ID Verification Checklist for AML: Steps Every Accounting Practice Should Follow
ID verification checklist for AML under MLR 2017: individual and company checks, beneficial owners, EDD triggers and the records your supervisor will ask for.
Client onboarding done. Documents verified. Files saved.
Your AML supervisor calls. They want your records. Now.
You log into FigsFlow. Click on the client’s name. Passports, address proof, sanctions checks, verification certificates. All there. Timestamped. Traceable.
This guide provides the complete ID verification checklist for AML that every accounting practice needs, plus the exact steps to verify clients correctly under MLR 2017.
Key Points from the ID Verification Checklist (For Busy Accountants)
- The checklist covers three core identifiers for every individual client: full name, residential address and date of birth, verified from a reliable source independent of the client
- MLR 2017 lets you verify from documents or from information, including electronic identification (regulation 28(18) and (19)). Electronic checks are permitted, not mandatory
- Beneficial owners are individuals who own or control more than 25% of a company, or otherwise control it (regulation 5). You must identify each one and take reasonable measures to verify their identity (regulation 28(4))
- Common mistakes include accepting expired documents, treating a photocopy as verification, and stopping at the PSC register for beneficial owners
- FigsFlow automates document collection, electronic verification, sanctions screening, and audit trail generation in one integrated workflow
What ID Verification Actually Means Under MLR 2017
ID verification confirms your client is genuinely who they claim to be. This forms the foundation of Customer Due Diligence, commonly called CDD, under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
The goal is preventing criminals from using your practice to launder money through the financial system. Without proper verification, your firm becomes an unwitting participant in financial crime.
MLR 2017 requires you to:
- identify every client and verify their identity before the business relationship starts (regulation 28(2) and regulation 30(2))
- base that verification on documents or information obtained from a reliable source which is independent of the client (regulation 28(18))
A photocopy on file proves you received a document, not that you checked it. Verification means confirming the document is genuine, current and belongs to the client, or confirming the details through an electronic identification process. Regulation 28(19) treats electronic identification as a reliable independent source where the process is secure from fraud and misuse.
For company clients, requirements extend beyond the entity itself. You must identify every beneficial owner, meaning any individual who owns or controls more than 25% of the shares or voting rights, or otherwise controls the company (regulation 5), and take reasonable measures to verify their identity (regulation 28(4)).
The Persons with Significant Control register, abbreviated as PSC, shows who owns or controls companies. Relying on it alone does not meet your beneficial owner duties (regulation 28(9)), because ownership structures change and complex arrangements can obscure who ultimately owns or controls the client.
Want to Master AML ID Verification?
Get the complete guide to ID verification requirements, acceptable documents, and FigsFlow’s automated process.
The Complete ID Verification Checklist for AML Compliance
Use this ID verification checklist to verify every client under MLR 2017. Check off each requirement as you complete it and retain the records for your AML supervisor.
For Individual Clients
| Verification Step | Requirement | Status |
|---|---|---|
| Identity Document | Has one document been collected? (Valid passport / Photocard driving licence / National ID card) | ☐ |
| Address Document | Has one document been collected? (Bank statement / Utility bill / Council tax bill / Mortgage statement) | ☐ |
| Verification Method | Has identity been verified against the original document or through a reliable independent electronic source, and the method recorded? | ☐ |
| Purpose of Relationship | Has the purpose and intended nature of the business relationship been assessed and recorded (regulation 28(2)(c))? | ☐ |
| Sanctions Screening | Has client been screened against sanctions lists? | ☐ |
| Document Storage | Have copies been saved with verification date and source recorded? | ☐ |
For Company Clients
This part of the ID verification checklist applies to corporate entities, directors, and beneficial owners who own or control more than 25% of the company.
| Verification Step | Requirement | Status |
|---|---|---|
| Company Details | Have the company name and registration number been obtained and verified (regulation 28(3)(a))? | ☐ |
| Registered Address | Has the registered office address, and the principal place of business if different, been obtained and verified (regulation 28(3)(a)(iii))? | ☐ |
| Constitution & Governing Law | Have reasonable measures been taken to determine and verify the law the company is subject to and its constitution, such as its articles of association (regulation 28(3)(b)(i))? | ☐ |
| Board & Senior Persons | Have the full names of the board of directors and the senior persons responsible for operations been determined and verified (regulation 28(3)(b)(ii))? | ☐ |
| Authorised Contacts | Has anyone acting on the company’s behalf been confirmed as authorised, identified and verified (regulation 28(10))? | ☐ |
| Purpose of Relationship | Has the purpose and intended nature of the business relationship been assessed and recorded (regulation 28(2)(c))? | ☐ |
| Register Excerpt | Has an excerpt of the beneficial ownership information on the register been collected before onboarding and during ongoing due diligence, and any material discrepancy reported to Companies House (regulation 30A)? | ☐ |
| Beneficial Owners Identified | Have all individuals who own or control more than 25%, or otherwise control the company, been identified? | ☐ |
| Beneficial Owners Verified | Have reasonable measures been taken to verify each beneficial owner's identity, and the steps recorded? | ☐ |
| Ownership Structure | Has the ownership and control structure been understood, documented and timestamped (regulation 28(3A))? | ☐ |
For Enhanced Due Diligence (EDD) Clients
The ID verification checklist must be expanded for Enhanced Due Diligence cases to reflect higher risk, increased scrutiny, and additional documentation requirements.
| Verification Step | Requirement | Status |
|---|---|---|
| EDD Trigger Identified | Has the reason for EDD been documented? Mandatory cases include a PEP, a person established in a high-risk third country, false or stolen identification, and complex or unusually large transactions (regulation 33(1)). Factors such as non-face-to-face onboarding or complex ownership can also make a case high risk (regulation 33(6)). | ☐ |
| Additional Documents | Has at least one additional verification document been obtained? | ☐ |
| Source of Funds | Has the source of funds been established? For PEPs, has the source of wealth also been established (regulation 35(5)(b))? | ☐ |
| PEP Approval | For PEPs, has senior management approved establishing or continuing the relationship (regulation 35(5)(a))? | ☐ |
| Enhanced Monitoring | Has an enhanced ongoing monitoring schedule been set and recorded? | ☐ |
Why Every Accounting Firm Needs a Formal ID Verification Checklist
Without a documented ID verification checklist, firms rely on memory, informal processes, and inconsistent checks. If you cannot show your supervisor how and when each client was verified, you cannot evidence compliance, even when the documents exist. A formal checklist ensures every mandatory step under MLR 2017 is completed, recorded, and auditable.
Common ID Verification Mistakes That Lead to Supervisory Action
These five mistakes create compliance gaps that can lead to supervisory action and financial penalties, even when firms believe they’re doing everything correctly.
In most cases, these failures occur because firms do not follow a consistent ID verification checklist across all client types.
Mistake #1: Treating a Photocopy as Verification
Photocopying a passport does not, on its own, satisfy verification requirements.
A photocopy proves you received a document, not that you verified it. Verification means checking that the document is genuine, current and matches the client, or confirming the details through a reliable independent source such as an electronic identification process (regulation 28(18) and (19)).
The real risk is discovering during a supervision visit that verification you thought was compliant actually wasn’t.
This usually happens when firms treat document collection as sufficient and fail to follow a documented ID verification checklist that records how each document was checked.
The same applies when another firm carried out the checks. Regulation 39 lets you rely on certain third parties for customer due diligence, but your firm remains liable for any failure to apply the measures (regulation 39(1)). Obtain the underlying information immediately and agree arrangements that let you get copies of the evidence on request (regulation 39(2)).
Mistake #2: No Written Document Policy
MLR 2017 does not list acceptable documents. Your firm sets that list in its AML policy, based on its risk assessment and its supervisor’s guidance.
A properly maintained ID verification checklist applies that list consistently, so every team member accepts and rejects the same documents.
Your policy should settle the documents that cause the most disputes: expired identity documents, mobile phone bills, credit card statements and utility bills printed from the internet.
Care-of addresses need a policy position too. Address evidence should show the client lives at the address, not just receives mail there.
Decide in advance how you treat store cards, gym memberships and loyalty programme statements, and write that decision into the policy.
Mistake #3: Missing Beneficial Owner Verification
The PSC register shows people with significant control over UK companies. That overlaps with, but is not the same as, the beneficial owners you must identify under MLR 2017. Checking the register and stopping there is not sufficient (regulation 28(9)).
You must take reasonable measures to verify each beneficial owner’s identity so you are satisfied you know who they are (regulation 28(4)(b)). If three individuals each hold 30% of the shares, all three are beneficial owners and all three need verifying.
Indirect holdings count too (regulation 5(1)(b)). If Company A owns 60% of your client and one individual owns 60% of Company A, that individual controls Company A and so indirectly controls more than 25% of your client. They are a beneficial owner even though their name never appears on your client’s share register.
For multi-tiered groups, you must take reasonable measures to understand the full ownership and control structure (regulation 28(3A) and 28(4)(c)). How far up the chain you go is a judgement call, so record why you stopped where you did. If you have exhausted all possible means and still cannot identify a beneficial owner, regulation 28(6) to (8) lets you treat the senior person responsible for managing the company as its beneficial owner, provided you record every step you took and the difficulties you met.
This gap arises when the ID verification checklist is applied only to the company itself and not extended to every individual who owns or controls more than 25%.
Beneficial ownership is not a one-off check. Regulation 27(8)(b) requires you to apply customer due diligence again when an existing client’s circumstances change in a way that is relevant to your risk assessment, and regulation 27(9)(a) names a change in the beneficial owner as one of the signals. Verify any new beneficial owner or director before relying on the old file.
Mistake #4: Incomplete Audit Trails
You verified the client two years ago. Your supervisor wants proof. You search through folders, emails, and separate systems trying to compile documentation.
That scattered approach creates compliance gaps even when you performed verification correctly. You might have the documents but cannot prove when you obtained them, which sources you checked, or who conducted the verification.
An effective ID verification checklist requires not just documents, but a complete audit trail showing when verification occurred, which sources were checked, and who completed each step.
MLR 2017 requires you to keep customer due diligence records for five years from the date the business relationship ends (regulation 40). Timestamped records showing who did what and when make those records usable during a supervision visit.
A passport copy in your filing cabinet proves you received a passport. It doesn’t prove anyone checked it was genuine, or that sanctions screening ran.
Mistake #5: Delayed Verification After Onboarding
You win a new client. Send engagement letters. Start work. Three weeks later someone remembers you haven’t completed AML checks yet.
That delay creates regulatory breach. Regulation 30(2) requires verification before the business relationship is established. The exception in regulation 30(3) applies only where completing verification during onboarding is necessary to avoid interrupting normal business and the money laundering risk is low.
The gap opens when onboarding happens in a CRM while AML checks happen in separate systems. Nobody owns the handoff, so verification gets delayed or forgotten.
Client information lives in your CRM. Documents live in email. Verification certificates live in the AML tool. Risk assessments live in spreadsheets. Every handoff between them is a point where a check can be missed.
Firms avoid this breach by embedding the ID verification checklist directly into onboarding, ensuring verification is completed before any work begins.
See the Complete List of AML Mistakes
Discover all common ID verification mistakes that lead to supervisory action and how to avoid them.
Read: Common ID Verification Mistakes in AML →
How FigsFlow Eliminates These ID Verification Mistakes
FigsFlow automates every step of the ID verification checklist from document collection through to the audit record. The system handles what manual processes struggle with: consistent execution and complete documentation.
- Automatic Verification at Onboarding: Verification triggers when clients accept engagement letters. No delays, no forgotten checks.
- Electronic Verification Built In: Checks run through a secure digital onboarding link or Trust ID integration with NFC chip passport verification, and every result is recorded against the client.
- Sanctions & PEP Screening Included: Automatic screening against PEP lists and financial sanctions lists.
- Timestamped Audit Trails: Document uploads, verification checks, risk assessments, and approvals recorded automatically, ready when your supervisor asks.
- Senior Management Approval Routes: High-risk cases escalate automatically to designated senior managers. EDD situations flagged and routed without manual intervention.
With FigsFlow, your entire ID verification process runs in one place, so every client is verified and every record is documented.
Beyond AML ID Verification: What FigsFlow Offers
FigsFlow is a complete client onboarding platform offering everything from initial proposals through ongoing compliance. Here’s what you get:
- Proposal management and professional templates
- Engagement letters with built-in e-signature
- Secure document collection portals
- Complete AML compliance module
- Pricing and fee management
- Team collaboration with role-based access
- Integrations with HubSpot, Xero, QuickBooks, and Stripe
And the best part? It’s yours at zero cost for the next 30 days.
What to Do Next
Here’s your four-step action plan to move from manual checklists to automated compliance.
- Review Your Current Process
Check your ID verification against the checklist in this guide. Look closely at beneficial owner checks and at how each document was verified. - Calculate Your Opportunity Cost
Time spent per client × monthly new clients × your hourly rate. Compare this to FigsFlow’s pricing. - Test FigsFlow Free for 30 Days
Upload actual documents, run verification checks, complete risk assessments. Experience automated processes with real client scenarios. - Choose What Protects Your Firm
Manual processes create gaps. Automated processes apply the same steps every time. The choice determines your exposure during supervision visits.
Additional Resources
- Money Laundering Regulations 2017: The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
- HMRC Economic Crime Supervision Handbook: Detailed guidance on supervision expectations and common compliance failures
- Complete Guide to AML Software: Complete Guide to AML Software for Accountants, Bookkeepers & Tax Advisors
- How to Write an AML Policy: How to Write an AML Policy for Your Firm: A Practical Guide for UK Accountants
- High Risk Jurisdictions: High-risk and other monitored jurisdictions identified by FATF
Conclusion
An effective ID verification checklist under MLR 2017 requires reliable identity evidence, a recorded verification method, beneficial owner checks, and complete audit trails. Missing any element leaves your firm exposed at its next supervision visit.
Manual processes fail because verification steps are spread across multiple systems, making even a well-designed ID verification checklist difficult to apply consistently. Documents get missed, verification gets skipped, beneficial owners get overlooked, audit trails develop gaps.
FigsFlow runs the checks inside the onboarding workflow. Audit trails generate automatically. Senior approvals route without manual escalation.
The question isn’t whether to automate but whether you’ll automate before your next supervision visit or after.
See Automated ID Verification in Action
Watch FigsFlow verify clients electronically, screen sanctions automatically, and build complete audit trails in real time.