Customer due diligence explained: KYC and AML for accountants

AML, KYC and CDD: what the words mean

AML stands for anti money laundering. It covers the whole system of duties on firms, set out mainly in the Money Laundering Regulations 2017, the Proceeds of Crime Act 2002 and the Terrorism Act 2000.

KYC stands for know your client. It is not a legal term in the Regulations. People use it to mean finding out who a client is and checking that it is true.

CDD, customer due diligence, is the term the Regulations use. It includes KYC and more.

When you must carry out CDD

Regulation 27 sets out when CDD applies. HMRC's guidance summarises the main occasions, including when you:

• establish a business relationship with a client;
• suspect money laundering or terrorist financing;
• doubt whether information you were given earlier is true or adequate.

HMRC also expects you to apply CDD again when a client's circumstances change significantly.

What CDD involves

Under regulation 28 you must:

• identify your client and verify their identity;
• identify any beneficial owner and take reasonable measures to verify who they are;
• for a company or other organisation, understand its ownership and control structure;
• assess, and where appropriate obtain information on, the purpose and intended nature of the business relationship;
• carry out ongoing monitoring of the relationship.

The Regulations say verification must be based on documents or information from a reliable source which is independent of the person being checked.

How much checking: simplified, standard and enhanced

The CCAB guidance says CDD should reflect your risk assessment of the client. Where risk is lower you may be able to apply simplified due diligence. Where risk is higher you must apply enhanced due diligence, for example for politically exposed persons.

If you can't complete CDD

Regulation 31 says that where you are unable to apply CDD you must not establish a business relationship with the client, must end any existing one, and must consider whether you need to make a disclosure under the Proceeds of Crime Act 2002 or the Terrorism Act 2000. In practice that disclosure is a suspicious activity report to the National Crime Agency, usually made through your MLRO.

Keeping records

Regulation 40 requires you to keep your CDD records for five years from when you know, or have reasonable grounds to believe, that the business relationship has ended.

Changes in 2026

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 came into force on 30 June 2026 and made targeted changes, including to enhanced due diligence. The CCAB published updated sector guidance based on the law as at 1 July 2026. Check that your procedures follow the current versions.