Engagement Letter

An engagement letter records who the client is, what the firm will do, what it will not do, and what the work will cost. Imagine an accounting practice that takes on a family-owned company to prepare its annual accounts. Six months later one of the owners asks why nobody looked at her personal tax return. The letter is where the answer should be found.

The first point is the identity of the client: the company, its owners, or both. The scope follows, with its exclusions stated as plainly as the work itself. Then come the fees and how they are billed, the people who will do the work, and what the client must provide. The remaining terms deal with limits on the firm's liability, confidentiality, the handling of personal data, conflicts of interest, complaints and the way either side can end the engagement. Many firms put these standing terms in a separate document attached to each letter.

No single EU rule requires one. Whether a firm must put its terms in writing depends on the professional conduct rules that apply to it, and those differ by country and by profession. Lawyers, auditors, accountants and tax advisers each answer to their own regulator or professional body. The rules to look for concern written information on fees, on the scope of the mandate and on how to complain.

Even where nothing requires a letter, most firms use one, because it is the best evidence of what was agreed. Whether a letter that the client never signed still binds the client is a matter for the governing law.

Before the relationship that the letter records begins. Article 19(1)(a) of the EU Anti-Money Laundering Regulation requires customer due diligence when a business relationship is established. Article 23(1) adds that the identity of the customer and its beneficial owners must be verified before that point.

The signature date on the letter does not decide when the relationship starts. The definition in Article 2(1)(19) covers a professional relationship with an element of repetition or duration, including where there is no written contract. A firm that starts advising before the letter is signed may already be in a business relationship.

There is limited room to finish verification later. Article 23(2) allows it to be completed while the relationship is being established, if that is necessary to avoid interrupting normal business and the risk is low. It must then be done as soon as practicable. If due diligence cannot be completed at all, Article 21 requires the firm not to establish the relationship. The same article contains an exception for legal professionals, auditors, external accountants and tax advisers who are ascertaining a client's legal position or representing the client in proceedings.

These duties bind auditors, external accountants and tax advisers generally, and lawyers and notaries for the transactions listed in Article 3(3). The regulation applies from 10 July 2027. Until then, the national laws that implement the EU anti-money laundering directives apply. One safeguard is to state in the letter that the engagement takes effect when the checks are complete.

The client, the client's beneficial owners and anyone acting on the client's behalf. Article 20(1) lists the measures. The firm identifies the client and verifies its identity. Where the client is a company, the firm identifies the natural persons who own 25% or more of it or who control it by other means (Articles 51 and 52). It also verifies that the person who signs for the client is authorised to do so, and verifies that person's identity.

The same article requires the firm to understand the purpose and intended nature of the relationship, to check the client and its owners against sanctions lists, and to establish whether any of them is a politically exposed person. The scope section of the engagement letter is a natural record of the first of these.

Yes, in principle. Article 25 of the eIDAS Regulation says that an electronic signature cannot be denied legal effect or refused as evidence solely because it is electronic. It also gives a qualified electronic signature the equivalent legal effect of a handwritten one. Article 2(3) leaves national requirements on form untouched, so a firm should check whether its own professional rules ask for a particular form.

The choice of level matters most for one reason. A firm must apply due diligence measures when it doubts whether the person it is dealing with is the client or someone authorised to act for the client (Article 19(1)(f)). A simple signature, such as a typed name or a click, gives little help with that doubt. A qualified signature is based on a certificate issued after the provider has verified the signer's identity (Article 24(1)). It shows who signed. It does not replace the firm's own due diligence, which covers more than the signer.

For the engagement letter itself, the period comes from national law and professional rules. For the due diligence file behind it, EU law sets the period. Under Article 77, an obliged entity keeps a copy of the documents and information obtained in customer due diligence for five years from the end of the business relationship. A competent authority may require up to five more years in an individual case. After that the personal data must be deleted, unless another law requires it to be kept.

This makes the end of the engagement a date worth recording. A firm that never closes a matter cannot say when the five years began. For the same reason, the storage limitation principle in Article 5(1)(e) of the GDPR is easier to meet when each client file carries a closing date.