A law firm KYC and AML onboarding checklist commonly includes: verifying the client's identity, confirming their address, identifying beneficial owners of any company or trust, understanding the source of funds and, where risk is higher, source of wealth, screening against sanctions lists, checking whether the client is a politically exposed person, assigning a risk rating, applying enhanced due diligence for high-risk clients, keeping records, and monitoring the relationship over time.
Which of these steps are mandatory, and when, depends on your jurisdiction and the type of work. Many regimes apply AML duties to lawyers only for certain services, such as handling client money, property transactions or company formation. This guide is general information, not legal advice; check your regulator's current rules.
LawAOS records a KYC status and manual risk rating per client, holds a checklist for the core items, screens names against the US Treasury OFAC SDN list, and can block approval of a High-risk client until enhanced due diligence is complete.
- Identity: collect and verify government-issued identification for individuals.
- Address: confirm residential or registered address with an acceptable document.
- Entities: record the legal name, registration number and registered office.
- Beneficial ownership: identify the individuals who own or control the entity above the threshold your rules set.
- Purpose: record the nature and purpose of the matter and the expected transactions.
- Source of funds: record where the money for this transaction comes from.
- Source of wealth: for higher-risk clients, record how the client built their overall wealth.
- Sanctions: screen the client and beneficial owners against the lists your jurisdiction requires.
- Politically exposed persons: check PEP status for the client, family members and close associates.
- Risk rating: assign Low, Medium or High with the reasons written down.
- Enhanced due diligence: complete extra checks and senior approval for high-risk clients.
- Records: keep copies and the reasoning for the period your rules require.
- Ongoing monitoring: rescreen and refresh documents when circumstances change or on a schedule.
- Chasing documents.
- Clients send partial documents by email over several days. Keep one checklist per client so everyone can see what is still missing.
- Complex ownership.
- Layered companies and trusts make beneficial owners hard to find. Record the chain you traced and the evidence for each link.
- Name matches.
- Fuzzy screening produces false positives. Record why a potential match was discounted, with the identifying details you compared.
- Work started before checks finished.
- Pressure to start work leads to matters opening before due diligence is complete. A gate that blocks approval of high-risk clients until EDD is done removes the temptation.
Check conflicts first.
Run a conflict search on the client and related parties. Results are Clear, Potential or Flagged, and a failed search is recorded as could not check, never as a clearance.
See the moduleOpen the client's KYC record.
Set the KYC status (Not Started, Pending, Verified or Expired) and work through the checklist: ID document, proof of address, source of wealth, PEP screening, beneficial ownership and sanctions check.
See the moduleRead the ID with AI, then confirm.
Upload the ID document and let the AI read the fields off it, citing the line it used. A person confirms each field before it is saved.
See the moduleScreen against OFAC.
Screen the client's name, including aliases, with fuzzy matching against the US Treasury OFAC SDN list. An administrator refreshes the list with a button.
See the moduleRate the risk and apply EDD.
Set the risk rating to Low, Medium or High. With the enhanced due diligence gate on, a High-risk client cannot be approved until EDD is complete.
See the moduleAccept the client and open the matter.
With guided accept switched on, the intake flow runs conflict check, AML screen, engagement letter, e-signature and optional trust retainer before the matter opens.
See the module
Stated plainly, so you can decide before you sign up rather than after.
- LawAOS does not verify identity through a third-party provider; it records the checks your staff perform.
- Sanctions screening covers the US Treasury OFAC SDN list only; UK HMT, UN and EU lists are not included.
- There is no PEP or adverse-media data source; PEP screening is a checklist item your staff complete.
- There is no ongoing monitoring or automatic rescreening, no stored beneficial-ownership trees, and no automatic risk scoring; the risk rating is set by a person.
- Guided accept is off by default and must be switched on in settings.
Anything the list leaves open, our team answers directly.