The AML Check You Meant to Do: Onboarding Without Gaps
AML/KYC verification and the first PBC request often happen in the wrong order, in the wrong tool. Here's how to make identity checks and document requests one clean step.
Most firms know the rule: verify who you're dealing with before you start acting for them. In practice, the AML/KYC check tends to fall into an awkward gap. The engagement letter goes out, the client says yes, work starts to feel real — and someone quietly assumes identity verification happened during the handshake conversation. Sometimes it did. Sometimes a passport scan is sitting in an email nobody filed. Sometimes it never happened at all, and you find out months later when a partner asks where the records are.
The problem isn't that firms don't care about anti-money-laundering obligations. It's that onboarding is a chain of small tasks — identity checks, beneficial ownership questions, the first document request, the prepared-by-client (PBC) list — and each one tends to live in a different place. When the steps are scattered, the order slips, and gaps open up between them.
Why the sequence keeps breaking
Think about what a new client onboarding actually involves. You need to confirm the identity of the individuals and, for a company or trust, understand who ultimately controls it. You need to record how you verified that. You need to issue an engagement letter that scopes the work. And you need to gather the documents that let you actually do the job — prior year returns, bank statements, ASIC records, the trust deed, whatever the engagement requires.
On paper that's a clean list. In a busy firm it fragments fast:
- The identity check happens in a standalone AML tool or a folder of scanned IDs.
- The engagement letter goes out from a document platform or a Word template.
- The first PBC request gets typed into an email, one item at a time, from memory.
- The client's replies land back in three different inboxes.
Nobody owns the whole sequence, so nobody can see whether all of it happened. A client can be halfway into their first job before anyone notices the KYC step was skipped — and by then you're already exposed.
Verification and document requests are the same conversation
Here's the shift worth making: the AML/KYC check and the first document request aren't two separate events. They're the same moment in the relationship — the point where you're asking the client to prove who they are and hand over the material you need. Treating them as one workflow, rather than two disconnected chores, closes most of the gaps on its own.
When a new client comes on board, the natural flow is:
- Collect the identity evidence — the individuals behind the entity, ID documents, and the beneficial ownership picture for companies and trusts.
- Record the verification — what you checked, when, and who signed off, stored against the client record rather than in a personal folder.
- Issue the engagement letter — scoped to the work, ready for e-signing.
- Request the documents — the PBC list for the specific engagement, sent as one structured ask, not a trickle of emails.
Done in sequence, in one place, each step becomes a prerequisite for the next. You can't quietly start work on a client whose identity was never verified, because the verification is part of the same onboarding record you're working from.
The PBC list you keep re-typing
The document request deserves its own attention, because it's where the most time leaks out. Most PBC lists live in someone's head or in an old email they copy and adapt each time. That means the list changes slightly with every client, items get forgotten, and the request goes out as a wall of text the client half-reads.
A better approach is to standardise the PBC list by engagement type. A company tax return has a predictable set of inputs. A SMSF audit has another. A new bookkeeping client needs bank feeds, prior software access and opening balances. Once those lists exist as reusable templates, onboarding stops depending on whoever happens to be doing it that day — and the client gets a clear, complete request the first time instead of a dribble of follow-ups.
This is where account practice management software earns its place. Rather than juggling an AML tool, a document platform, an inbox and a spreadsheet, the whole onboarding sequence runs as one workflow. In Finye, a new client record ties the identity and verification details, the engagement letter with e-signing, and the document request together — so the KYC step and the PBC request happen in order, against the same client, with nothing sitting in a personal inbox.
Let the portal do the chasing
The other benefit of running requests through a client portal rather than email is that the follow-up stops being your job. When you send a structured PBC list to the portal, the client can see exactly what's outstanding, upload as they go, and get reminded automatically about the items they haven't returned. You're not sending the fourth version of "just a gentle nudge on those bank statements." The system closes the loop.
It also keeps the documents in one predictable place. Client accounting work depends on having the right inputs to hand — and when everything a client sends lands against their record instead of scattered across inboxes and downloads folders, the job can actually start when you expect it to.
Making it stick
You don't need a heavy compliance regime to fix this. You need three things joined up:
- A single onboarding sequence that puts identity verification before work begins, every time, without relying on memory.
- Templated PBC lists by engagement type, so the request is complete and consistent rather than reinvented per client.
- One place the client responds, so documents and verification records live against the client rather than in someone's email.
Get those right and the AML check you meant to do stops being the thing you discover was missing. It becomes the natural first step of every engagement — done, recorded, and impossible to skip — with the first document request following straight behind it, as one clean piece of client accounting management rather than four disconnected tasks.