AML Documentation Accounting Firms

For many accounting firms, AML documentation requirements for customer due diligence in accounting firms are primarily associated with supervision and the risk of administrative sanctions. However, the same documentation is often the most important evidence when the firm is challenged by a client, a supervisory authority or, in the worst case, before a court in connection with allegations of liability for damages or involvement in money laundering.

From Compliance File to Central Evidence

The regulatory framework on anti-money laundering and counter-terrorist financing requires the firm not only to carry out customer due diligence measures, but also to document how risks have been assessed and managed. In practice, this documentation is what should show that the firm acted carefully and on a risk-based basis.

This may include anything from simple notes on the purpose of the business relationship to extensive enquiries into beneficial owners, complex ownership structures and unusual transaction patterns. The issue is not only whether the information exists, but whether it is traceable, comprehensible and capable of being understood afterwards.

AML Risk Classification When the Client Challenges the Firm

Disputes between a client and an accounting firm do not only concern incorrectly recorded entries or shortcomings in the delivery of services. In some situations, the client may argue that the firm should have reacted to suspicious circumstances, advised against certain arrangements or had no right to terminate the engagement.

In such a situation, customer due diligence documentation may have direct significance for whether the firm is considered to have acted correctly. Typical questions that may arise include:

• How did the client describe its own business and business model when the engagement began?
• How did the firm assess the client’s risk level, and on what grounds?
• Has it been documented when and how questions were asked about unusual transactions or changes in the business?
• Are there notes showing that the firm advised against certain arrangements or highlighted risks to the client?

If these elements are missing or unclear, it becomes difficult to show what the firm actually did, even if the employees in practice acted correctly and responsibly. Documentation may therefore become decisive for the evidential position in allegations of negligence or breach of contract.

Supervision – When the Overall Picture Must Be Demonstrated

During supervision by a competent authority, the purpose is not to investigate an individual dispute, but to assess whether the firm works systematically and on a risk-based basis as a whole. Customer due diligence documentation is then central to showing how the firm has applied its policies and procedures in practice.

The authority will often want to see:

• How the general risk assessment is reflected in individual client relationships.
• How risk classification is carried out and how the reasoning appears in real cases.
• Whether enhanced measures are documented where there is increased risk.
• How monitoring and reassessment are documented over time.

If the documentation is fragmented, varies significantly between case handlers or is spread across several systems, the risk increases that the supervisory authority will consider that the firm does not have sufficient control. Well-structured documentation can, by contrast, help show that any shortcomings are limited, defined and manageable.

Suspicion of Involvement in Money Laundering

In the most serious cases, an accounting firm may become the focus of a criminal investigation into money laundering or aiding money laundering. This may involve situations where a client is suspected of having used the firm as part of a wider arrangement.

Here, customer due diligence documentation can serve several functions:

• Show what knowledge the firm actually had about the client’s business and transactions.
• Clarify which questions were asked and which answers were provided by the client.
• Support the position that the firm reacted to warning signs and took measures, such as enhanced monitoring or reporting a suspicion.
• Make clear that any deviations were due to mistakes or insufficient information, not intent or gross negligence.

What Is Often Missing in Practice

Many firms today have some form of basic documentation: identity verification, information on beneficial owners and an AML risk classification. What is often missing are precisely the elements that are most valuable as evidence:

• Brief but clear reasons for risk classification and the choice of measures.
• Notes on dialogue with the client when questions and clarifications arise.
• Documented considerations when the firm has accepted or declined a higher-risk client.
• Notes explaining why a deviant behaviour or pattern was not considered to reach the reporting threshold.

From a purely efficiency-based perspective, writing down these assessments may feel like additional work. From an evidential perspective, however, this is where the decisive value arises: the ability to see, afterwards, the reasoning behind the decisions.

Internal Allocation of Responsibility and Personal Liability

The documentation is not only important externally, but also internally within the firm. It may be crucial in clarifying what was a business line decision and what amounted to individual mistakes.

By ensuring that central decisions concerning risk clients, rejected engagements or reporting of suspicions are documented and approved at the right level, it becomes easier to show that individual case handlers did not carry a disproportionate personal responsibility. In the same way, documentation helps the board and firm management demonstrate that they have in fact exercised their responsibility for governance and control of AML work.

Strengthening Evidence Through AML Risk Classification Documentation

Viewing documentation requirements from an evidential perspective often leads to concrete improvements. Practical steps may include:

• Introduce fields for explaining the risk classification and the choice of measures.
• Make it easy to document dialogue with the client in connection with questions and deviations.
• Ensure that decisions on high-risk clients and rejected engagements are documented with dates and decision-makers.
• Build in support for documenting why suspicions were not considered reportable.
• Carry out sample reviews where you test whether an external party would understand your decisions based on the documentation.

When customer due diligence documentation is designed with evidential value in mind, it becomes more than a way to check off regulatory requirements. It becomes protection for the firm, its employees and its management if something goes wrong. For firms that want to develop this work further, it may be valuable to seek support from experienced lawyers within the anti-money laundering regulatory framework who can help design documentation, processes and allocation of responsibility in a way that holds up in both supervision and disputes.