Your client risk assessment should get longer every year, not shorter

A local accountant had the town's taxi driver on his books. Nice enough bloke, been driving the same patch for years. The client risk assessment said what you'd expect: taxi driver, local fares, a bit cash-based, nothing alarming.

Twelve months later that taxi driver won the contract to drive a PEP and assorted senior politicians around Edinburgh.

His accountant had no idea. The risk assessment still said local fares.

Kevin Lord, Firmcheck CRO, told that story in our September webinar, and his closing point is the one worth holding on to. The taxi driver is still perfectly entitled to be a client. Nothing has gone wrong. What's gone wrong is that the documentation stopped keeping up.

Most firms have this backwards

An attendee asked David Winch, a respected and experienced name in the AML world, whether client risk assessments should be redone annually.

Before the answer, David laid out something more useful: the four tiers that risk assessment actually operates on, which most people have never seen drawn out.

At the top, HM Treasury assesses the money laundering, terrorist financing and proliferation financing risk to the UK economy as a whole.

Below that, HMRC and the professional bodies assess how those risks affect the accountancy and tax adviser sector.

Below that, your firm-wide risk assessment covers how they affect your firm.

Below that, your client risk assessment covers one client.

The point of drawing it this way is what it reveals about the bottom two. The firm-wide and client assessments address the same questions at a different scale. Your client assessments feed upwards into the firm-wide risk assessment, and the firm-wide risk assessment is essentially their aggregation. What you then do about AML reflects those risks, and that feeds your policies, controls, and procedures document.

They're seen as separate items on a checklist. They aren't separate. They're one thing viewed at four distances.

Which brings us to the counterintuitive bit

Here's the observation that should change how you work. A client risk assessment ought to be fairly thin when you take someone on, and fairly chunky after five or six years.

Think about why. On day one you know what they've told you and what you can look up. After six years you know how they behave. You know the business went quiet in 2023 and picked up again. You know the director's brother joined the board. You know they've started invoicing a customer in a jurisdiction they'd never mentioned.

That's exactly the information a risk assessment is supposed to capture. And it only exists because time has passed.

Most firms do the reverse. The assessment is written at onboarding, when you know least, and then never revisited. Six years of accumulated knowledge sits in the relationship and never reaches the file. The taxi driver's accountant knew the man. The file didn't.

On cadence

David's answer on annual review was more nuanced than the question expected.

Annual works for accountants because accountants live an annual life. Annual accounts, annual tax returns, corporation tax, self-assessment. The rhythm already exists, so hanging an AML review on it is convenient.

But he was careful to frame it as convenience rather than a rule. A family solicitor, whose clients appear when they're buying a house and vanish for six years, doesn't have that cycle, and forcing one would be artificial.

The part that does bind: if you decide to review a particular client every two or three years rather than annually, you need to document why less frequent review is acceptable for that client. The decision is defensible. The undocumented decision isn't.

What this looks like in practice

If your client risk assessments are the same length today as the day you wrote them, that's the signal. Not that you've done something wrong, but that six years of knowing your client hasn't made it into the file where a supervisor would look for it.

The fix isn't a bigger template. It's treating the annual review as a moment to write down what changed, rather than confirming that nothing did.

What to do this week

Take your longest-standing client. Open their risk assessment and read it as if you'd never met them.

Then ask what you know about that client today that isn't in the document. Not risks, necessarily. Just facts. New premises, a new line of business, a director who left, a contract that changed the shape of their income.

If there's a meaningful gap between the client in your head and the client on the page, you've found the thing supervisors are actually looking for. And unlike most AML findings, this one's straightforward to fix: write it down.

This came from our September webinar on AML for payroll, with Kevin Lord and David Winch of MLRO Support. We run a monthly AML Ask Me Anything where the questions come from firms like yours. Email support@firmcheck.com to secure your place for the next one, or submit a question in advance.