AML client risk assessment template for accountants
Give every client a money laundering risk rating, a reason for it and a date for the next review. This AML client risk assessment template is one Excel register with a row per client, which suggests the rating from your answers and won't finish a row without a reason.
UK practicesGet this pack and 100 more for $129
What the register looks like
When you need it
The Money Laundering Regulations 2017 require you to assess the risk of each client and let that risk decide how much customer due diligence you do. You must be able to show your supervisor that the checks you chose fit the risk.
- Before you start work for a new client
- When you first bring your existing clients into a written risk assessment, starting with those you think carry the most risk
- At each client's review date
- When something changes, such as a new director or owner, a new service or a transaction that doesn't fit what you know
How to use the AML client risk assessment template
- Set your review periods. On the Settings sheet, choose how often you review High, Normal and Low clients. The defaults are 12, 24 and 36 months.
- Add one row per client. Enter the name, client type and date, then answer Yes or No to all 13 questions.
- Read the suggested rating. Any Yes in the first four questions means enhanced due diligence and a High rating. Otherwise no other factors gives Low, one gives Normal and two or more give High.
- Record your reason. Keep the suggestion or choose your own rating, and write why. The Check column stays red until every question is answered and the reason is in.
- Work through the reviews. Sort or filter by Next review. Overdue dates turn red, and the Summary sheet counts them.
Questions
What is a client risk assessment for AML?
It is your record of how likely each client is to involve money laundering or terrorist financing, and why. The rating decides the level of customer due diligence: simplified for low risk, standard for most clients and enhanced for high risk.
What risk factors should a client risk assessment consider?
The regulations require you to consider the purpose of the relationship, the size of the transactions and how regular and long-lasting the relationship is, alongside your firm-wide risk assessment. In practice that means the client's type, ownership, country links, sector, the services you provide and how you took them on.
When is enhanced due diligence required?
When the client is high risk, has links to a country on the FATF call for action list, is a politically exposed person or a family member or close associate of one, has given false or stolen ID, or is involved in a transaction that is unusually complex or unusually large for its nature.
What risk ratings should we use?
The accountancy sector's AML guidance suggests categories such as low, normal and high, and expects most clients to fall within normal. The register uses those three.
How often should client risk assessments be reviewed?
There is no fixed period in the regulations. Review on a risk-based timetable, more often for high-risk clients, and straight away when something changes. You must keep each client's due diligence information up to date.
Do PEPs always need senior management approval?
Yes. For a politically exposed person, or a family member or known close associate, senior management must approve taking on or keeping the client, and you must find out where their wealth and funds come from. UK PEPs start from a lower level of risk than foreign PEPs.
Also in the AML compliance pack
Who it's for
Small accountancy firms that need a risk rating, a reason and a review date on file for every client.
Last checked
Checked against the Money Laundering Regulations as amended on 30 June 2026 and the sector's July 2026 guidance.
