Accountancy Practice Website: AML Supervision and Onboarding

A prospective client of an accountancy practice rarely asks which body supervises the firm for anti-money laundering. They notice instead when the onboarding process feels careless: an email asking them to attach a passport scan, a form that does not say where the data goes, or no sign that the firm is registered with anyone at all. The website is where both problems are solved, and the two are linked. Regulators expect you to be supervised and to run proper checks; clients expect the checks to be handled as carefully as their tax return.

This guide is aimed at small practices, many of them supervised by HMRC rather than by a professional body. It explains how to work out which supervisor you need, what that costs, what to say about it on the site, and how to design an onboarding path that follows the National Cyber Security Centre's advice on phishing and account security. For the wider service context, see our web design and GDPR-compliant website pages.

GOV.UK lists the businesses that count as accountancy service providers for money laundering purposes: auditors carrying out statutory audit work, accountants who provide accountancy services to clients, tax advisers and consultants who advise clients about their tax affairs, payroll agents that provide accountancy services or tax advice, and customs practitioners or freight forwarders if they provide accountancy or tax services. The services include recording, reviewing, analysing, calculating and reporting on financial information for other people, giving a customer specific tax advice, helping to complete and submit tax returns, and advising on the amount of tax due.

Two points in that guidance affect website projects directly. First, if you provide these services virtually or through an automated service, you still need to carry out customer due diligence on your customer. A self-service online tax-return product is therefore not exempt simply because no person speaks to the customer. Second, the guidance says providers who give customers, or link to, basic tax information that would be the same for everyone, such as the basic rate of Income Tax, may not need to register. A purely informational blog is on the safe side of that line; an interactive calculator that produces a figure for one person's circumstances deserves a second look.

If your practice is not supervised by a professional body, HMRC is the supervisory body. GOV.UK states that an insolvency practitioner is supervised by their authorising body instead. Whichever body supervises you, say so on the site, because it answers a question that careful clients and banks both ask.

Fees are part of the business case when a sole practitioner decides whether to add a new service line. According to the GOV.UK fees page, which was updated on 22 December 2025 to reflect changes from 1 December 2025, the main charges are as follows.

Adding premises during the year is priced by timing: in the first six months you pay the full fee for each premises, in the second six months half, and removing a premises earns no refund. HMRC also says it will not review an application until fees are paid, and that it may cancel a registration if the annual declaration fee is not paid on time.

Why does this matter for a website? A practice that uses a co-working address, a home office and a client-facing branch has three possible premises. The site's contact page, the registration paperwork and the declared premises need to agree. Treat the contact page as part of the compliance record, and update the registration before opening a new location.

The register-or-update guidance sets a clear order of work. Before applying you should carry out an anti-money laundering, terrorist financing and proliferation financing risk assessment, put in place policies, controls and procedures to manage the risks you identified, add all beneficial owners, officers or managers (called responsible persons on the registration system) to the application, and add all premises where supervised activity takes place. HMRC says it may reject or refuse the application if these are not in place.

Reviews of new applications can take up to 45 days, according to the same page, and HMRC may email or telephone you in the meantime after sending a note about the risks of corresponding by email. Once registered you must submit an annual declaration that your details are correct and pay the annual fee. HMRC sends a message to your online account 30 days before the declaration and payment are due. Both stages must be completed or registration is cancelled.

A practical implication: a website launch date should not be the first date on which you tell anyone you provide services that need supervision. Finish the registration, then publish. If the site is already live, add the supervision statement as soon as the registration is confirmed.

The supervision statement

Place a short statement in the footer and on the About page. It should name the supervisory body, give the registration number HMRC issued, and say what the statement covers. Keep the wording factual, for example: the firm is supervised for anti-money laundering purposes by HMRC under registration number X. Do not suggest that supervision is an endorsement of quality; it is a registration under the regulations.

A short explanation for clients

Add a plain-English page titled something like "Why we ask for identification". Say that the law requires accountancy service providers to carry out customer due diligence, that the checks happen before work starts, what documents are usually needed, how they will be collected securely and how long they will be kept. A short page saves hours of explaining by phone and signals professionalism.

What not to publish

• An email address labelled "send your passport here".
• Registration numbers you do not hold, or a body's logo that you are not entitled to use.
• Any claim that clients are "approved" or "cleared" by the firm's checks.
• Names of clients or the sectors they work in, which would breach confidentiality.

The NCSC's guidance on defending an organisation against phishing is aimed at organisations of every size and is directly relevant to a practice that collects identity documents. Several of its recommendations translate into design decisions.

1. Share files through an access-controlled account, not attachments. The NCSC lists sharing files through an access-controlled cloud account, rather than sending files as attachments, as an example of making processes more resistant to phishing. Build the client upload into a portal and have the onboarding email contain only a link to it.
2. Verify important requests with a second channel. The same page says to verify all important email requests using a second type of communication, such as SMS, a phone call, logging into an account, or confirmation by post or in person. If a client emails new bank details or asks you to change a payment instruction, the process should require a call-back.
3. Tell clients what you will never do. The NCSC suggests telling customers what to look out for, such as "we will never ask for your password" or "our bank details will not change at any point". Put those lines on the onboarding page and in the welcome email.
4. Protect staff and client logins with multi-factor authentication. The NCSC explains that a second factor means an attacker cannot get into an account using only a stolen password. Turn it on for the portal, for email and for the practice management system.
5. Make it easy to report a suspicious message. The NCSC advises creating an environment that encourages users to report phishing, and avoiding a punishment or blame culture. Add a clearly visible "Is this email genuine?" contact on the portal.

None of this requires bespoke software. Many portals support these features out of the box; what the website adds is the explanation and the consistent branding that lets a client recognise the real thing.

The order matters because it keeps document collection inside an authenticated space and makes the later steps depend on earlier ones. The step that practices most often leave out is the call-back, and it is also the cheapest defence against payment-diversion fraud.

Most small practices buy a practice management or client portal product rather than building one. The website then has two jobs: explain the process and hand the client over to the product's login. Check four things before choosing a product: whether the portal supports multi-factor authentication for clients, whether uploaded documents are held in an access-controlled account rather than being emailed, whether the product keeps an audit trail of who viewed what, and where the data is hosted. Put the answers in your privacy notice.

Link from the site to the portal using a clearly branded address on your own domain, so clients learn one address to trust. If your site needs a lightweight rebuild to do that, a simple brochure site starts from EUR 300 excl. VAT, see pricing, and larger integrations are covered under web development.

Guidance on supervision has been revised repeatedly: the GOV.UK pages used here show updates in 2023, 2025 and 2026, including fee changes from 1 December 2025. Build the supervision statement so it is easy to edit in one place, and review it whenever HMRC changes its guidance. Keep a dated note of the pages you relied on, and assign one named person to check them each quarter.

A short quarterly checklist keeps the site honest:

• Does the footer still show the correct supervisory body and registration number?
• Do the premises on the contact page match the premises on the registration?
• Has the annual declaration been submitted, and was the payment reference quoted?
• Does the onboarding page still describe the checks you actually carry out?
• Is multi-factor authentication switched on for every portal and email account?
• Do the fee figures in any budgeting page match the current GOV.UK page?

When you are ready to plan a new site or portal handover, use the request a quote page and tell us which practice management product you use.

• GOV.UK: Fees you'll pay for money laundering supervision
• GOV.UK: Check if you need to register as an accountancy service provider
• GOV.UK: Register or update your money laundering supervision with HMRC
• NCSC: Phishing attacks, defending your organisation