Aipedia: Accountants

AI for AML checks and client due diligence

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Accountants can use AI tools for client due diligence, but the firm stays responsible for the outcome under the Money Laundering Regulations. A missed risk can bring supervisory action, and regulatory fines usually fall outside PI cover.

Part of: AI in Accountants

In short

AI-driven onboarding tools verify identity, scan adverse media and score client risk, which saves time for accountancy firms that must carry out customer due diligence (CDD) under the Money Laundering Regulations. Using a vendor does not move the legal responsibility: the firm still owns the CDD decision. False negatives, where the tool misses a politically exposed person or adverse news, can lead to action by the firm's AML supervisor. Fines and penalties usually fall outside PI, although a policy may respond to some related civil claims and defence costs, depending on the wording.

How accountants use AI for onboarding

Accountancy firms are within the scope of the anti-money laundering regime and must carry out CDD on new clients and keep it up to date. AI tools now handle much of that work: matching a selfie to a passport, checking documents for tampering, searching news sources in many languages for adverse media, screening against sanctions and politically exposed person lists, and producing a risk score.

The output is a tidy report with a green, amber or red rating. The temptation is to treat green as the answer and file it. That is understandable in a busy practice, but a risk score is a summary of matches the tool found in the data it can reach. It says nothing about what it could not find, how confident each match was, or whether the client's actual business carries risks the tool was never asked to assess, such as cash-heavy trading or complex ownership.

The duties that apply

The Money Laundering Regulations place the CDD and risk assessment obligations on the firm. Buying a tool does not transfer them to the vendor.
R320.11 of the IESBA technology revisions: decide whether output is appropriate for the intended purpose. A risk score designed for one sector may not suit another.
300.6 A2: the data might not be sufficient for the technology, for example thin records for overseas individuals.
Confidentiality: client identity data passed to a vendor must be protected, and the PCRT AI guidance covers overseas storage and third-party retention (paras 4.2 to 4.5).
UK GDPR Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 and in force from 5 February 2026: a significant decision based solely on automated processing needs safeguards, such as allowing human intervention. An automatic refusal to take on a client could engage this.

What can go wrong

Illustrative scenario: a firm onboards a new company client. The AI tool returns a low risk score because it matched the director's name to a different person with no adverse history. Nobody reviews the underlying matches. The firm later discovers through its supervisor's inspection that the director had relevant adverse media and that enhanced due diligence should have been applied. The supervisor takes regulatory action, and the firm faces internal costs to review its whole client base.

The opposite failure also matters: a tool that wrongly flags a legitimate client, leading to a refusal without human review, can raise data protection questions. It can also damage a client relationship and, in some cases, lead to a complaint that the firm acted unfairly on the basis of a mismatched record.

How PI usually responds

Regulatory fines and penalties are commonly excluded from PI or uninsurable, so an AML supervisory fine would usually fall on the firm. Some policies provide cover for defence costs in regulatory investigations, depending on the wording. A civil claim, for example from a client whose matter was disrupted, is a different question and may fall within PI subject to the terms. See whether fines are covered by PI. A data breach at the vendor is usually a cyber issue; see cyber insurance for accountants.

Practical controls

Review the underlying matches behind every risk score, not just the colour.
Record the human decision to accept or decline the client and the reasons.
Carry out vendor due diligence on data sources, storage location and retention.
Re-run checks when circumstances change, not only at onboarding.
Explain AI-assisted checks in the engagement letter.
Use the same scepticism as with AI anomaly detection on ledgers.

How Apex helps

Apex arranges PI and cyber insurance for accountants, and a broker can explain where regulatory costs, civil claims and data incidents sit across your policies. See the accountancy AI overview.

Sources

Frequently asked

Can we rely on an AI tool for client due diligence?

You can use it, but the firm remains responsible for the CDD outcome under the Money Laundering Regulations. Review the evidence behind each result and record the human decision, especially for higher-risk clients.

Does PI cover an AML fine from our supervisor?

Usually not. Fines and penalties are commonly excluded from PI and may be uninsurable. Some wordings include limited cover for defence costs in regulatory proceedings, so check your policy and ask your broker.

Do automated client acceptance decisions engage data protection law?

They can. From 5 February 2026, UK GDPR Articles 22A to 22D require safeguards for significant decisions based solely on automated processing, including the right to human intervention. Keeping a person in the decision avoids the issue.

What should vendor due diligence on an AML tool cover?

Check the data sources and how current they are, where data is stored and for how long, whether data is used to train models, how matches are made and explained, and what the contract says about errors. The ICAEW roundtable report recommends vendor due diligence.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.