The check your engagement cannot start without
Under the Money Laundering Regulations 2017, your practice has to complete client due diligence before it acts for a client, hold the evidence for five years, and escalate suspicion to your nominated officer without tipping the client off. FigsFlow runs those obligations inside the same engagement flow as your proposals and letters — so the compliant route is the only route open.
See how due diligence actually runs on a new client
Click through a real onboarding — from the accepted proposal to the sealed record — and see exactly where FigsFlow stops the firm acting before the check is finished.
The check starts when the client does, not when someone remembers
The client accepts the proposal. FigsFlow opens the due diligence stage on the same client record, with the fields your firm's AML procedure requires, and puts a named person against it. Nobody has to create a task, open a second system, or re-key the client's details.
Your client verifies from their phone, not your reception desk
FigsFlow sends the identity request to the client by email or SMS. They confirm their identity with photo ID and a liveness check, without downloading an app or coming into the office. The result posts back to the client record — it does not arrive as an attachment somebody has to file.
The rating shows its reasoning, so your MLRO can disagree with it
Every client gets a risk rating from the diligence data collected. It is not a black box — FigsFlow lists the factors that drove the rating, so your nominated officer can review the reasoning, override it where their professional judgement differs, and record why. The record carries both the system rating and the override.
High risk stops the engagement. It does not just flag it.
Where the rating triggers enhanced due diligence, the EDD stage opens on its own with the fields your procedure specifies — your team is not deciding what extra information to ask for. The engagement letter is held, the nominated officer is notified inside the platform rather than by email, and only they can clear the stage.
The record is sealed, dated, and counted down for you
Once diligence is complete the record is sealed against the client file — reviewable, not editable. It holds the identity evidence, the rating and its factors, every officer decision with its timestamp, and the date the relationship began. FigsFlow tracks the five-year retention period and flags the file for deletion review when it ends.
Nobody should have to work out whether the CDD on a client you have already billed was actually finished
It is Friday, the engagement letter went out on Tuesday, and the first invoice is already raised. Somebody now has to establish whether client due diligence was completed before the firm started acting — and where the evidence for that sits.
“The junior ran the ID check. I signed the letter after that.”
“I uploaded the passport. I assumed the manager did the risk rating.”
One passport scan. No risk assessment, no date, no sign-off.
Three people, three answers, and a practice that has already acted for the client. That is not a diligence problem — it is a sequencing problem. Due diligence was a task somebody had to remember, rather than a gate the engagement could not get past.
One record, from the accepted proposal to the sealed file
Diligence does not start with a blank folder. When a client accepts a proposal, FigsFlow opens the check on the same client record your team already uses for letters, jobs, and billing — so the evidence lives where the work lives, not in a parallel system nobody audits.
The client signs. This is the only moment anyone types anything.
The check appears on the client record with the fields your procedure requires.
The rating decides whether the engagement continues or pauses for enhanced checks.
The evidence stays on the client file, dated and immutable.
Make due diligence a gate, not a to-do
FigsFlow holds the engagement letter until the diligence stage is complete. Not a reminder, not a red flag on a dashboard — the release button is unavailable while an item is open. Your team can keep working on the file; they cannot let the firm start acting for a client whose check is unfinished.
The letter cannot go out before the check is done.
The letter unlocks the moment the last item closes. Nobody has to notice, and nobody can wave it through.
An override is available to the nominated officer. It requires a reason, and the reason stays on the record.
Rate the risk, and show the working
A rating nobody can interrogate is not much use to a supervisory body. FigsFlow shows which factors moved the client up or down, so the rating is something your MLRO can review, accept, or override on the record rather than a score they have to take on trust.
Your MLRO can override the rating. They cannot override it silently.
Let the engagement pause itself
Enhanced due diligence is a stage in the workflow, not an exception somebody has to spot. When it opens, the work downstream of it blocks: the letter waits on the officer, and the first job waits on the letter. The chain clears itself in order, and the person who needs to act next is told.
Nobody has to decide to escalate.
Staff can open blocked work and prepare it. They cannot complete it before the stage it depends on is cleared.
Three outcomes, all of them on the record
Every check ends in one of three places, and each one leaves something a reviewer can read six months or six years later.
The record seals and the engagement letter is released without anyone chasing it.
The enhanced stage opens with your procedure's fields, and the engagement waits.
The nominated officer is notified with a timestamp, and the log cannot be edited afterwards.
Every outcome leaves a record your supervisory body can read.
What the Money Laundering Regulations 2017 ask of your practice
Accountancy service providers in the UK are supervised for anti-money laundering purposes and are required to run due diligence before acting, apply enhanced measures where the risk is higher, appoint a nominated officer, retain the evidence, and report suspicion without tipping the client off. Here is where each obligation sits in FigsFlow.
| Obligation | What it requires | Where it sits in FigsFlow |
|---|---|---|
| Client due diligence | Identify and verify the client before establishing the business relationship. | Diligence stage opens from the accepted proposal; the engagement letter is gated on it. |
| Enhanced due diligence | Additional measures where the risk is higher, and for politically exposed persons. | EDD stage opens automatically on the rating and blocks the work downstream of it. |
| Ongoing monitoring | Keep the relationship and the client's information under review. | A review cycle per client, set by risk rating and surfaced before it falls due. |
| Record keeping | Retain the diligence evidence for five years from the end of the relationship. | The record is sealed on the client file and flagged for deletion review at the end of the period. |
| Nominated officer | A named officer within the firm to receive and consider internal reports. | An MLRO role with escalation routing and a log that cannot be edited after the event. |
| Reporting suspicion | Report to the National Crime Agency, and do not tip the client off. | The client record is structured and exportable so the officer has the information in one place. |
This table summarises obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. It describes how FigsFlow supports a firm's compliance workflow and is not legal or regulatory advice. Your own supervisory body's guidance takes precedence, and your firm remains responsible for its AML procedure.
Set the review cycle once. Stop tracking it in a spreadsheet.
Diligence is not finished when onboarding is. Set the review cycle against the client's risk rating and FigsFlow raises each review on schedule — a client who has drifted past their review date is visible before a file review finds them.
Twelve months of scheduled reviews at a glance, with a full history of when each client was onboarded, rated, re-reviewed, and by whom.
Built for practices that have outgrown a shared drive and an AML folder
FigsFlow is not a checklist bolted onto your engagement process. Due diligence sits on the same client record as the proposal, the letter, and the work — so the compliant sequence is the one your team follows by default, not the one they follow when they remember.
Built to fit how your practice actually runs
The obligation is the same whether you are one person or fifty. What changes is who has to see it.
Run diligence on a new client yourself, without a separate tool or a manual checklist to maintain.
Anyone on the team can start a check. The nominated officer still sees every escalation.
Standardise the procedure before headcount turns inconsistency into a supervisory finding.
Diligence records held inside your own Microsoft tenant, under your IT team's existing policy.
Built inside working practices, not in a lab
FigsFlow was built inside two working practices. The AML workflow came from partners who had been through file reviews, not from a product roadmap — which is also why we are precise about what it does not do.
What stays with your firm
FigsFlow structures the workflow, holds the evidence, and puts the decision in front of your nominated officer with a record attached. Whether a transaction is suspicious, whether enhanced due diligence has been satisfied, and whether a report goes to the National Crime Agency remain your firm's professional judgement. FigsFlow evidences; it does not advise, and it does not report on your behalf.
Talk to us about your AML procedure →Everything the check connects to
Due diligence is one stage of the client record. Here is what sits either side of it.
Entity, officer and ownership data pulled onto the client record instead of typed in.
See Companies House →The rating that decides whether the engagement continues or pauses for enhanced checks.
See risk assessment →The document the diligence gate holds until the check is complete.
Page coming soonWhere the check gets created, the moment a client accepts.
Page coming soonSignatures captured against the same client record as the diligence evidence.
Page coming soonWhere the client uploads what you have asked for, without an email thread.
Page coming soonReady to see the check run inside a real engagement?
Bring an actual client onboarding to the call. A practice specialist will walk through diligence, risk rating, enhanced checks and the officer log against your firm's own procedure — no scripted demo, no invented data.