Client onboarding checklist for accounting firms: from yes to the first job

The client onboarding checklist, step by step

Run these steps in this order for every new client, and for every new entity an existing client adds. Steps 2 to 5 can overlap. Nobody in the firm links to a tax account or opens a Xero file until steps 2 and 3 are done.

1. 01

   Accept the client and agree the scope.

   The partner checks for conflicts and decides which entities and services the firm will take on. Ask here whether any of the work is a regulated anti-money laundering (AML) service in your country. Owner: partner.

2. 02

   Send the engagement letter for signature.

   Name every entity it covers, the services, the fees and who is responsible for what. Get it signed before the work starts. Owner: practice manager.

3. 03

   Verify identity and authority.

   Check each individual and confirm each entity exists. Confirm the authority of anyone who signs or gives instructions for an entity. Record what you checked, when and how. Owner: client services.

4. 04

   Write to the previous accountant.

   With the client’s written consent, ask whether there’s anything you should know before you accept, and request the records you’ll need. Owner: partner.

5. 05

   Get authority to act with the tax office.

   The client nominates or authorises the firm for each entity and tax. You then add them to your client list, linking only at the accounts you’re engaged for. Owner: client, then client services.

6. 06

   Collect last year’s information and access.

   Ask for the prior returns and financial statements, working papers, loan agreements, the trust deed and constitution. Ask the client to invite the firm into each Xero organisation. Owner: manager.

7. 07

   Set up the client group and its filing.

   Create each entity once, record how they relate, and give the group one folder structure in your document system. Owner: manager.

8. 08

   Create the first recurring job with an owner.

   Set up the next BAS, VAT return, payroll or year-end job with an owner, a reviewer and a due date. If someone else will run the client from here, walk them through the file. Owner: manager.

Why the order of onboarding steps matters

Three sequence errors are worth designing out of the checklist.

• Access before identity. An agent link or a Xero invitation gives your staff a client’s tax records. The ATO’s linking checklist puts proof of identity before you add a client to your list. The IRS requires you to authenticate a taxpayer you don’t know who signs an authorisation remotely.
• Work before the letter. A job started on a handshake has no agreed scope, and a scope dispute is hardest to settle once the work is done. Australia’s APES 305 asks for the terms to be documented, preferably before the engagement starts.
• The job before the group. A recurring job set up against the person when it belongs to the trust is how a lodgment gets missed. Set the group up first, then create each job against the entity that owns the obligation.

A worked example: onboarding the Bull family group

Ryan Bull is the shareholder of Bull Antics Pty Ltd, and the group includes the Crazy Bull Family Trust. On 1 October 2026 he agreed to move all three to your firm from another practice. A partner, a practice manager, a client services officer and a manager share the onboarding.

Two items in the prior-year request matter more than the rest for this group. Bull Antics has lent money to Ryan, so the 2026–27 minimum yearly repayment needs a schedule well before June; our Division 7A guide covers the calculation. The company and the trust also lend to each other, so the opening balances need reconciling across both Xero files before the first set of accounts.

The onboarding checks that differ by country

Four checks change between countries: who sets the identity standard, whether AML rules apply, how the tax office grants access, and what the professional codes say about the previous accountant.

Australia: TPB proof of identity, AUSTRAC, APES 305 and ATO agent linking

The TPB’s proof of identity (POI) requirements are in TPB(GS) 42/2022, last updated on 20 July 2026. The Tax Agent Services Act has no POI section, but skipping the checks can breach Code item 9 (reasonable care) and other provisions. The TPB requires the checks before you provide tax agent or BAS services, and on an ongoing basis.

• Individuals: full name and either residential address or date of birth. Sight an original or certified primary photo ID, or a primary non-photo ID plus a secondary document.
• Entities: the name and ABN or ACN, and evidence the entity exists, such as an ASIC extract or the trust deed. Add evidence of the representative’s authority, such as an ASIC record naming them as an officeholder, the trust deed or board minutes.
• Related clients: check each one. The TPB’s examples include a company and its directors, and a trust’s trustees and beneficiaries.
• The record: the date and time, who checked, which documents were sighted and how, including whether it was by video. Keep it for at least five years after the engagement ends. The TPB doesn’t require copies of the documents, and says keeping them may increase the risk of identity theft.

AUSTRAC’s test is whether your work directly advances the transaction. Its own example is tax advice on the implications of selling a company, which isn’t a designated service. Acting for the client once there’s one buyer is. Restructuring means changing an entity’s legal form, such as a merger or demerger. Client money counts too: AUSTRAC gives the example of a practice that receives a client’s funds and pays their bills, which is likely to be an item 3 service.

The TPB says POI steps that meet AUSTRAC’s requirements will generally meet its own, so one identity check can serve both.

Engagement letters. APES 305 requires you to document and communicate the terms of engagement, preferably before the work starts. The document needn’t be a letter. If you use outsourced services, it must say who provides them, where and what they do. For cloud services that aren’t outsourcing, APES 305 says you should tell the client the provider, where it is and how their information is stored. For a recurring engagement, consider reissuing the letter after a change of ownership or a big change in the client’s business.

ATO agent linking. Every entity with an ABN, except a sole trader, must nominate you in Online services for business before you can add it to your client list. You can’t do the nomination for them. You then have 28 days to add the client. The ATO sends you no notification, so run the Client nominations report. Link only at the account you’re engaged for, because adding yourself at the activity statement account can remove the client’s existing BAS agent.

For individuals and sole traders, the ATO plans agent-initiated linking, with a pilot from March 2027 and full deployment in November 2027. Until then, the current process for adding individuals stays the same.

United Kingdom: MLR customer due diligence, professional enquiry and HMRC authorisation

The Money Laundering Regulations 2017 cover external accountants and tax advisers, so every new UK client needs customer due diligence (CDD). Regulation 27 requires it when you establish a business relationship. Regulation 30 says to verify identity before the relationship starts. You can finish during set-up only where that’s needed to avoid interrupting normal business and the risk is low.

Your AML supervisor is your professional body, such as ICAEW or ACCA. If no professional body supervises you, you must register with HMRC. The government has decided the FCA will become the single supervisor for professional services. That needs primary legislation, and your current supervisor stays responsible until it’s in force.

The previous accountant. ICAEW calls this step professional enquiry, not clearance, because the previous accountant can’t give or refuse permission. Get the client’s written consent, ask them to authorise the existing accountant to reply, then write. If no reply comes, chase. After a reasonable time, which ICAEW puts at possibly 14 to 30 days, write by tracked delivery saying you intend to accept unless they reply by a set date. ICAEW says a deadline under two weeks is unlikely to be reasonable. The ICAEW Code also says you shall not ask whether they’ve reported money laundering suspicions.

HMRC authorisation. Register as a tax adviser through an HMRC agent services account (the requirement is being phased in), then get authority for each tax. VAT and Making Tax Digital for Income Tax use the digital handshake. Self Assessment, Corporation Tax and PAYE use Online Agent Authorisation or form 64-8. Never use the client’s own HMRC sign-in.

United States: IRS Forms 8821 and 2848, and Circular 230

US accounting firms have no general AML customer due diligence regime like Australia’s, the UK’s or New Zealand’s. The Bank Secrecy Act’s list of financial institutions doesn’t include accountants or tax preparers. Identity still matters. The IRS requires you to authenticate a taxpayer you don’t know who signs an authorisation electronically in a remote transaction. It recommends the same check whenever you don’t know the taxpayer, and for a business, confirming that the person signing has authority.

• Form 8821 lets the firm receive and inspect the client’s confidential information for the tax types and periods listed. It doesn’t let you represent them.
• Form 2848 lets an individual eligible to practise before the IRS represent the client, and includes access to their information.
• File either form online, by fax or by mail. Tax Pro Account processes individual authorisations in real time.

Circular 230. If your people practise before the IRS, two sections bear on onboarding. Section 10.28 requires a practitioner to return, promptly and at the client’s request, the records the client needs for their federal tax obligations, even during a fee dispute (subject to state law). Section 10.29 applies when representing one client conflicts with another. Each affected client must give informed consent, confirmed in writing within 30 days, and you keep the consents for 36 months after the representation ends.

New Zealand: AML/CFT captured activities and IRD client linking

Under the AML/CFT Act 2009, an accounting practice is a reporting entity only for captured activities carried out in the ordinary course of business. Examples are forming companies or trusts, acting as a trustee or nominee director, providing a registered office that isn’t only ancillary to other work, and managing client funds. The Department of Internal Affairs (DIA) supervises accountants.

DIA reads managing client funds widely. Its guidance says it includes transferring a client’s funds within the IRD system, though most tax transfers are partly exempt. A bookkeeper who pays a client’s bills or payroll from the client’s bank account may be captured too.

For a captured activity, standard CDD covers the customer, each beneficial owner and anyone acting for the customer. For each, collect the name, date of birth, address or registered office and relationship to the customer. You also record the nature and purpose of the business relationship. The Identity Verification Code of Practice 2026 is a safe harbour for verifying names and dates of birth, not a requirement.

IRD linking. Inland Revenue needs signed, written authority from the client before you link to their account in myIR, under Intermediary centre and then Client maintenance. Tax agents get access as soon as they’re linked. A client can’t have two intermediaries of the same type linked to one account, so agree with the client when the previous firm’s link ends.

Common client onboarding mistakes reviewers catch

• Verifying the person, not the group. Ryan’s licence verifies Ryan. The company and the trust each need evidence that they exist and that he can act for them.
• Keeping a scan of every licence. The TPB doesn’t ask for copies, and says keeping them may increase the risk of identity theft. Record what was sighted. Where an AML program applies, follow its record-keeping rules.
• Deciding AML once, at the start. In Australia and New Zealand the trigger is the service. Ask the question at acceptance, and again whenever a client wants a new company or trust, a sale, or the firm to handle their money.
• Letting the 28 days run out. The ATO doesn’t tell you a nomination has arrived. Diary a follow-up, or run the nominations report each week.
• A first job owned by “the team”. If nobody owns it, nobody chases the client for the bank statements.

How AccountKit handles client onboarding

AccountKit doesn’t verify identity, run AML checks or link you at the tax office. Use your identity provider or your own checklist for those, and keep the record. AccountKit works alongside Xero and Xero Practice Manager on the rest.

• The checklist. Keep your onboarding procedure in the Knowledge Centre and link it from the tasks in your workflow, so every new client starts with the same steps and owners.
• The client group. Bring client records in from Xero Practice Manager and build the group’s structure diagram from them. Client details sync both ways with XPM; AccountKit jobs stay in AccountKit. Our guide to the family group structure diagram covers what each card should record.
• The engagement letter. Send it through FuseSign or Annature from AccountKit’s document workflow and track the signing. The signed copy is filed back to its original location.
• The first recurring job. Start it from a workflow template against the right entity, with an owner, a due date and a repeat cycle.