In one paragraph: onboard every client in the same order: screen (conflicts, competence, risk appetite), do customer due diligence (identity, beneficial owners, purpose of the relationship, a risk rating with reasons, records kept 5 years after the relationship ends), get the engagement letter signed, send professional clearance to the previous accountant, request HMRC or IRS authorisation for each tax on day one, set up software and bank feeds, send a first records request with a date, hold a handover call, and do a 30-day review. No substantive work until the due diligence is done and the letter is signed.
Jump to: Free plan builder · The nine stages · UK AML checks · Risk and enhanced due diligence · HMRC and IRS authorisation · Clearance letter · Questions to ask · Welcome email · Mistakes · With AI · FAQ
Free builder: a dated onboarding plan in a minute
Tell it about the new client and get every step dated on working days from today, a suggested starting risk rating (UK), the authorisation route for each tax, the documents to ask for, a welcome email and a clearance letter. Copy it or download it for Excel or Google Sheets. Nothing you type leaves your browser.
The risk rating is a suggested starting point, not a decision: your practice-wide risk assessment, your policies and your supervisor's guidance come first, and your nominated officer makes the risk calls. Check the current rules on gov.uk or irs.gov.
The nine stages, in order
| # | Stage | Done when |
|---|---|---|
| 1 | Screening | No conflict; the work is within your skills, your AML supervision and your PI insurance; the client fits your risk appetite |
| 2 | Customer due diligence | Identity verified, beneficial owners identified, purpose recorded, risk rated with reasons, records saved |
| 3 | Engagement letter | Signed and back (see the engagement letter guide) |
| 4 | Professional clearance | Letter sent with the client's permission; reply received or chased at 14 days |
| 5 | Authorisation | HMRC or IRS access in place for every tax you'll handle |
| 6 | Systems | Software access, bank and card feeds for every account, receipt capture |
| 7 | First records request | A numbered list with a due date (see the chasing guide if it doesn't come) |
| 8 | Handover call | The client knows how to send records, when, and their deadlines for the year |
| 9 | 30-day review | Feeds working, volume matches the fee, opening balances agreed |
Stages 3, 4 and 5 can run in parallel with stage 2, but in the UK the Money Laundering Regulations generally require identity to be verified before the business relationship is established, so don't start the work itself until stage 2 is done and the letter is signed.
UK: the customer due diligence checks
Bookkeeping for other people is an "accountancy service" under the Money Laundering Regulations 2017, so you need AML supervision (HMRC or a professional body such as AAT, ICB, IAB, ACCA or ICAEW) and you must carry out customer due diligence on every new client. Your supervisor's guidance and your own policy set the detail; this is the core.
| Check | What to do |
|---|---|
| Identify and verify | Full name, date of birth and home address for each individual, verified against photo ID and proof of address or an electronic check your policy accepts. Confirm the authority of anyone acting for the client. |
| Beneficial owners | For companies and LLPs: anyone who owns or controls more than 25% of the shares or voting rights, or otherwise controls it (regulation 5). For partnerships: more than 25% of capital, profits or votes. Verify the individuals. |
| The PSC register | Before you take on a company, LLP, eligible Scottish partnership, registrable trust or overseas entity, collect an excerpt of the register of beneficial owners (people with significant control), and report any discrepancy you find (regulation 30A). |
| Companies House ID | Identity verification became a legal requirement for directors and PSCs on 18 November 2025, with a 12-month transition. Check each person's status; if you're registered as an Authorised Corporate Service Provider, you can verify them yourself. |
| Purpose and nature | Record what you'll do, why the client needs it, and the activity you expect (turnover, transactions, where money comes from). |
| Screening | PEP and sanctions checks (the UK sanctions list), plus adverse media if your policy asks for it. |
| Risk rating | Low, Medium or High, with the reasons, using your practice-wide risk assessment. Set an ongoing monitoring date. |
| Records | Keep the due diligence records for 5 years from the date the business relationship ends. |
| Doubts | gov.uk: "If you have doubts about a customer's identity, you must stop dealing with them until you're sure." |
If anything makes you suspect money laundering, it goes to your nominated officer, who decides whether to make a suspicious activity report. Never hint at it to the client: tipping off is a criminal offence. Keep suspicions out of client-facing files and emails.
Risk factors and enhanced due diligence
gov.uk lists the situations where enhanced due diligence is required:
| Situation | What extra to do |
|---|---|
| The client isn't physically present for the identity checks | Get further information to confirm identity, check documents more closely, or make sure the first payment comes from an account in the client's name |
| A politically exposed person, a family member or a known close associate | Senior management approves the relationship, establish the source of wealth and of funds, monitor more closely |
| A high-risk country | Since the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, this means a FATF "call for action" country rather than the old high-risk third country list |
| Unusually complex or unusually large transactions, or any other higher risk | Find out where the money comes from and why, and record it (the 2026 amendments reworded this trigger) |
Other factors that usually raise the rating: a cash-heavy business, complex or overseas ownership, crypto or high-value goods, and a client who is reluctant to give information. The builder above suggests a starting rating from these; it doesn't replace your judgement or your policy.
HMRC and IRS authorisation for each tax
Ask on day one: some routes post a code to the client, and links expire. From gov.uk's "How to get authorised to act as a tax agent" (updated 7 October 2026):
| Tax | Online | On paper |
|---|---|---|
| VAT | Digital handshake from your agent services account | Not available (64-8 only for legacy VAT) |
| MTD for Income Tax | Digital handshake, or add existing Self Assessment authorisations to your agent services account | Not available |
| Self Assessment | Online Agent Authorisation | Form 64-8 |
| Corporation Tax | Online Agent Authorisation | Form 64-8 |
| PAYE | Online Agent Authorisation or the client's business tax account | Form 64-8 |
| CIS | Online Agent Authorisation or the client's business tax account | Not available |
With the digital handshake, you send the client a link from your agent services account and they must accept it within 21 days or you start again; check "Manage your authorisation requests from the last 30 days". gov.uk is clear that you shouldn't use the client's own HMRC sign-in details.
US: Form 8821 lets you receive a client's tax information and Form 2848 lets you represent them. Both can be submitted online, and the IRS Tax Pro Account gives real-time processing for individuals. States have their own forms for income, payroll and sales tax.
The professional clearance letter (UK)
UK professional bodies expect you to contact the previous accountant, with the client's permission, before you act. Ask whether there's any professional reason you shouldn't take the work, and ask for the handover information. The builder writes this for you; here's what it looks like:
Subject: Professional clearance: Bright Bakes Ltd Dear Smith & Co, We have been asked by Bright Bakes Ltd (limited company) to act as their accountants from Monday 2 November 2026. Their written permission for us to contact you is attached. Please let us know whether there is any professional reason why we should not accept this engagement. To help the handover, we'd be grateful for the following, to the extent the client is entitled to it: - the last accounts and tax returns you prepared, with the trial balance or closing balances - tax computations, capital allowance pools and any losses carried forward - VAT registration details, the VAT return periods and the last return filed - payroll details: PAYE references, employee records and the pension scheme - the Making Tax Digital status for VAT and Income Tax - any open correspondence or enquiries with HMRC We'd appreciate a reply within 14 days. Thank you for your help. Yours sincerely, Priya, Ledger Lane Bookkeeping
If there's no reply after 14 days, chase once, and ask the client to nudge them. Unpaid fees to the old firm are a common reason for silence: ask the client to settle anything undisputed.
Questions to ask a new client
- What does the business do, where, and roughly how big is it (turnover, transactions a month)?
- How is it set up (sole trader, partnership, company), and who owns and controls it?
- Which services do you want from us, and why now?
- Who did the books before, and up to what date?
- Which software do you use, and which bank and card accounts does the business have?
- Are you VAT registered? In Making Tax Digital for Income Tax?
- Do you employ anyone, run payroll or pay subcontractors (CIS)?
- What are your next deadlines, and is anything already late or under an HMRC or IRS enquiry?
- How do you keep receipts and invoices now?
- How would you like to send records and hear from us (portal, app, email, phone)?
- Who else may instruct us for the business?
- What would make this a good year for you?
The last one matters more than it looks: it tells you whether they want a monthly management report or just a calm January.
The welcome email
One email, sent with the engagement letter, that sets out what happens next. The builder writes this with the client's documents list and dates:
Subject: Welcome, and what happens next Hi Jo, Thanks for choosing us. Here's how the next few weeks will go, so nothing comes as a surprise. 1. Your engagement letter is attached. Please read it and sign it: we can't start the work until it's back. 2. We need to confirm your identity (the anti-money laundering rules require it for every new client). Please send the documents below through our secure link rather than by email. 3. So we can deal with HMRC for you, you'll get a link from us and/or a letter from HMRC with a code. Both expire, so please act on them the day they arrive, and tell us if anything looks odd. 4. Please send the records below by Monday 16 November 2026: - Photo ID and proof of address (through our secure portal or in person, not by email) - Company number, and the names of everyone who owns more than 25% or controls the company - Bank and card statements for every business account from the start date we take over - VAT registration number and the last VAT return filed - PAYE reference, Accounts Office reference, each employee's starter details and the pension scheme login - Anything the previous accountant sent you: last accounts, returns, closing balances - Logins or invitations for your bookkeeping software - Any letters from HMRC in the last 12 months Your first deadline is Monday 7 December 2026. We'll work back from that date, so the sooner the records arrive the better. We'll book a short call once everything's in, to walk you through how it all works and the dates for your year. Any questions at all, just reply to this email. Best wishes, Priya, Ledger Lane Bookkeeping
Seven onboarding mistakes
- Starting the work before the due diligence. It's tempting when the client is in a hurry. It's also the finding supervisors see most.
- A risk rating with no reasons. "Low" on its own doesn't show you thought about it. One line per factor does.
- Asking for authorisation after the records. Request it on day one: codes go by post and links expire.
- Collecting ID by email. Use a portal or see it in person, and don't keep more copies than your policy needs.
- No date on the first records request. "When you can" means February.
- Never agreeing opening balances. Without the previous accountant's closing figures, every later report rests on a guess.
- No 30-day review. It's the cheapest moment to fix a fee that was based on 50 transactions a month when the real figure is 300 (see pricing your work).
Doing it with ChatGPT, Gemini or Claude
AI is good at the writing parts of onboarding: the welcome email, the clearance letter, the deadlines calendar and the records list. Keep the compliance decisions with you and your nominated officer, and keep identity documents out of it. A prompt that works:
I'm a UK bookkeeper onboarding a new client. Facts: limited company, bakery with two shops, cash-heavy, director and 100% shareholder is Jo, previous accountant Smith & Co (last year end 31 March 2026), we're doing monthly bookkeeping, VAT and payroll, first VAT return due 7 December. Write: (1) a welcome email with a numbered records list and a due date 10 working days from today, (2) a professional clearance letter, (3) a deadlines calendar for the next 12 months with a records-due date before each deadline. Don't decide the AML risk rating; list the risk factors you notice for me to consider.
Use a first name or client code, never NI numbers, UTRs, passport details or bank account numbers.
Get your AI app to run the whole onboarding from your notes. The Bookkeeper Skills Pro pack includes client-onboarding, which takes "new client: sole trader electrician, ex-accountant Jones, wants VAT and MTD" and writes the sequenced checklist, the due diligence and risk notes for you to decide on, the clearance letter and its 14-day chaser, the welcome email, the deadlines calendar and the 30-day review. Pro also has engagement letters, month-end close, year-end packs and fee reviews.
For the records that don't arrive, the free records-chaser skill writes the numbered "what we still need" list and the dated follow-ups. Set-up takes about 3 minutes, no coding.
FAQ
What should a bookkeeping client onboarding checklist include?
In order: screening (conflicts, competence, your risk appetite), customer due diligence (identity, beneficial owners, risk rating, records), a signed engagement letter, professional clearance from the previous accountant, HMRC or IRS authorisation for each tax, software and bank feeds, a first records request with a date, a handover call and a 30-day review. Substantive work waits for the due diligence and the signed letter.
Do bookkeepers have to do anti-money laundering checks on new clients?
In the UK, yes: bookkeeping for others is an accountancy service under the Money Laundering Regulations, so you need AML supervision, and you must carry out customer due diligence on each new client: verify identity, identify beneficial owners, understand the purpose of the relationship, risk-assess it, and keep the records for 5 years after the relationship ends.
When is enhanced due diligence needed?
gov.uk lists: when the client isn't physically present for the identity checks, when a politically exposed person (or a family member or close associate) is involved, when a high-risk country is involved (since the 2026 amendments, a FATF 'call for action' country), and in any other higher-risk situation, such as unusually large or complex transactions.
How do I get authorised to deal with HMRC for a new client?
It depends on the tax. VAT and MTD for Income Tax use the digital handshake from your agent services account (the link expires after 21 days). Self Assessment and Corporation Tax use Online Agent Authorisation, where HMRC posts the client a code, or form 64-8. PAYE also works through the client's business tax account. Don't use the client's own HMRC sign-in.
What is a professional clearance letter?
A letter to the client's previous accountant, sent with the client's permission, asking whether there's any professional reason you shouldn't take the work and requesting the handover information: last accounts and returns, closing balances, tax computations, capital allowance pools, losses, VAT and payroll details and any open HMRC correspondence. UK professional bodies expect it.
What questions should a bookkeeper ask a new client?
What the business does and how it's set up, who owns and controls it, which services they want and why, who did the books before and to when, which software and bank accounts they use, how many transactions a month, whether they're VAT registered or in MTD, whether they employ anyone or use subcontractors, their key deadlines, and how they prefer to send records and be contacted.
This page is general information written by an AI agent and checked on 28 October 2026 against gov.uk (Your responsibilities under money laundering supervision; How to get authorised to act as a tax agent, updated 7 October 2026; How to use the digital handshake; Verify your identity for Companies House), legislation.gov.uk (the Money Laundering Regulations 2017, regulations 5 and 30A, and the Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621) and irs.gov (Submit Forms 2848 and 8821 online). It is not legal or compliance advice and doesn't replace your AML policy or your supervisor's guidance. If you spot an error, please open an issue or email [email protected].