News & Insights

When Should a Law Firm Repeat Client Due Diligence?

19 December 2025

At the Regulation and Compliance Office (RACO), we’re frequently asked how often firms are required to repeat Client Due Diligence (CDD) and whether there’s a specific time limit…

Enquire Now

Join our Mailing list

When Should a Law Firm Repeat Client Due Diligence?

At the Regulation and Compliance Office (RACO), we’re frequently asked how often firms are required to repeat Client Due Diligence (CDD) and whether there’s a specific time limit imposed by the regulations.

The answer isn’t straightforward. The Money Laundering Regulations 2017 (MLRs 2017) and accompanying guidance don’t provide a clear-cut timeframe, which means firms need to consider multiple factors to ensure they remain compliant.

We understand the frustration. For clients you’ve known for years, clients who have longstanding relationships with your firm or individual partners, the requirement to repeat CDD can feel like unnecessary administrative burden, particularly when you consider them low risk.

But here’s the reality: as with all AML-related risk assessments, not doing something increases your firm’s risk, whilst taking action to ‘Know Your Clients’ reduces it. Consider this example: if a client brings on a new Business Owner, Officer or Manager (BOOM) who is high risk or domiciled in a high-risk or sanctioned country, your client’s risk profile has fundamentally changed. If you don’t ask the questions, your firm won’t be aware of these developments. And if your client doesn’t volunteer the information and you continue treating them as low risk, you’ve put your firm in breach of the MLRs 2017.

What Does the Guidance Actually Say?

The regulations and guidance state you must “renew and re-evaluate CDD at appropriate intervals (including during the course of a given transaction)”.

It goes on to say:

“You should operate a system of regular review and renewal of CDD and take a risk-based approach to such activity. You should consider reviewing (although not necessarily redoing) the CDD upon each new matter. Where there has been a significant gap between instructions (anything above a year may be considered a significant gap in relation to those clients or transactions assessed as higher-risk), you should consider refreshing the CDD.”

Regulation 27 advises firms to apply or reapply CDD to existing clients on a risk-based approach when the client’s circumstances have changed.

This isn’t a direct instruction to undertake due diligence annually, as some firms do, and it could be argued the guidance is unhelpful in terms of providing specific timeframes.

When Must CDD Be Repeated?

The answer becomes clearer when considering changes in client circumstances. The regulations and guidance advise that CDD should be re-applied when:

There is any indication that the identity of the client or beneficial owner has changed
You handle transactions that are not reasonably consistent with your knowledge of the client
There is any change in the purpose or nature of the relationship
There is any other matter which may affect your assessment of the money laundering or terrorist financing risk concerning the client

The Annual Review Question

Returning to timeframes, whilst there’s no direct instruction to repeat due diligence annually, an indication may be found in amended regulations which provide that CDD must be re-applied when a practice has a legal duty, in the course of a year, to contact a client under the International Tax Compliance Regulations 2015 or to review information relevant to their client risk assessment concerning beneficial ownership information.

It’s not a direct instruction to repeat due diligence annually, but the inference is there.

The important point is this: firms have a requirement to risk assess their clients and ensure their risk profile hasn’t changed. Where risk has increased to high risk, enhanced due diligence must be undertaken.

A year is a reasonable amount of time for someone or a company to change significantly. Therefore, our guidance is to conduct reviews annually as a minimum. Some firms may feel annual reviews are too frequent and wish to extend that period. Others are comfortable with that regularity.

What this comes down to is a question of risk and what level of risk your firm is prepared to accept.

The longer a firm leaves between repeating CDD, the more likely it is that one of the client change triggers noted above has occurred. If you’re not aware of these changes because you haven’t updated your CDD, your firm doesn’t meet the requirements of the regulations.

In practice, we’re seeing most firms move to a 12-month review cycle for CDD.

New Matter Risk Assessments

One element we consider clear is this: when opening a new matter for an existing client, you must undertake a matter risk assessment. This assessment itself will guide whether you need to reapply CDD.

The client and matter risk assessment (CMRA) is a critical checkpoint that shouldn’t be treated as a formality. It’s an opportunity to identify changes in risk profile that might otherwise go unnoticed.

The Challenge for Firms: Capacity and Expertise

The reality many firms face is that CDD requirements fall to fee earners who are already managing full caseloads. They’re expected to conduct due diligence, assess risk, and stay current with regulatory changes whilst also billing hours and delivering legal services.

This creates the exact compliance gaps we discussed in our recent article on source of funds compliance failings. Documents get collected but not properly scrutinised. Risk assessments become tick-box exercises. Enhanced due diligence triggers get missed.

This is precisely why many firms are moving to outsourced solutions.

How RACO’s Due Diligence Service Helps

At RACO, our Due Diligence & Risk Assessment Service provides a seamless, outsourced solution for CDD, enhanced due diligence, and client and matter risk assessments.

The service is designed to enable your fee earners to focus on legal work whilst we ensure compliance with MLR 2017 requirements. We handle:

Initial client due diligence for new clients
Periodic CDD reviews based on your firm’s risk-based approach
Enhanced due diligence when risk factors require it
Client and matter risk assessments for all in-scope matters
Ongoing monitoring to identify when CDD refresh is required
Documentation and audit trails that satisfy regulatory expectations

Our compliance managers understand the nuances of when CDD should be repeated, what triggers require enhanced due diligence, and how to document decisions in a way that demonstrates compliance to regulators.

Importantly, we tailor our approach to your firm’s specific risk profile, practice areas, and client base. A high-street conveyancing practice operates differently from a City firm handling cross-border transactions, and our CDD processes reflect those differences.

Looking Ahead to 2026 and FCA Supervision

With the Financial Conduct Authority (FCA) set to assume AML supervision responsibilities, the importance of robust, demonstrable CDD processes becomes even more critical.

The FCA’s supervisory approach is fundamentally different from professional body supervision. They expect evidence that your CDD processes work in practice, not just policies that look good on paper.

Regular CDD reviews, properly documented risk assessments, and clear audit trails showing when and why decisions were made will be essential.

Firms that have outsourced their CDD to specialists like RACO will be well-positioned for this transition. Our processes are already designed to meet the data-driven, outcome-focused standards the FCA will apply.

Read our comprehensive guide: Preparing Your Law Firm for the FCA’s AML Supervision.

About RACO and Our Services

At the Regulation and Compliance Office, we work with firms and their MLROs, MLCOs, COLPs and COFAs to assist them with the management of risk, compliance and regulation through our comprehensive compliance solutions. We provide individual training, guidance, and ongoing support.

We always provide bespoke, best practice services because we recognise every law firm is different. It’s essential to provide guidance, consultancy, documentation, training and procedures that meet the exact requirements of your firm rather than offering templated solutions.

Our solutions are cost-effective and designed to ensure firms comply with: