Anti-money laundering compliance is non-negotiable for UK law firms. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended, impose detailed obligations on regulated firms to verify the identity of clients, understand the nature of their business, and assess the risk posed by the client relationship. Failure to comply carries severe consequences — fines, prosecution, and regulatory sanction.

But there is a real tension between rigorous CDD and good client experience. A client who is asked to produce multiple forms of identification, explain the source of their funds in detail, provide corporate structure charts, and wait while their documents are processed can feel treated as a suspect rather than a valued customer. The friction of a heavy-handed AML process causes client drop-off, delays matters, and damages first impressions.

The good firms have solved this tension. They maintain full compliance while delivering a smooth, professional onboarding experience. This guide explains how.

Understanding the Regulatory Requirements

The Basic CDD Requirements

Under the Money Laundering Regulations 2017, law firms must apply customer due diligence in specified circumstances, including when establishing a business relationship and for occasional transactions above the relevant threshold. Standard CDD requires:

Identity verification — establishing who the client is (name, date of birth, address for individuals; name, registration number, registered office for companies)
Verification of identity — confirming that the client is who they claim to be, using reliable, independent source documents
Beneficial ownership — for corporate clients, identifying any individual who owns or controls more than 25% of the shares or voting rights
Understanding the purpose and intended nature of the business relationship

The regulations do not prescribe the specific documents you must obtain. They require that you use reliable, independent source documents, data, or information. This gives firms flexibility in how they verify identity — which is the key to a better client experience.

Enhanced Due Diligence

For higher-risk clients and situations, enhanced due diligence is required. The regulations identify a range of high-risk factors including politically exposed persons (PEPs), high-risk third countries, complex or unusual transactions, and situations where there is no face-to-face contact.

EDD requires additional measures proportionate to the risk — additional document verification, information about the source of funds, senior management approval, and enhanced ongoing monitoring. The challenge with EDD is that it is inherently more intrusive, and communicating the reason for the additional checks to the client in a way that does not cause offence requires care.

Ongoing Monitoring

CDD is not a one-time exercise at the start of the retainer. The regulations require ongoing monitoring of the business relationship, including scrutiny of transactions and keeping CDD information up to date. In practice, this means refreshing client information periodically and being alert to changes in the client’s circumstances that affect the risk assessment.

The Client Experience of CDD: Where the Problems Arise

Most CDD friction arises from three sources: poor communication, inefficient process, and disproportionate requests.

Poor Communication

Clients who do not understand why they are being asked for identity documents find the request intrusive and unexpected. A client asked to produce a passport and a utility bill at the start of a property purchase, with no explanation, may wonder whether the firm suspects them of something.

The fix is simple: explain the requirement clearly in the client care letter and in any onboarding communication. “Anti-money laundering regulations require us to verify the identity of all clients before we begin work. We will ask you to provide [specific documents]. This is a standard regulatory requirement and applies to every new client, regardless of the nature of the matter.”

This short explanation transforms the dynamic. The client understands that this is a regulatory requirement, not a judgement about them personally, and is more likely to comply promptly.

Inefficient Process

CDD processes that require clients to post certified copies, attend the office in person, or wait for manual review introduce unnecessary delays and create friction at exactly the moment the client is most engaged — the start of the matter.

The UK legal sector now has access to a range of electronic identity verification services that are both faster and more secure than traditional document review. Services such as Thirdfort, SmartSearch, Credas, and Amiqus enable clients to verify their identity using a smartphone — typically in under ten minutes — while providing firms with a fully compliant verification record.

The SRA has confirmed that electronic verification satisfies the requirements of the Money Laundering Regulations where the verification service uses reliable, independent data. HMRC guidance on AML compliance is consistent with the same principle. Firms that have not yet adopted electronic verification are offering a significantly worse client experience than those that have, for no compliance benefit.

Disproportionate Requests

Risk-based CDD means that the level of due diligence should be proportionate to the risk. For a standard residential conveyancing instruction from an existing client whose identity has previously been verified, minimal additional CDD may be required. For a high-value corporate transaction with an offshore ownership structure, substantially more will be needed.

Many firms apply the same extensive CDD to every client regardless of risk profile, which is both disproportionate and off-putting to low-risk clients. A well-designed risk-based approach segments clients appropriately and applies the right level of scrutiny to each segment.

Designing a CDD Process That Works for Clients

Integrate CDD Into the Onboarding Journey

Rather than treating CDD as a separate, slightly awkward exercise, build it into the normal onboarding flow. When you send the onboarding communication confirming your instructions, include:

A brief explanation of AML requirements
A request for the specific information or documents needed
A link to your electronic ID verification service (if you use one)
A clear indication of what happens next once the verification is complete

This positions CDD as part of your normal, professional onboarding process rather than an afterthought. Clients who are given a clear, digital way to complete verification do so quickly.

Use Technology for Verification

Electronic ID verification services have reached a level of reliability and acceptance that makes them the right choice for most individual client verifications. The user experience is straightforward: the client takes a photo of their ID document, takes a selfie for biometric matching, and the service verifies their identity against multiple data sources within minutes.

For the firm, this generates a compliance record that is more reliable than a file note recording that a passport was examined, more securely stored, and easier to retrieve. For the client, it takes minutes rather than days and does not require posting irreplaceable documents.

For corporate clients, electronic company verification services (including those that pull directly from Companies House and international equivalents) reduce the manual burden of beneficial ownership verification significantly.

Train Fee Earners to Discuss CDD Naturally

Fee earners who are uncomfortable discussing AML requirements with clients often handle it awkwardly — either avoiding the topic until the last possible moment or raising it in a stilted, apologetic way that makes clients more suspicious, not less.

Short training on how to explain AML requirements clearly and confidently makes a significant difference. A fee earner who can say “Before we get started, I just need to run through the standard identity checks we complete for every new client — this should only take a few minutes” sets exactly the right tone.

Dealing With Higher-Risk Situations

For clients who trigger enhanced due diligence requirements — PEPs, high-risk country connections, complex structures — the approach requires more care. The request for additional information should:

Be made by a senior person (partner or senior solicitor, not a trainee or admin)
Be explained with reference to the regulatory requirement (“our AML regulations require us to obtain additional information in this type of matter”)
Be specific about what is needed and why
Be delivered respectfully — not apologetically, not aggressively

Where a client refuses to provide information necessary for enhanced due diligence, the firm cannot proceed. This should be communicated clearly and non-judgementally: “We are required by law to complete these checks before we can begin work. If you are unable to provide this information at this stage, we would not be able to act for you in this matter.”

Source of Funds

Source of funds verification is one of the most sensitive areas of CDD. Asking a client to explain where their money came from can feel deeply intrusive, particularly for individuals making large purchases.

The key is framing. “Could you help us understand the origin of the funds for this purchase? For example, are these savings, a remortgage of another property, or proceeds of a recent sale?” is a less confrontational question than “We need documentation of the source of your funds.”

Where clients are selling a property and buying another, the source of funds is self-evident from the transaction. Where they are using savings, a brief explanation and perhaps a bank statement is usually sufficient. Reserve detailed source of funds investigation for situations where the risk assessment genuinely warrants it.

Documentation and Record-Keeping

The Money Laundering Regulations require firms to keep CDD records for at least five years from the end of the business relationship. Records must be sufficient to evidence the due diligence carried out.

Good CDD documentation should record:

What checks were carried out and when
What documents or information were obtained
The risk rating assigned to the client
The basis for the risk rating

Electronic verification services typically generate an audit trail automatically. For manual verification, the standard approach is a file note recording the documents examined, the date, and the fee earner who conducted the check.

Obiter helps streamline CDD by integrating with the onboarding workflow — prompting for client verification at the start of each new matter, flagging incomplete checks before work begins, and keeping AML records alongside the matter file so compliance is built into the process rather than bolted on as an afterthought.

Conducting Client Due Diligence Without Alienating Clients