Client Onboarding

Client onboarding runs from the first enquiry to the point where the firm can start work. The order matters, because some steps must be finished before others begin. A typical sequence for a law firm or an accounting practice looks like this.

1. Take the enquiry. Record who the prospective client is, what they want done, who will give instructions.
2. Check for conflicts. Confirm that acting for this client does not clash with a duty owed to an existing one.
3. Identify the client. Collect identifying details for the person or company, for anyone acting on their behalf, for the beneficial owners.
4. Verify what was collected. Check the details against an identity document, an electronic identity or a register.
5. Assess the risk. Understand the purpose of the work, screen against sanctions lists, check for political exposure, then set the level of checks.
6. Agree terms. The client signs the engagement letter.
7. Open the file. Store the evidence with the decisions taken, then set a review date.

Steps three to five are customer due diligence, the part that the law prescribes. The rest comes from the firm's own practice and its professional rules. When the two halves run as separate processes, with compliance forms in one place and the engagement letter in another, the client is asked for the same information twice.

The sequence also shows where onboarding can stall. Steps three and four depend on the client sending something back. Each round of missing documents delays the point at which the firm can lawfully begin.

The Anti-Money Laundering Regulation requires customer due diligence whenever an obliged entity establishes a business relationship (Article 19(1)(a)). The regulation applies from 10 July 2027 (Article 90). Until then, the national laws that implement the EU anti-money laundering directives set the checks.

Professional firms are within its reach. Auditors, external accountants and tax advisors are obliged entities for their professional activities. Notaries and lawyers are obliged entities where they take part in financial or real estate transactions for a client. The same holds where they help to plan or carry out certain transactions: buying and selling real property or business entities, managing client money, opening or managing bank accounts, or creating and managing companies and trusts (Article 3(3)(a) and (b)).

Article 20(1) lists what due diligence consists of. The firm must identify the customer and verify their identity. It must identify the beneficial owners and take reasonable measures to verify theirs, so that it understands the ownership and control structure. It must understand the purpose and intended nature of the relationship. It must check whether the customer or the beneficial owners are subject to targeted financial sanctions. It must determine whether any of them is a politically exposed person. It must also verify that anyone claiming to act for the customer is authorised to do so, then verify that person's identity.

The depth of each measure follows the risk. The firm sets the extent of the measures on an individual analysis of the client and the work (Article 20(2)). Higher risk calls for enhanced measures. Lower risk permits simplified ones. Whichever applies, the firm must be able to show its supervisor that the measures were appropriate to the risks it identified (Article 20(4)).

Article 22(1) of the AMLR sets a minimum list, and it is longer than a name with an address. For a natural person, the firm must obtain all names and surnames, the place and full date of birth, nationalities, the national identification number where applicable, and the usual place of residence. For a legal entity, it must obtain the legal form and name, the address of the registered office, the principal place of business if different, the country of creation and the names of the legal representatives. Where available, it also needs the registration number, the tax identification number and the Legal Entity Identifier.

The same details are needed for any person who claims to act on the client's behalf.

Collecting is not verifying. To verify, the firm uses one of two means. The first is an identity document, passport or equivalent. The second is electronic identification at the eIDAS assurance levels substantial or high, with relevant qualified trust services (Article 22(6)). For beneficial owners, the firm must also consult the central register of beneficial ownership (Article 22(7)). When the new client is a legal entity that has to register its beneficial owners, the firm collects valid proof of registration or a recently issued excerpt of the register (Article 23(4)).

More detail is on its way. Article 28(1) gave AMLA, the EU's anti-money laundering authority, until 10 July 2026 to submit draft regulatory technical standards. They specify the information to be collected for standard, simplified and enhanced due diligence. The detailed list a firm follows will come from those standards once the Commission adopts them.

Before the work starts. Verification of the identity of the customer and of the beneficial owner must take place before the business relationship is established or the occasional transaction is carried out (Article 23(1) of the AMLR).

There are two narrow exceptions. Verification may be completed during the establishment of the relationship if that is necessary so as not to interrupt the normal conduct of business and there is little risk of money laundering or terrorist financing. It must then be finished as soon as practicable after initial contact (Article 23(2)). Under simplified due diligence, where the risk is low, verification may follow the start of the relationship by no more than 60 days (Article 33(1)(a)).

If the checks cannot be completed, the firm must not go ahead. It must refrain from carrying out the transaction or establishing the relationship. It must end the relationship if one exists, and consider reporting a suspicious transaction (Article 21(1)).

Legal and tax professionals have a specific carve-out. That rule does not apply to notaries, lawyers, auditors, external accountants and tax advisors to the extent that they ascertain the legal position of their client. Nor does it apply where they defend or represent the client in judicial proceedings, including advice on instituting or avoiding them. The carve-out is lost where the adviser knows that the client is seeking legal advice for the purposes of money laundering (Article 21(2)).

A practical consequence follows. A firm that sends its engagement letter for signature before verification is complete may find it hard to show that verification came first. Placing the identity check directly before signature removes the question.

Yes. The AMLR does not require a meeting. One of the two permitted ways to verify identity is electronic: electronic identification means at assurance level substantial or high, with relevant qualified trust services, under the eIDAS Regulation (Article 22(6)(b)). Recital 66 states that electronic identification under eIDAS should be accepted by obliged entities for customer identification. It adds that, with appropriate risk mitigation, such identification can reduce the risk level to standard or even low.

Distance is still a factor in the risk assessment. Annex I lists the extent to which the relationship is conducted on a non-face-to-face basis among the delivery channel risk variables. What counts is how the firm offsets it. Asking a client to email a photograph of a passport offsets nothing. The firm cannot tell whether the document is genuine or whether the sender is its holder. A remote identity check that tests the document, then compares it with a live image of the person, addresses both.

Remote onboarding also changes where the documents travel. Identity documents, company records and proof of funds sent as email attachments stay in inboxes on both sides. A channel with access control keeps them in one place, where a retention rule can be applied.

For banks and other financial institutions, the European Banking Authority has issued guidelines on remote customer onboarding. They are addressed to the financial sector. Other firms can still read them as a description of what a supervisor expects from a remote process.

Five years from the end of the business relationship (Article 77(3) of the AMLR). The firm must retain a copy of the documents and information obtained in customer due diligence, including information obtained through electronic identification means. The records must not be redacted (Article 77(1)). When the five years expire, the personal data must be deleted, unless another Union or national law sets a longer period. A competent authority may require up to five more years in an individual case.

The record is more than the documents. The firm must keep a record of the actions it took to comply, including the decisions taken with the supporting documents and justifications. The duty also covers cases where the firm refused a client or ended a relationship (Article 21(3)). A supervisor reading the file should be able to see what the firm knew, what it decided and when.

The GDPR applies alongside. The legal obligation is the lawful basis for holding the data (Article 6(1)(c) of the GDPR). The data must be limited to what is necessary, and it must be kept secure (Article 5(1)(c) and (f)). The AMLR adds a limit of its own. Personal data processed on its basis may be used only to prevent money laundering and terrorist financing, and commercial use is prohibited (Article 76(4)). An identity document collected for due diligence cannot feed a marketing database.

Onboarding does not end the duty. Customer information must be kept up to date, at intervals of no more than one year for higher-risk clients and five years for all others (Article 26(2)).