AML client due diligence sheet for accountants and tax advisers: beneficial owners at 25%, update dates and retention under the EU AML Regulation from 10 July 2027 (Regulation (EU) 2024/1624)
What you get: a finished client due diligence sheet for accounting, bookkeeping and tax firms, in three tabs: a clients tab with one row per client that lists the gaps in each file against the EU Anti-Money Laundering Regulation and gives the next date the client information must be updated; an ownership tab that works out who the beneficial owners of a client company are using the 25% test; and a retention tab that gives the date each closed file must be deleted. A trigger checklist and a letter you can send to small business clients asking for their documents follow. Made-up example rows show how it fills in.
Short answer: Regulation (EU) 2024/1624, the EU AML Regulation, applies from 10 July 2027 directly in every Member State (Article 90). Auditors, external accountants and tax advisers are "obliged entities" (Article 3(3)(a)). Before taking on a client they must identify and verify the client and its beneficial owners (people with 25% or more, or control by other means, Articles 51 to 53), understand the purpose of the work, check targeted financial sanctions and whether anyone is a politically exposed person (Article 20(1)). Client information must be updated at least every 5 years, or every year for higher-risk clients (Article 26(2)), and records are kept for 5 years after the relationship ends, then deleted (Article 77(3)). Until 10 July 2027, your national AML law applies.
Why firms and their small business clients should look at this now
- Fixed lists replace national variations. The Regulation sets out the minimum identity details for people and companies (Article 22(1)) and for beneficial owners (Article 22(2), pointing to Article 62(1)(a)). Files built under today's national rules may miss items such as place of birth, all nationalities or the beneficial owner's identity document number.
- Every file needs an update date. The time between updates depends on risk but may never exceed 1 year for higher-risk clients and 5 years for all others (Article 26(2)). Changes in a client's circumstances also trigger a review (Article 26(3)).
- No beneficial owner found is not the end of the file. If no natural person can be identified after all possible means, the firm records that and identifies and verifies all senior managing officials (Article 22(2)).
- If you cannot finish due diligence, you cannot take the work. The firm must refrain from the business relationship, end an existing one and consider a suspicious transaction report (Article 21(1)), with a limited exception for ascertaining a client's legal position or court work (Article 21(2)).
- AI tools in client onboarding have conditions. Decisions from automated processes or AI systems are allowed only if they use due diligence data, a person meaningfully reviews any decision to accept, refuse or change the level of checks, and the client can get an explanation and challenge it (Article 76(5)).
Step 1: tab 1, clients (one row per client)
| Column | What to write | Source |
|---|---|---|
| A | Client name | Your client list |
| B | Type: type exactly Person or Company | Article 22(1)(a) and (b) |
| C | Risk: type exactly Standard or Higher (your own risk assessment) | Articles 10, 20(2) and 34 |
| D | Date identity verified (ID document or eID at "substantial" or "high" level) | Article 22(6) |
| E | Beneficial owners identified: Y, N, NONE FOUND, or N/A for a person | Articles 20(1)(b) and 22(2) |
| F | Beneficial owners checked against the central register: Y or N | Article 22(7) |
| G | Date of last sanctions check | Articles 20(1)(d) and 26(4) |
| H | Politically exposed person check result: Yes or No (empty if not checked) | Article 20(1)(g) |
| I | Purpose and nature of the work recorded: Y or N | Article 20(1)(c) and (e) |
| J | Date client information was last updated | Article 26(2) |
| K | Next update due: =IF(J2="","NOW",EDATE(J2,IF(C2="Higher",12,60))) | Article 26(2)(a) and (b) |
| L | Gaps: =TEXTJOIN(", ",TRUE,IF(D2="","verify ID (Art 22(6))",""),IF(E2="N","identify beneficial owners (Art 20(1)(b))",""),IF(E2="NONE FOUND","record this and verify senior managers (Art 22(2))",""),IF(AND(B2="Company",F2<>"Y"),"check central register (Art 22(7))",""),IF(G2="","sanctions check (Art 20(1)(d))",""),IF(H2="","PEP check (Art 20(1)(g))",""),IF(I2<>"Y","record purpose and nature (Art 20(1)(c))","")) | Formula |
| M | Status: =IF(L2<>"","FIX GAPS",IF(K2="NOW","UPDATE NOW",IF(K2<=TODAY(),"UPDATE NOW","OK UNTIL "&TEXT(K2,"dd/mm/yyyy")))) | Formula (our working rule) |
Example data (made up, to show how the sheet fills in; status as at 28 Oct 2026):
| A | B | C | D | E | F | G | H | I | J | K | L | M |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Client 1 | Company | Standard | 12/03/2024 | Y | Y | 12/03/2024 | No | Y | 12/03/2024 | 12/03/2029 | OK UNTIL 12/03/2029 | |
| Client 2 | Person | Higher | 05/09/2025 | N/A | 05/09/2025 | No | Y | 05/09/2025 | 05/09/2026 | UPDATE NOW | ||
| Client 3 | Company | Standard | 20/01/2026 | NONE FOUND | Y | No | N | 20/01/2026 | 20/01/2031 | record this and verify senior managers (Art 22(2)), sanctions check (Art 20(1)(d)), record purpose and nature (Art 20(1)(c)) | FIX GAPS | |
| Client 4 | Company | Higher | 02/06/2026 | Y | Y | 02/06/2026 | Yes | Y | 02/06/2026 | 02/06/2027 | OK UNTIL 02/06/2027 |
Client 4 has a politically exposed person, so enhanced measures apply as well (Articles 34 and 42 onwards); the sheet only tracks dates and gaps, it does not decide the risk level. Choose "Higher" in column C whenever your risk assessment or Annex III factors point to higher risk.
Step 2: tab 2, ownership (one row per person behind a client company)
Ownership interest means 25% or more of shares, voting rights or other ownership interest, directly or indirectly. Indirect ownership is worked out by multiplying the percentages along each chain of companies and adding the chains together (Article 52(1)). Control by other means is checked separately, whatever the percentage (Article 51 and Article 53(3): majority of voting rights, right to appoint or remove most of the board, veto rights, decisions on profit distribution).
| Column | What to write |
|---|---|
| A | Client company |
| B | Natural person |
| C | Direct share in the client (e.g. 20%) |
| D | Person's share in an intermediate company |
| E | That intermediate company's share in the client |
| F | Total: =C2+D2*E2 (add one D×E pair per extra chain) |
| G | Control by other means (Article 53(3)): Y or N |
| H | Result: =IF(F2>=0.25,"BENEFICIAL OWNER (ownership)",IF(G2="Y","BENEFICIAL OWNER (control)","NOT BY OWNERSHIP: CHECK CONTROL")) |
Example data (made up): Client 5 is owned 20% by Person A, 20% by Holding H and 60% by Person C. Holding H is owned 50% by Person A and 50% by Person B.
| A | B | C | D | E | F | G | H |
|---|---|---|---|---|---|---|---|
| Client 5 | Person A | 20% | 50% | 20% | 30% | N | BENEFICIAL OWNER (ownership) |
| Client 5 | Person B | 0% | 50% | 20% | 10% | N | NOT BY OWNERSHIP: CHECK CONTROL |
| Client 5 | Person C | 60% | 0% | 0% | 60% | Y | BENEFICIAL OWNER (ownership) |
Person C also controls the client through ownership, because holding 50% plus one share counts as control (Article 53(2)(c)). The Commission may later set a lower threshold of up to 15% for higher-risk types of company (Article 52(2)), so keep the 0.25 in column H in one cell you can change.
Step 3: tab 3, retention
| Column | What to write |
|---|---|
| A | Client |
| B | Date the relationship ended, the one-off job was done, or you refused the client |
| C | Delete by: =IF(B2="","OPEN",EDATE(B2,60)) |
| D | Extended by authority? Y/N (up to 5 more years, case by case) |
Keep a copy of the due diligence documents, any assessment of unusual activity and the transaction records, unredacted, for 5 years from that date, then delete the personal data unless another law requires longer (Article 77(1) and (3)).
Checklist: when due diligence must be done (Article 19(1))
- ☐ Taking on a new client (a business relationship)
- ☐ A one-off transaction of EUR 10 000 or more, in one go or in linked parts
- ☐ Helping to set up a company or other legal entity, or (for accountants and tax advisers) helping to transfer ownership of one, whatever the amount
- ☐ Any suspicion of money laundering or terrorist financing, whatever the amount
- ☐ Doubts about whether earlier identity data is true or enough
- ☐ Doubts about whether the person you deal with is really the client or authorised to act for it
Letter to small business clients (template)
Subject: Updating your client file before 10 July 2027
Hello [name],
From 10 July 2027 a new EU regulation sets out exactly which details accounting and tax firms must hold about each client and the people who own or control it. To keep working for you without interruption, please send us by [date]: (1) a copy of a valid ID document or passport for each director, or a confirmation through your national eID; (2) the name, date and place of birth, home address, nationality and ID document number of every person who owns 25% or more of the company, directly or through another company, or who controls it in another way; (3) a simple chart of the ownership if another company sits between you and those people; and (4) a short note of what your business does. We check this against the beneficial ownership register, so if anything there is out of date, please tell us. We will update your file at least every [5 years / year] and keep it for 5 years after we stop working together.
Thank you,
[your name]
Related free sheets: GDPR Article 22 automated decisions sheet · data retention schedule · Article 30 records of processing · DAC7 seller income reconciliation.
AI tools in client onboarding
If your firm uses an AI tool to read ID documents, screen names against sanctions or PEP lists, or score client risk, write down who reviews each accept, refuse or risk-level decision and how a client can ask for an explanation (Article 76(5)), and list the tool in the EURO AI Register free edition. It runs in your browser with no account and no upload, covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Attach this sheet as the evidence record for the onboarding step.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
National law and open points
The Regulation is directly applicable, but supervision, penalties, any lower national cash limit (Article 80(2)) and, where a Member State allows it, reporting suspicions through a self-regulatory body (Article 70(1)) are national. The EU Anti-Money Laundering Authority (AMLA) issues guidelines on risk factors and ongoing monitoring (Articles 20(3) and 26(5)). EUR-Lex also lists a pending court action (case T-451/24) asking for partial annulment of parts of Articles 19, 20 and 21. Check your national rules and your professional body's guidance. This page covers the EU text as we read it today.
Frequently asked questions
When does the EU AML Regulation apply to accountants and tax advisers?
From 10 July 2027 (Article 90 of Regulation (EU) 2024/1624). Auditors, external accountants and tax advisers are obliged entities under Article 3(3)(a).
Who is a beneficial owner of a client company?
Any natural person who owns, directly or indirectly, 25% or more of the shares, voting rights or other ownership interest, or who controls the company by other means, such as the right to appoint or remove most of the board (Articles 51 to 53).
How often must client information be updated?
Based on risk, but at least every year for higher-risk clients and at least every 5 years for all others, and also when the client's circumstances change (Article 26(2) and (3)).
Not legal advice. The sheet helps a firm see gaps and dates in its client files; it does not decide a client's risk level or whether to report a suspicion. When in doubt, ask your supervisor or professional body. Spotted an error? Write to mininglife7@gmail.com and we correct it.
Sources
- Regulation (EU) 2024/1624 of the European Parliament and of the Council of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (OJ L, 19.6.2024): Articles 3, 10, 19, 20, 21, 22, 23, 26, 34, 51, 52, 53, 62, 69, 70, 76, 77, 80, 90 — eur-lex.europa.eu, CELEX 32024R1624 (read 28 Oct 2026)
- EUR-Lex document information page for 32024R1624: corrigenda (ES, FI, SV, LV, HU, CS only) and pending case T-451/24 (read 28 Oct 2026)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.