Your AML Requirements Are More Than an ID Check
AML risk assessments don't have to be a chore when they feed onboarding and account management in your firm. The questions that keep you compliant are the same ones that help you price accurately, spot growth opportunities, and build your practice around your best clients.
Done right, your risk assessment is the best account management tool you have.
But to get there, AML compliance needs to move beyond a chore. Too often we run an ID check at onboarding, tick a box, file it away, and forget about it until the next review.
The numbers tell us how well that approach is working... Only 19.4% of firms were fully compliant in the ICAEW AML Supervision Report 2024/25. A further 60.6% were “generally compliant” - meaning they had some gaps but weren't failing outright. And one in five firms were non-compliant.
Financial penalties totalled nearly £200K, and 11.6% of all firms reviewed aren't performing or updating their Customer Due Diligence throughout the client relationship.
The most common root cause? Over-reliance on long-standing client relationships. Firms assuming that because they've known a client for years, they don't need to keep asking questions.
The questions you need for AML are the same questions you need to run a great practice
Think about what a proper client-level risk assessment requires you to understand:
What sector are they in? AML needs this for sector risk. Commercially, it tells you about specialist requirements, CIS obligations, charity SORP, and pricing.
Where are their customers and suppliers? AML needs this for geographic risk. Commercially, it tells you about multi-currency complexity, VAT treatment, and scope.
How did they find you? AML needs this for delivery channel risk. Commercially, it's your marketing attribution.
What's their turnover relative to their team size and business model? AML needs to know whether the business profile makes sense. Commercially, it's the foundation of your pricing.
You're already asking these questions. Or at least, you should be. Next, it’s about connecting the dots between your commercial and AML data
Have one conversation, not two
Too many firms run two separate processes when a new client comes through the door. There's the commercial conversation (what do you need, what service level fits, what's this going to cost) and then there's the compliance exercise. Usually, a separate form, a separate system, asking nearly identical questions in a different order.
It's inefficient, and it frustrates the client. Possibly worse, the compliance side often gets treated as an afterthought - something to rush through at the end rather than weave into the discovery conversation as you determine if this client is the right fit for you.
When you design your client onboarding as a single, structured discovery conversation, three things can happen:
You price more accurately because you genuinely understand the business: its model, complexity, sector, and trajectory.
You recommend the right service level because you know their ambition, their current phase, and what would make the biggest difference to them right now.
You complete your AML obligations because the risk intelligence came naturally from asking smart commercial questions, not from bolting on a separate compliance section.
Your risk assessment tells you who your best clients are
Mike Michalowicz wrote about something he calls the Pumpkin Plan. The idea is simple and easy to apply in business: colossal pumpkin farmers don't spread seeds everywhere and hope for the best. They identify their strongest sprouts and pour all their attention into those. Then they prune everything else.
The business equivalent? Focus on your best clients. Understand what makes them ideal. Then find more like them.
Your AML risk assessment already does half this work for you.
Low-risk
Low-risk clients in sectors you understand deeply, who found you through trusted referrals, with straightforward UK structures and a clear commercial rationale? Those are probably your best clients. These are the ones who are easiest to serve, most profitable to work with, and simplest to keep compliant. Identify them and clone them.
High-risk
High-risk clients in unfamiliar sectors, with complex international structures, who appeared through unknown channels? They might be perfectly legitimate. But they require disproportionate resource to serve compliantly: enhanced due diligence, more frequent reviews, more documentation, and more time.
That's no reason to turn them away, but it is a reason to be deliberate about taking them on.
This is where the practice-wide risk assessment becomes powerful. When you map your risk ratings against your service levels, you start to see patterns. Which businesses have grown in complexity since you last reviewed their scope? Where are you undercharging because the risk profile has shifted but the pricing hasn't?
Existing clients
The biggest opportunity is usually serving your existing clients better rather than finding new ones.
Your risk assessment gives you the intelligence to spot those opportunities. A client who's started trading internationally needs more from you, not less. A business that's taken on investment has new reporting requirements. Each of those changes is a commercial opportunity to deepen the relationship and deliver more value.
Finding your ideal client
When you understand the cost of compliance at a client level, not just a practice level, you can make informed decisions about where to invest your energy. Your risk assessment does more than protect you from regulatory action. It shows you the shape of your ideal client base and where your biggest growth opportunities already sit.
Productise the process
The best firms I see treat their client assessment like a product, not an admin task.
A structured discovery process with a consistent set of questions that feeds multiple outputs simultaneously:
Pricing: What does this client need from us? How complex is their business? What's the transaction volume?
Service level: Are they looking for compliance foundations, financial clarity, or strategic partnership?
AML risk rating: Low, medium, or high? Across all four dimensions for client, geographic, service, and delivery channel.
Account management priorities: What does growth look like for them? What's changed since last time? What would make the biggest difference right now?
This is the accounting equivalent of what Greg Hickman calls the Chipotle model. It operates with a fixed structure and consistent process, but it feels personal to every client because the questions are genuinely about their business: just real conversations with a clear framework behind them.
The part most firms struggle with is taking on every client that comes knocking. You don't have to do everything for everyone. A productised process gives you the clarity to say no. If a prospect doesn't fit your core service model, if the complexity sits outside your expertise, if the risk profile would pull your team away from your best clients, you can walk away with confidence. Because you know exactly what your process is designed to deliver and who it's designed for.
That same clarity lets you invest properly in the processes and communication that matter. When you're not trying to be everything to everyone, you can build brilliant onboarding. You can invest in how you communicate with clients: the templates, the check-in cadence, the reporting format. You can make your service feel exceptional because it's focused.
When your process is this structured, compliance gets baked in. Every client goes through the same discovery. Every client gets a risk rating. Every client's information feeds both your commercial decisions and your regulatory obligations.
It doesn't stop at onboarding
The Money Laundering Regulations don't just require due diligence at the start of a relationship. They require ongoing monitoring. And the ICAEW's report makes it clear that this is where many firms fall short.
But again, this maps perfectly onto what you should already be doing as good account management.
Your periodic client review, whether that's annual, every couple of years, or triggered by a material change, should already cover questions like:
Has the business model changed or expanded?
Have they started trading internationally?
Has turnover shifted significantly?
Have they taken on new investment or changed their ownership structure?
Is the scope of work still right? Are we undercharging or over-delivering?
Every one of those questions serves a dual purpose. Commercially, they help you keep the engagement properly scoped and priced. From an AML perspective, they keep your risk rating current.
Most good accountants already know this: when something changes, you probably already knew about it. You're in their Xero every month. You've seen the new supplier in a different currency. You've noticed turnover climbing faster than headcount would explain. You've spotted the unusual transaction pattern.
The data is already telling you. Your ongoing monitoring is half-done before you even pick up the phone.
And if a change catches you by surprise? That's the perfect prompt to pick up the phone or visit your client. “I noticed something's changed - let's catch up.” That's great account management, and your client will thank you for it.
What this looks like in practice
At a practice level, this is what changes when you stop treating AML as a bolt-on:
Your firm-wide risk assessment becomes a strategic tool. It shows you which sectors you serve, where the complexity sits, and where your practice is most (and least) efficient. That's the core of business intelligence.
Your client-level assessments inform your pricing. A client in a high-risk sector with international operations and complex structures carries more regulatory risk and costs more to serve. Your pricing should reflect that.
Your onboarding feels like a relationship, not an interrogation. Clients don't know (or care) that you're satisfying regulatory obligations. They just know you asked smart questions about their business and came back with a thoughtful recommendation.
Your ongoing reviews become genuine account management conversations. Instead of a form to fill in, you have a conversation about where the business is heading, what's changed, and whether your service is still the right fit. The AML update happens naturally, because the right questions are already being asked. That's how you want it.
The bottom line
Stop treating AML as a box to tick.
Start treating it as the foundation for knowing your clients well enough to serve them brilliantly, price them fairly, and grow your practice with the right people.
Your regulator wants you to know your client. So does your P&L.
How integrated is your AML process with your client onboarding and account management? I'd love to know what's working for you.
Sources
ICAEW AML Supervision Report 2024/25
Mike Michalowicz Pumpkin Plan
Xama Building a Policy and Procedures Framework
Greg Hickman and the Chipotle model
Xama Ongoing Monitoring solutions