AML Members Area
AML Complete Support
Guides and answers for setting up your AML Complete record, understanding your risk scores and keeping your details up to date.
Popular:
Browse topics
- Latest updates2
- Getting started5
- Completing your record6
- Keeping details up to date3
- Profiles and BOOMs4
- Risk and scoring3
- Definitions3
- Data, GDPR and inspections2
- FAQs13
Still need help?
Our team is here Monday to Friday, 9am to 5pm.
No guides match your search
Try a shorter word such as ‘client’, ‘risk’ or ‘upload’, or contact us on hello@iab.org.uk or +44 (0)208 187 8888.Latest updates
AML Complete update: supporting independent reviews and risk monitoring (March 2026)
The regulatory landscape for the bookkeeping and accountancy profession continues to evolve. As previously communicated, anti-money laundering supervision across the sector is expected to move towards greater consistency and scrutiny as the Financial Conduct Authority develops its future supervisory approach.
In this environment, it is increasingly important for practices to ensure that their AML controls, policies and procedures are not only documented, but are regularly reviewed and operating effectively in practice. As part of the IAB’s ongoing support for members, AML Complete is being updated to further support the principles of continuous improvement and independent review within member practices.
New questions within AML Complete
You will shortly notice the introduction of several additional questions within the AML Complete system designed to help practices record when key elements of their AML framework have been independently assessed.
These questions relate to:
- When the practice AML policy was most recently independently assessed and approved as effective
- When procedures relating to client risk assessment, PEP identification, onboarding and CDD, client anonymity, record keeping and SAR processes were most recently independently assessed
- When procedures relating to client activity monitoring and unusual transactions were most recently independently assessed
- When procedures relating to ongoing monitoring and review of AML compliance within the practice were most recently independently assessed
- When the practice policy on identifying and controlling proliferation financing risk was most recently independently assessed
- Members may also notice refinements to how AML Complete evaluates certain risk indicators within the system, supporting a more structured approach to assessing the strength of a practice’s AML framework.
These updates do not introduce new regulatory requirements, but they are designed to help practices demonstrate that their AML policies and procedures remain robust, effective and appropriate as regulatory expectations continue to develop.
The IAB will continue to support members with practical guidance and tools to help maintain strong AML compliance now and in the future.
The Institute of Accountants and Bookkeepers
Independent Review: what is it and who can carry one out?
An AML Inspection is a formal supervisory activity carried out by the IAB as part of its regulatory role. It is not optional and forms part of your ongoing compliance obligations.
An Independent Review, by contrast, is an activity undertaken by the practice to assess its own AML policies, procedures, and controls. It is not mandated in the same way as an inspection, but it is strongly encouraged as good professional practice and aligns with regulatory expectations around ongoing monitoring and effectiveness.
In terms of who can carry out an independent review, this should be someone experienced and sufficiently objective. In practice, this would typically be another practitioner who understands AML requirements and how they apply in a bookkeeping or accountancy setting. As a guide, an individual holding at least MIAB level (or equivalent experience) and operating their own practice would be appropriate. The IAB Ambassador network is a suitable place to identify individuals with the relevant experience.
As evidence, the IAB would expect a clear written record of the review. This should be dated and set out what areas were covered, the findings, and any actions identified. The documentation should demonstrate that the review was a genuine and structured assessment of your AML framework.
Getting started
Do I have to use AML Complete?
The use of AML Complete was mandated by the IAB in 2023 as part of our commitment to strengthening anti money laundering supervision and ensuring consistent standards across our member base.
For members supervised by the IAB for anti money laundering, use of the platform is a requirement. It provides a structured framework for managing your obligations, including client due diligence, risk assessments, and maintaining clear, auditable records of compliance.
This approach ensures consistency across the IAB community and enables us to meet increasing regulatory expectations, while supporting members to demonstrate that their practices are operating to a professional and compliant standard.
AML compliance is an ongoing responsibility, and AML Complete is designed to help embed this into the day to day running of your practice.
I have just logged on after receiving my log in details. What do I do now?
There are seven steps that you will need to follow to create your record for the first time in AML Complete. A summary of each step is provided here with specific details of how to perform each step broken down further in the Getting Started section. Please note that when you first log into each section all questions will be highlighted yellow. Once an answer has been selected the highlight will disappear for that question.
This is to help you identify any questions you may have missed that could stop you from being able to submit the form.
STEP 1 – Create your Practice Details. Details are entered here which describe the Practice, including its business structure, the number of owners, partners, employees and subcontractors involved. It also covers services offered and how the Practice manages things like engagement with its clients, compliance with anti-money laundering legislation as well as oversight of its own business processes and staff training. Certain questions will generate further profiles, for example in relation to each staff member. Uploading of documents may also be invited, for example the Practice anti-money laundering policy.
STEP 2 – Create a record for each BOOM* within your practice. This is where details of any Beneficial Owner, Officer or Manager(s) for your Practice are entered. NOTE – *See the Definitions section for further details of what constitutes a BOOM.
STEP 3 – Create a record for every member of staff within your practice (this includes yourself!) This is where details are entered for each practice employee* (including partners or owners in the business) whose work is: ‘Relevant to compliance with the 2017 Regulations; or is otherwise capable of contributing to the identification and mitigation of the risks of MLTF to which the business is subject, or to the prevention or detection of MLTF in relation to the business.’ *Note: A separate profile is required for Agents or Sub-contractors who are not ‘employees’ but provide relevant services to the Practice (Step 4 below).
STEP 4 – Create any Subcontractors you may have. This is where details are entered for each subcontractor or ‘agent’ used by the Practice whose work is ‘Relevant to compliance with the 2017 Regulations; or is otherwise capable of contributing to the identification and mitigation of the risks of MLTF to which the business is subject, or to the prevention or detection of MLTF in relation to the business.’ Note: There is a separate form staff who are employees of the Practice (Step 3).
STEP 5 – Create your Clients and their Beneficial owner(s). This is where details of a client business are entered. (A separate profile is required for each client). It covers who they are, the structure of their business, what they do and how your practice engages with them. An additional short profile is also needed for each Beneficial Owner(s) of this client business and for some questions you will be invited to upload copies of relevant documents.
STEP 6 – Check your tasks. This is where any outstanding tasks will appear to prompt you to complete any areas of the application which may be missing or incomplete.
STEP 7 – Submit your application to IAB. Congratulations! You are now ready to submit your application to the IAB for review. To do this click the ‘Submit to IAB’ button under the My Tasks page
How long do I have to insert all details in AML Complete?
You will have 6 weeks to insert all your details from the date of your first renewal notice.
Do I have to complete my AML training annually?
AML training is a requirement under UK regulations and must be undertaken on a regular basis to ensure you and your staff remain up to date with current risks, legislation, and best practice.
In practice, this is typically completed at least annually, with additional training required where there are changes to regulations, your business activities, or your risk profile.
As an IAB supervised member, you are expected to maintain up to date AML knowledge and to be able to evidence that appropriate training has been completed. This includes keeping clear records of training undertaken, dates, and content covered.
AML compliance is not a one off exercise. Regular training ensures you are able to identify risks, apply your policies effectively, and demonstrate that your practice is operating to the required professional and regulatory standard.
I feel lost when it comes to AML Regulations and my practice. Where do I start?
You are not alone. AML regulations can feel complex, particularly as expectations continue to evolve and regulatory scrutiny increases. However, as an IAB supervised member, it is essential that you have a clear understanding of your responsibilities under the Money Laundering Regulations.
To support you, the IAB provides a structured pathway to build your knowledge and confidence. This includes a suite of 8 dedicated CPD courses covering the key areas of the Money Laundering Regulations, designed to give you both the technical understanding and practical application required within your practice.
In addition, members should refer to the CCAB Anti Money Laundering Guidance for the Accountancy Sector, which sets out the expectations for firms and provides detailed, practical guidance on how to apply the regulations in real scenarios.
AML Complete should then be used alongside this knowledge to implement and evidence your compliance. The system provides the framework, but it is your understanding of the regulations that ensures it is applied correctly.
Taking the time to engage with the CPD courses and the CCAB guidance will give you the clarity and confidence needed to manage your AML responsibilities effectively and to demonstrate that your practice is operating to the required professional and regulatory standard.
For CPD available courses, please click here.
Completing your record
I have multiple clients. Do I have to enter each one separately?
No, you do not need to manually enter each client individually. AML Complete allows you to import your client data using a CSV file, making the process more efficient for practices with multiple clients.
From the ‘My Clients’ section, you can use the import function to upload your client list in one step. Before doing so, you should download the sample template to ensure your data is structured correctly and aligns with the required format.
It is important that your data is accurate and complete at the point of upload, as this information forms part of your AML compliance record. Once imported, you can then review and update individual client profiles as needed.
This approach enables you to efficiently populate your client base while maintaining a clear, consistent, and auditable record of your AML obligations.
A question is highlighted yellow. What do I do?
A question will be highlighted in yellow if it hasn’t been answered. Once a question has been answered the highlight will disappear. This is to help you locate any answers that you may have missed when completing your form
I only have a combined Policy & Procedure document. How do I upload it to my Practice Profile?
AML Complete does not currently have the capability to distinguish between a combined document and single procedures. Please upload the combined Policy & Procedures document for each area when upload is prompted. We recognise that this is duplication for you and is an area being looked at for future development.
Is it mandatory to upload clients’ letters of engagement and IDs?
Yes, as these are documents that are required by us then it is mandatory that you upload them.
The system is showing my application as incomplete, but I have entered everything. What do I do?
Please check through your application by editing each section to ensure that all questions have been answered, all owners, staff, clients and subcontractors have been created as appropriate and that there are no outstanding tasks in the ‘My Tasks’ panel. If you are still encountering difficulties then please contact us at hello@iab.org.uk or +44 (0)208 187 8888 and we will be happy to help.
How do I submit my application to the IAB?
You will be unable to submit your application to the IAB until ALL sections and tasks are complete. All profiles (Practices, Owners, Staff, Subcontractors, Clients) must be showing as ‘Complete’ where applicable and any displayed tasks in the My Tasks panel must be completed before submission. The information you provide is used to help inform our statutory AML Supervision process and must be accurate, complete and up to date. Once you have entered all relevant details, each section is showing as complete, and you are happy with the content please click on the ‘Submit to IAB’ button to forward your application to the IAB.
Keeping details up to date
What do I do if any of my client details change?
If you need to update any information relating to your clients then you can simply click on the relevant client, then the Edit button and this will take you into the original data which you can simply overwrite and save. You will then need to resubmit this data to the IAB by clicking on Submit to IAB.
What do I do if my practice details change?
If any details change in relation to your practice management, services or the staff you employ you can simply edit these by clicking into the My Practice page and selecting the relevant topic you wish to amend (Details, Staff, Subcontractors). Once you are in the appropriate page click on the edit button and you can overwrite the information previously populated. You will then need to save the updated profile and resubmit to IAB by clicking on the Submit to IAB button under the My Tasks page. You are unable to update your Practice Name, Structure or contact details which must be updated via the IAB membership team. The Membership Team can be contacted at hello@iab.org.uk or +44 (0)208 187 8888.
Can I download my data from AML Complete?
Yes. Look for the ‘download’ button. Clicking this will initiate a download of a spreadsheet containing your last ‘saved’ data
Profiles and BOOMs
Staff Profile
A Staff profile is needed for each person employed doing AML-relevant work for the Practice (including the owner) This profile will include their details and information including their updated AML Training.
Contractors Profile
A Contractor (or agent) Profile is needed for each person contracted by the practice carrying out AML-relevant work. For example, someone who does ‘outsourced’ work from time to time.
Why do I have to provide details of all BOOMs within my practice?
Regulation 26 requires each beneficial owner, officer and manager in a business to be approved by the supervisory authority of that business. Effective from 10th January 2020 the revised ML Regulations require that the business provides proof (i.e. DBS Check) that none of the BOOMs associated with the business have relevant criminal convictions.
What is Integrity Screening?
Integrity is a key issue across the financial services sector and IAB requires evidence of a DBS check, dated within the past 6 months, when approving membership applications. For further information on the IAB DBS requirements please refer to the Frequently Asked Questions on our Membership area of the website at our Membership page.
Risk and scoring
What is a Firm Risk Assessment and why do I need one?
Industry and government AML guidance refers to the need for a ‘risk-based’ approach and the regulations include provision for ‘proportionate’ actions and policies. This risk-based approach starts with an understanding of the risks faced by your business as a bookkeeping or accountancy practice, and this requires assessment of a wide range of factors.
This overview is known as a Firm Risk Assessment (FRA). The FRA is the starting point from which you will determine your practice policy and especially the methods and procedures you will need to design so that you are able to manage all the AML risks and demonstrate your compliance with the regulations. Some services are recognised as high risk in relation to AML.
So, if your practice offers these services, for example ‘Trust and Company Service Provision’ (TCSP) this needs to be recognised in your FRA and reflected in the procedures you put in place. The Firm Risk Assessment is a broad approach which should grow to cover most aspects of your business. It is a very necessary process at the start of a business practice so that procedures can be designed but it will need to be re-visited, at a minimum once per year, to ensure that any business changes are still covered; for example: where there are new clients or new services provided by your practice. It is YOUR responsibility to review and update your FRA regularly.
For further guidance please see Firm Risk Assessment Video.
Some of my answers are highlighted in red on the summary page. What does this mean?
Answers highlighted in red means that a risk score has been allocated to the answer you have provided. This could be for a variety of reasons such as the service you provide has a risk associated with it (e.g. TCSP services). Or it may be that you have cash intensive clients which again has a risk associated to it. Or it may be that you haven’t provided Policy & Procedures documentation for a certain area that is mandatory as part of the AML Regulations and CCAB Guidance, any answer that is highlighted in red will contribute to your overall risk score. Some risks you will be able to negate – such as providing the relevant Policy & Procedure documentation. Other risks will remain whilst you provide those specific services or engage with particular clients. For those risks it is about management through regular reviews and implementing mitigation strategies to help reduce the impact of the risk.
Why does my Practice or Service Risk show as Very High Risk?
For every question you answer, a score is allocated depending on the answer you provide. This score is predetermined by the IAB and will be dependent on a number of risk factors associated with that specific question. The higher the associated risk with the category concerned the higher the score. This rating does not mean that there is definitely a risk in your practice as you may already have mitigation procedures in place. The rating is intended to provide an indication that there is an associated very high risk and to prompt vigilance in that area to ensure any associated risk has appropriate mitigation in place. Where no risk is indicated for an answer you have provided a score of 0 will be allocated to that specific question. For an answer that indicates potential medium risk a score of 5 will be assigned. For an answer that indicates a high level of risk a score of 10 will be allocated to that answer. For an answer that indicates a very high risk is associated then a score of 15 is assigned. The scores are then totalled for each category (e.g. Practice, Service, Client) and assigned a total risk score. The overall risk rating assigned (e.g. Low, Medium, High, Very High) will be taken from the highest rating that has been assigned throughout the completion of that category. For instance, a Practice may have one client who is a Politically Exposed Person. The level of risk associated with this type of client is Very High so the Practice will be assigned a Very High Risk, even if the Practice only scores 15 overall because no other risk score is assigned to any other answer.
Definitions
BOOM (Beneficial Owner, Officer or Manager)
BOOM stands for ‘Beneficial Owner, Officer or Manager’. CCAB Guidance (Section 3.2.5) defines a BOOM as follows.
Beneficial Owner
- a sole practitioner;
- a partner, or LLP member, in a firm who:
- holds (directly or indirectly) more than 25% of the capital, or profits or voting rights; or
- exercises ultimate control; and
- a shareholder in a limited company who:
- holds (directly or indirectly) more than 25% of the shares or voting rights; or
- ultimately owns or exercises ultimate control.
Officer
- a sole practitioner;
- a partner in a partnership (including a Scottish Limited Partnership (SLP));
- a member in a limited liability partnership (LLP);
- a director or company secretary in a limited company.
Manager
- the nominated officer (the MLRO);
- the member of the board of directors (or if there is no board, of its equivalent management body) or of its senior management as the officer responsible for the firm’s compliance with MLR17; and
- any other principal, senior manager, or member of a management committee who is responsible for setting, approving or ensuring the firm’s compliance with the firm’s Anti-Money Laundering policies and procedures, in relation to the following areas:
- client acceptance procedures;
- the firm’s risk management practices;
- internal controls, including employee screening and training for AML purposes;
- internal audit or the annual AML compliance review process;
- customer due diligence, including policies for reliance; and
- AML record keeping.
Beneficial Owner
A beneficial owner is an individual(s), who, directly or indirectly, through any contract, arrangement, understanding, relationship or otherwise, owns 25 percent or more of the equity interests of a legal entity. NOTE: AML Complete requires details of the Beneficial Owner(s) of your practice (Practice Profile) and details of the Beneficial Owner(s) of your client’s business(es) (Client Profile)
People with Significant Control (PSC)
A person with significant control (PSC) is someone who owns or controls a company. They may also be referred to as ‘beneficial owners’. A company can have one or more PSCs and their details must be recorded on the company PSC register on Companies House.
Data, GDPR and inspections
Does data protection and GDPR legislation allow me to share my client details with the IAB?
IAB is a ‘Professional Body Supervisor’ (PBS) under the MLTF Regulations 2017. As such IAB uses information relating to bookkeeping and accountancy practices for the lawful purpose of supervising compliance with the Regulations.
This is provided for under the General Data Protection Regulations and allows information (including personal data) to be shared.
Is AML Complete used for inspection purposes?
IAB uses a combination of different methods, including remote and on-site inspections for the supervision of bookkeeping and accountancy practices. AML Complete contributes to that process as a source of data relevant to AML risks and overall compliance with MLTF Regulations. It is not designed as an inspection tool.
Quick answers
AML Complete FAQs
Short answers to the questions members ask most. Each one links to the full guide above.
Is using AML Complete mandatory?
Yes, for members supervised by the IAB for anti-money laundering. The IAB mandated AML Complete in 2023 to keep standards consistent across the member base. Read the full guide
How long do I have to complete my details?
You have 6 weeks from the date of your first renewal notice to insert all your details. Read the full guide
Do I have to enter every client by hand?
No. From ‘My Clients’ you can import your client list as a CSV file. Download the sample template first so your data is in the right format. Read the full guide
Why is a question highlighted yellow?
It has not been answered yet. The highlight disappears as soon as you select an answer, which helps you spot anything that would stop you submitting. Read the full guide
What does a red answer on the summary page mean?
A risk score has been allocated to that answer, for example because of a higher risk service such as TCSP, cash intensive clients, or missing Policy & Procedure documents. Every red answer contributes to your overall risk score. Read the full guide
How is my risk rating worked out?
Each answer scores 0 (no risk), 5 (medium), 10 (high) or 15 (very high). Scores are totalled for each category, and the overall rating is taken from the highest rating assigned in that category. Read the full guide
Why can’t I submit my application?
Every profile (Practice, Owners, Staff, Subcontractors, Clients) must show as ‘Complete’ and every task in the My Tasks panel must be done before the ‘Submit to IAB’ button will work. Read the full guide
Must I upload client letters of engagement and ID?
Yes. These documents are required by the IAB, so uploading them is mandatory. Read the full guide
Do I need to resubmit after changing my details?
Yes. After editing and saving a client or practice profile, click ‘Submit to IAB’ under the My Tasks page to send the updated data. Read the full guide
Can I change my practice name or structure myself?
No. Practice name, structure and contact details must be updated by the IAB membership team on hello@iab.org.uk or +44 (0)208 187 8888. Read the full guide
Can I download my data?
Yes. Use the ‘download’ button to get a spreadsheet of your last saved data. Read the full guide
Is AML Complete an inspection tool?
No. It is one source of data the IAB uses alongside remote and on-site inspections, but it is not designed as an inspection tool. Read the full guide
How often should I review my Firm Risk Assessment?
At a minimum once per year, and whenever your business changes, for example new clients or new services. Read the full guide
Still stuck?
Talk to the IAB team
If you can’t find the answer here, get in touch and we will be happy to help.
Our Group
