Sanctions screening for accountants: a UK client-onboarding checklist

The short answer: screen, assess and record before accepting work

For a UK accountancy practice, a workable sanctions check starts by identifying the client and the relevant people or entities behind the engagement. Search current sanctions sources, investigate possible matches using reliable identifiers, assess ownership and any service restrictions separately, then record the decision and its reviewer. Repeat the assessment when material facts change. A search result alone does not decide whether the work can proceed.^[1][2]

An accountancy engagement is rarely just a name and an invoice. Your firm may prepare accounts for a company, receive instructions from a director and be paid by another group entity. A useful screening process connects those relationships to the work you are actually being asked to perform.

ACCA recommends considering sanctions at client acceptance and throughout the professional relationship. Its guidance identifies accountants, auditors, tax advisers and trust or company service providers as relevant firms with sanctions obligations. Identity verification and sanctions review answer different questions; completing one does not establish the outcome of the other.^[2]

Make the outcome understandable to someone who did not run the search. A colleague taking over a payroll engagement should be able to see which people were checked, why they were included, what needed review and who authorised the next step. A screenshot labelled “passed” does not explain all of that.

Start with the engagement, not the search box

Before searching, create a short relationship map. Begin with the contracting client, then identify relevant owners, controllers and people giving instructions. Record a company number alongside a legal name wherever available. Keep former names and trading names separate so that a later reviewer can reconstruct the search.

For bookkeeping, consider who authorises payments and which entities your team is handling records for. For a group audit, separate the parent, the audited entity and relevant ownership questions. For a sole trader, avoid turning a trading-name search into an assumed check of the individual. The purpose of this exercise is to make the scope explicit, not to screen every name in a ledger without a reason.

An onboarding form should make that map easy to complete. Give staff fields for the legal client name, company number if there is one, country of incorporation, trading names, owners and controllers identified for review, the people who instruct the firm, and any third-party payer relevant to the engagement. Distinguish information supplied by the client from information checked independently. If the owner of an intermediate company is unknown, write “unknown” and assign a follow-up; do not turn a partly completed organisation chart into a negative sanctions finding.

Use proportionate judgement when selecting additional names. The partner who signs an engagement letter, a director giving instructions, an owner who can control the company, and a company that will receive the work may each raise a different question. A rigid rule to screen every employee, every supplier and every ledger contact can overwhelm a small practice without explaining who can benefit from the service. Record why the selected people and entities matter, so the scope can be challenged later.

• Record the legal client, the engagement type and the person responsible for acceptance.
• List the people and entities selected for screening, their roles and the reason for inclusion.
• Capture available identifiers accurately; mark missing information as unknown rather than inventing it.
• Identify any separate ownership, geographic or service-restriction questions that a name search cannot resolve.

Check ownership and control beyond the client name

OFSI explains that an entity can be subject to relevant asset-freeze and financial-services restrictions because it is owned or controlled by a designated person even when the entity is not itself listed. Its guidance describes direct or indirect holdings of more than 50% of shares or voting rights, rights to appoint or remove a board majority, and a wider factual-control test. The exact regime and facts matter; a no-match company search cannot settle the ownership question.^[1]

For a corporate client, trace the chain through intermediate companies to the people or entities exercising ownership or control. Save the source and date for each link: client documents, group charts and Companies House records can help, but a filing is one piece of evidence rather than a complete guarantee of present control. Compare conflicting information, such as a recent share transfer that has not yet appeared in a filing, and record who will resolve the discrepancy. The practice should seek specialist advice where indirect or informal control is unclear.^[1][3]

Do not substitute the Companies House people-with-significant-control threshold for the sanctions analysis. PSC registration has its own conditions, while OFSI’s test includes indirect ownership and ways of exercising control that may need factual investigation. Equally, the fact that a director shares a surname with a designated person is a prompt to gather identifiers, not a conclusion about ownership. Keep the ownership memo alongside the screening record and identify the person who signed off its limits.^[3][1]

Use current sources and record the scope of the check

Since 28 January 2026, the UK Sanctions List has been the sole source for UK sanctions designations; the old OFSI Consolidated List is no longer updated. Check that procedures and supplier documentation do not still direct staff to the retired feed.^[4]

Keep the search date distinct from the source publication date and the time a provider last retrieved its data. Those dates answer different questions. If a source is unavailable or a search has not completed, record the interruption and the next action rather than filing an empty result as a completed check.

Decide which additional jurisdictions matter to an engagement with appropriate advice. A multi-list search is useful evidence of what was searched, but the presence of a foreign-list result does not, by itself, explain which restriction applies to a UK engagement. Record the list and programme rather than reducing every result to the same label.

Make coverage visible to the reviewer. Note the precise legal and trading names searched, aliases used, identifiers entered, list or provider consulted, search time, result reference and any data delay the provider discloses. If the firm uses a batch, reconcile the number of names submitted with the number of completed results; a batch receipt is not proof that every row finished. Decide how an unavailable source is retried and who can defer an engagement while that uncertainty remains.

Review possible matches before making a decision

OFSI distinguishes a name match from a target match. Compare the available identifiers; if uncertainty remains after checking the list, OFSI can assist.^[1]

In our suggested review record, separate three things: facts that agree, facts that differ and information you still do not have. A similarity score is a way to prioritise review, not a probability that your client is sanctioned. Avoid closing a result merely because one address differs when the rest of the identity evidence is unresolved.

Illustrative example: an invented client director shares a name with a listed individual. The reviewer records the source reference, compares independently obtained identity details and documents the reason for the decision. If the evidence is insufficient, the file remains unresolved and goes to the nominated senior reviewer. The example describes a process, not a rule that any single identifier automatically clears a match.

Give staff three distinct outcomes: clearly different person on documented evidence, possible match requiring more information, and a concern escalated for a decision about affected activity. For the first outcome, keep the decisive differences and where they came from; for the second, name the missing identifiers and an owner; for the third, document who was told and when. A change in address or spelling may be weak evidence on its own. The reviewer should test the whole identity against the list entry and avoid presenting a software score as a legal finding.

A clear name search is not permission to provide every service

UK Russia-related sanctions include restrictions on specified professional and business services, including accounting and auditing, supplied to persons connected with Russia. These are not simply a list of named clients. Scope, exceptions and licensing need a separate assessment against the current government guidance.^[5]

Add a service-scope question to your engagement review when relevant: what is being supplied, to whom, where, and for whose benefit? A firm can have an orderly name-screening file while still leaving that question unanswered. Escalate unfamiliar cross-border work before promising a delivery date; do not ask the screening result to resolve a question it was not designed to answer.

This matters when a UK practice prepares accounts or provides advisory work for a group with Russian operations. Establish the contracting party, the recipient of the actual work, where each entity is established and whether another group company benefits. Government guidance says the professional-services rules apply by activity, and distinguishes accounting from auditing, including different exceptions and licensing grounds. Do not assume a statutory audit or a UK intermediary makes the service permissible; have the responsible person assess the current regulation and guidance for the specific work.^[5]

Set an escalation route and keep the evidence usable

Relevant firms must report to OFSI as soon as practicable when the applicable knowledge or reasonable-suspicion threshold is met in the course of business. Do not wait for absolute certainty before assessing that duty.^[1]

Build a procedure that tells staff who can pause affected work, who assesses reporting and licensing, and where advice is recorded. Do not make a routine compliance meeting the only route for an urgent concern. Equally, do not label an unreviewed name hit as a confirmed designated person in the client record.

For continuing engagements, our recommendation is to connect review tasks to meaningful changes: a new owner, a new instruction, a change in payment arrangements or relevant list updates. Assign someone to unresolved items. Measure completion of reviews, not just the number of searches run.

Make those triggers part of ordinary practice management. At annual re-engagement, confirm whether the client, beneficial owners, controlling people or services have changed. During payroll, bookkeeping or company-secretarial work, route an unusual new payer, recipient or instruction to the engagement owner rather than silently relying on the original acceptance check. Monitor relevant list changes in a way your team can actually operate; the right interval depends on the firm’s exposure and procedures, not an arbitrary universal number of days.

A small firm can keep the control simple: one named reviewer for routine results, a senior escalation contact, a shared status for open questions and a periodic sample of completed files. Sample difficult cases as well as no-match searches. Ask whether someone outside the original team can identify the parties checked, the source available at the time, the reasoning used to close a possible match, and any separate service or ownership decision. Fix gaps in the template and training when that reconstruction fails.

• Save the searched names, identifiers, sources, timestamps and result references.
• Record the reviewer, supporting evidence, rationale and outstanding questions.
• Keep escalation and reporting decisions with the engagement record, with appropriate access controls.
• Export evidence into your retention process instead of assuming a screening provider is your permanent archive.