The short answer
For a two to ten person practice, a dedicated AML tool like Thirdfort, SmartSearch or ComplyCube earns its keep once you're onboarding clients often enough that per-check identity verification genuinely saves time over a manual process. If new clients arrive only occasionally, automating the request, chase and filing around a manual check, rather than buying a tool for it, usually works out simpler and cheaper. Either way, the actual due diligence decision still needs a person to make it. What's worth automating is everything around that decision: asking for the right documents, chasing when they don't arrive, and keeping a clear, dated record of what happened.
Why CDD can't be skipped when you're busy
Client due diligence isn't paperwork you do because it looks professional, it's a legal requirement under the Money Laundering Regulations before a UK accountancy practice takes on a new client, and skipping or rushing it to save time during a busy week creates real regulatory exposure, not just an administrative gap. The pressure to skip it tends to show up exactly when a practice is busiest, which is also when the temptation to say "we'll sort the paperwork properly later" is strongest. Building the check into the first step of onboarding, before any chargeable work starts, rather than treating it as something to catch up on, is the only version of this that actually holds up.
What you have to capture and keep
Broadly, a compliant CDD process needs to:
- verify the client's identity against an official document
- understand the source of funds and the nature of the relationship
- assess and record the client's money laundering risk
- keep the records for five years from when the relationship ends or the transaction completes
- review the file periodically, not only when the client is first onboarded
This is a general summary, not legal advice, and the detail changes depending on your supervisory body. Check the current position on gov.uk and with your own supervisor (ICAEW, ACCA, AAT or equivalent) before relying on it, particularly around retention and risk-rating criteria, since these do get updated.
Thirdfort, SmartSearch and ComplyCube for small firms
All three do the core job: verifying identity documents, checking against sanctions and PEP lists, and giving you a record to file. Where they differ is more about fit than features.
| Tool | Tends to suit | Worth knowing |
|---|---|---|
| Thirdfort | Practices wanting a client-facing app experience for ID checks | Originally built for property transactions, now used more widely |
| SmartSearch | Practices wanting one system across AML, ID and company checks | Often chosen by firms already using it for company searches |
| ComplyCube | Practices wanting API-level flexibility or multiple check types in one place | More configurable, which can mean more setup before it's simple to use |
Check current pricing and exact feature sets directly on each vendor's own site before deciding, since per-check and subscription pricing changes and varies by volume.
When a dedicated AML tool is overkill
If you're onboarding a handful of new clients a month, a dedicated per-check tool can cost more in subscription fees than it saves in time, and the fee itself becomes another thing to justify. In that case, a manual check against an official document, done properly and recorded consistently, is entirely compliant. What makes the difference isn't the tool, it's whether the request, the chase and the record keep happening the same way every time regardless of who's doing the onboarding that week. A small practice often gets further by automating that consistency than by buying a tool it only half uses.
Automating the request, chase and audit trail
Whether or not you use a per-check tool, the admin around it automates well. A new client triggers an automatic request for the right documents, worded consistently every time. If nothing arrives within a set number of days, an automatic reminder goes out without anyone needing to remember to chase it. Once the documents land, they're logged against the client record with a timestamp, so the audit trail showing what was requested and when builds itself, rather than depending on an inbox search months later when a supervisor asks for evidence. The order the rest of onboarding needs to happen in usually slots in right alongside this.
What a human still has to decide
Automation should never be making the actual compliance decision. A person still needs to look at the identity document and judge whether it's genuinely satisfactory, still needs to assess the money laundering risk rather than accepting a default score, and still needs to decide whether anything about the client looks unusual enough to escalate. The point of automating the surrounding admin is freeing up that person's time to make the judgement call properly, rather than spending it chasing a document that should have arrived a week ago.
When to get help, and what we'd do
Document and form automation is a guide price from £500 and usually live within one to three weeks, covering the identity request itself and the record it generates. A single automated reminder for outstanding documents, if that's the only piece you need to start with, is a guide price from £350. We'd scope this against whichever tool, or manual process, you're already running rather than replacing it, since the aim is removing the chasing and retyping, not adding a new system to learn. These are guide prices for a typical setup, with the fixed quote following a free 30-minute call. For the wider picture of why practice admin piles up in the first place, see our pillar page on admin eating your evenings.
Frequently asked questions
Do we legally need a dedicated AML tool like Thirdfort or SmartSearch?
No. The law requires proper client due diligence, not a particular piece of software. A manual process, done consistently and recorded properly, is entirely compliant. A tool just makes the identity-checking step faster at higher volumes.
How long do we actually need to keep AML records for?
Generally five years from when the business relationship ends or the transaction completes, though you should confirm the current position with your supervisory body, since retention requirements can be updated.
Can automation make the actual AML decision for us?
No, and it shouldn't try to. Automation handles the request, the chase and the record keeping. The decision on whether identity and source of funds checks are satisfactory still needs a person to make and sign off.
Is Thirdfort, SmartSearch or ComplyCube the right choice for a small practice?
It depends more on your volume and existing systems than on which tool is "best". A practice onboarding clients regularly tends to get more value from a dedicated tool than one onboarding only occasionally, where automating the manual process usually makes more sense.
What happens if a client never sends the documents we've requested?
A good automated chase handles the reminders, but at some point a person needs to decide whether to escalate, delay the engagement, or decline the client. The system's job is making sure that decision happens on schedule, not quietly slipping for weeks.