account.
CDD (Customer Due Diligence) is a process within KYC (Know Your Customer). KYC refers to the overall procedure of verifying a customer’s identity, while CDD focuses on assessing risk and monitoring ongoing transactions.
