Client Due Diligence: What UK Law Firms Need to Know

Client due diligence (CDD) is the process by which law firms verify who their clients are and understand the nature of their business. It sits at the heart of anti-money laundering compliance and is, for most solicitors, the AML obligation they encounter most frequently in day-to-day practice. Done properly, CDD protects the firm, its fee earners, and the wider financial system. Done poorly — or not at all — it creates regulatory, criminal, and reputational risk.

This guide explains what CDD requires in practice, covering individual clients, corporate clients, trusts, and the increasingly common challenge of verifying beneficial owners across complex corporate structures.

What Is Client Due Diligence?

CDD is the umbrella term for the identification and verification measures that solicitors must apply to their clients before establishing a business relationship or carrying out a transaction. It has three components under Regulation 28 of the Money Laundering Regulations 2017:

1. Identifying the client — establishing who the client is
2. Verifying the client’s identity — checking that identity against reliable, independent sources
3. Understanding the purpose and intended nature of the relationship — knowing why the client has come to you and what they want to achieve

For most solicitors, step one is automatic — you take instructions and know who is in front of you. The discipline lies in steps two and three: properly verifying identity against good-quality documents and genuinely thinking about what the client’s instructions mean in the context of their stated background.

When CDD Must Be Applied

CDD is required:

• When establishing a new business relationship — for every new client on every new in-scope matter
• For occasional transactions — one-off transactions (or linked transactions) at or above €15,000 (approximately £13,000)
• Whenever there is a suspicion — of money laundering or terrorist financing, regardless of transaction size
• When there is doubt about existing information — if you suspect previously obtained CDD is inaccurate or has become stale

The trigger is the start of an in-scope engagement, not the point at which money changes hands. If you are advising on a residential conveyancing transaction, CDD should be in place before you begin substantive work — not at completion.

CDD for Individual Clients

What to Obtain

For an individual client, standard CDD requires you to:

• Obtain the client’s full legal name
• Obtain their date of birth
• Obtain their home address
• Verify their identity against reliable and independent source documents

Acceptable Verification Documents

The Money Laundering Regulations do not prescribe specific documents; LSAG guidance specifies what is considered reliable. In practice, the standard approach is a combination of:

Primary identity document (proves name and date of birth):

• Valid UK passport
• Valid photo driving licence (full or provisional)
• Valid EU identity card (for EU nationals)
• Valid national identity card issued by an EEA state

Address verification:

• Bank or building society statement (less than three months old)
• Utility bill (less than three months old)
• HMRC correspondence
• Electoral roll confirmation

One document from each category gives you a solid verification package for a standard individual. Some firms require two documents from column A for higher-risk clients or where the primary document raises questions.

Electronic Verification

Electronic verification (EV) — using commercial databases to check identity against credit reference data, electoral roll records, and document databases — is increasingly common and is acceptable under LSAG guidance as a supplement to, or in some lower-risk cases a replacement for, document-based verification. The key requirement is that the EV check must draw on at least two independent data sources.

The SRA has confirmed that electronic verification meeting appropriate standards satisfies the Regulations. However, firms should ensure their EV provider meets the standard required by LSAG guidance and that they retain records of the check including the result and the sources used.

Clients Who Are Not Present

Non-face-to-face verification requires additional scrutiny. If the client cannot attend in person, the firm must:

• Apply additional measures to compensate for the inability to assess the client in person
• Consider requiring certified copies of identity documents
• Consider using electronic verification
• Consider conducting a video call to confirm the client’s appearance matches their documentation

The SRA expects firms to have a clear written procedure for remote client onboarding and to apply enhanced monitoring to remote relationships.

CDD for Corporate Clients

Corporate clients present a more complex verification challenge because you must verify not just the legal entity but also its beneficial owners.

Verifying the Company

Standard CDD for a corporate client requires:

• Company name and registered number
• Registered office address
• Type of company and articles of association or equivalent constitution
• Names of directors (and verification of the identity of at least one director where the company itself is not verified through a reliable register)

In practice, the vast majority of UK-registered companies can be verified through Companies House free of charge. The Companies House register is a reliable independent source for basic company information. Since the Economic Crime and Corporate Transparency Act 2023, companies must have their registered address verified and directors must undertake identity verification, which increases the reliability of Companies House data.

For foreign-registered companies, equivalent official company registries should be used where available. Where no reliable register exists, additional verification steps are required.

Identifying and Verifying Beneficial Owners

The most demanding element of corporate CDD is identifying the ultimate beneficial owners (UBOs) — the natural persons who ultimately own or control the company. The threshold under the Regulations is 25% ownership or control.

The process involves:

1. Requesting a UBO declaration from the client — who are the natural persons with over 25% ownership or control?
2. Checking the PSC (Persons with Significant Control) register at Companies House — the register records shareholders with significant control
3. Identifying any discrepancies between the client’s declaration and the register
4. Verifying the identity of each UBO — applying the same verification standards as for individual clients

Where no individual holds 25% or more, the Regulations require you to identify the “senior managing official” — typically the CEO or managing director — as a fallback. This is important: the requirement to identify a natural person is not discharged simply because ownership is dispersed.

Complex Corporate Structures

Layered corporate structures — where the immediate client is owned by a holding company, which is in turn owned by another entity — are common in commercial work. The obligation is to look through to the natural persons at the top of the ownership chain.

In practice, this can mean tracing through several layers of holding companies, potentially across multiple jurisdictions. LSAG guidance permits firms to apply a “reasonable measures” standard: you must take steps proportionate to the risk to identify UBOs, and document what you did. Where a structure is genuinely complex and UBOs cannot be identified despite reasonable efforts, that itself is a risk flag warranting enhanced scrutiny.

CDD for Trusts and Other Structures

Express Trusts

For trusts, CDD must cover:

• The trust itself — its name, purpose, and governing law
• The settlor(s) — who established the trust
• The trustee(s) — who manages the trust
• The beneficiaries (or class of beneficiaries) — who benefits from the trust
• The protector(s), if any

All natural persons who are trustees must be identified and their identities verified. Beneficiaries who are identifiable and take a fixed interest should also be verified; where beneficiaries form a class (e.g., “the children of X”), identify and verify the class and the mechanism for determining membership.

Nominee Arrangements

Where a client uses a nominee shareholder or director, the identity of the underlying principal must be established — not just the nominee. Nominee arrangements are a recognised vehicle for obscuring beneficial ownership and therefore attract heightened scrutiny.

Simplified Due Diligence

The Regulations permit simplified due diligence (SDD) — a reduced level of verification — in genuinely low-risk situations. The conditions for SDD are strict: the firm must have conducted a risk assessment that concludes the risk of money laundering is low, and SDD is only available for certain categories of client (such as UK-regulated financial institutions or listed companies on recognised exchanges).

The SRA has emphasised that SDD is the exception, not the default. Many firms err toward applying standard CDD even where SDD would technically be permissible, which is prudent.

Timing and the Risk of Acting Without CDD

The Regulations require CDD to be completed before establishing the business relationship or carrying out the transaction. Acting before CDD is in place is a breach of the Regulations and — more seriously — creates the risk that you are unknowingly facilitating a money laundering arrangement under s.328 POCA.

Regulation 30 permits firms to begin verification during (rather than before) a business relationship where:

• It is necessary not to interrupt normal business
• The risk of money laundering is low
• Verification is completed as soon as reasonably practicable after first contact

This exception is narrow. It does not mean firms can routinely begin work and do CDD later. The SRA specifically criticises firms that treat post-retainer CDD as acceptable standard practice.

Refusing Instructions Where CDD Cannot Be Completed

If you cannot complete CDD — because the client refuses to provide documents, provides unsatisfactory documents, or disappears before verification is complete — you must not proceed with the matter. Regulation 31 requires firms to:

• Not establish the business relationship or carry out the transaction
• Terminate any existing business relationship where CDD cannot be completed
• Consider whether the failure to complete CDD is itself suspicious, and if so, file a SAR

Turning down a transaction because CDD cannot be completed is not a breach of any obligation — it is the right response. The greater risk is proceeding without adequate CDD and finding yourself implicated in a money laundering arrangement.

Ongoing CDD: Keeping Records Current

CDD is not a one-off exercise. Firms must apply ongoing monitoring to all business relationships, which includes keeping CDD documents up to date. This is particularly relevant for:

• Long-standing clients with infrequent but significant transactions
• Clients whose circumstances change (new beneficial owner, change of jurisdiction, new type of transaction)
• Clients who have been flagged in ongoing PEP or sanctions screening

Good practice is to set a calendar review for all active client CDD records annually, and to diarise a refresh whenever the scope of instructions changes materially.

---

Obiter takes the administrative burden out of CDD by integrating identity checks, document requests, and electronic verification directly into the client onboarding workflow. Fee earners see a clear dashboard of which clients have complete, current CDD — and which need attention — without chasing documents manually.