How to develop a client onboarding and due diligence process

To protect your business from financial crime and meet UK legal requirements, you must establish a formal process to verify the identity of your clients before you start working with them. This process, known as Customer Due Diligence (CDD), involves collecting specific documents to prove who your clients are and ensuring their source of funds is legitimate. Failing to do this can result in heavy fines or even criminal prosecution under the Money Laundering Regulations.

Why a formal onboarding process is essential

In the UK, many industries—particularly property, legal, and financial services—are legally required to prevent money laundering. Beyond compliance, a clear onboarding process sets a professional tone, manages client expectations, and protects your reputation. It ensures you aren't accidentally helping to hide the proceeds of crime or dealing with individuals on international "sanction" lists.

Steps to create your onboarding and due diligence process

1. Initial Information Gathering: Start by asking the client for their basic details. For an individual, this is their full name and residential address. For a company, you need their registered name, company number, and the address of their principal place of business.
2. Risk Assessment: Before doing a deep dive, assess the risk level of the client. Are they based in a high-risk country? Is their transaction unusually large or complex? Most "everyday" UK-based clients will be "Standard Risk," but you must have a system to flag "High Risk" clients who require "Enhanced Due Diligence."
3. Verify Identity (KYC): "Know Your Customer" (KYC) is the core of due diligence. You must see original documents or "certified copies."
   • Proof of Identity: A valid passport, photocard driving licence, or national identity card.
   • Proof of Address: A utility bill, bank statement, or council tax bill (usually dated within the last three months).
4. Identify Beneficial Owners: If your client is a company, you must identify the "Ultimate Beneficial Owners" (UBOs). These are the people who own or control more than 25% of the shares or voting rights. You must verify their identities just as you would an individual client.
5. Check Sanction Lists: Ensure your client is not on a government financial sanctions list. There are free search tools provided by the UK government to check this.

What documents should you collect?

Depending on the type of client, your requirements will vary. Use this table as a quick reference for your process manual:

Client Type	Standard Verification Required
Individual	One government photo ID and one proof of residential address.
UK Limited Company	Certificate of Incorporation, list of directors, and ID for all UBOs (owners of 25%+).
Trusts	Trust deed, plus ID for the settlor, trustees, and beneficiaries.

Recording and storing information

The law requires you to keep copies of the evidence you obtained for five years after your relationship with the client ends. This is crucial for proving to regulators that you did your homework. Ensure this data is stored securely and in line with UK GDPR rules, as you are handling sensitive personal information.

Pro Tip: Don't do this manually if you can avoid it. There are many UK-based digital ID verification apps that allow clients to upload photos of their ID and a "selfie" from their smartphone. These systems often run automatic checks against global databases, saving you hours of paperwork and reducing the risk of human error.

Ongoing Monitoring

Due diligence isn't just a one-off task at the start. If you work with a client for several years, you should periodically refresh their information. If a client's behaviour suddenly changes—for example, they start making payments from a different country or their business structure changes—you must re-verify their details to ensure everything is still above board.