The payroll bureau client risk assessment template is built from HMRC's risk assessment for accountancy service providers, which lists the payroll risks HMRC expects firms to consider. It's scored so that a typical longstanding client lands at Low or Medium, and only genuine red flags push a client to High.
This article explains how the scoring works and what to check for each question. You can keep it open alongside the assessment while you complete it.
This is your risk assessment. The questions and scores are a starting point, but you know your clients, so the final judgement and any changes to the scores are yours. HMRC doesn't set a scoring method. What it looks for is that you've considered the right risks and can explain your conclusion.
Answer from what you know and can reasonably check. You aren't expected to see parts of the client's business that payroll doesn't touch. Question 5.1 records that limitation.
If you're unsure, find out first. If you can't find out, answer Yes and note why. A cautious Yes is easier to defend than a No you can't back up.
Add a short note to every Yes. Say what you saw and what you did about it.
A question that doesn't apply is a No. For example, 1.8 is No for any client that isn't a trust.
Re-run the assessment at the review date you set for the client, and whenever something changes: new owners, trustees or contacts, a big change in headcount, or a new type of request.
Some answers need action, not just a score. Incomplete CDD (1.7) means don't start or continue the work until it's done. A sanctions match (1.3), signs of exploitation (4.5, 5.4) or anything that makes you suspicious means pause, record it, and speak to your MLRO about whether to make a Suspicious Activity Report (SAR) to the NCA.
"HMRC" numbers in brackets refer to the risks in HMRC's risk assessment. "MLR" means the Money Laundering Regulations 2017.
Every question is phrased so that Yes means more risk. Each Yes adds its score and No adds nothing. Firmcheck totals the Yes scores and suggests a risk level:
0 to 39, Low: standard CDD, normal review cycle
40 to 84, Normal / Medium: standard CDD, keep an eye on the factors that scored
85 and above, High: enhanced due diligence (EDD), more frequent review, and consider whether to continue
The questions use four weights:
100: a red flag. The law requires EDD or stopping work, or HMRC treats it as a strong sign of fraud or exploitation. One Yes makes the client High.
40: a recognised risk factor. One Yes makes the client Medium. Two stay Medium (80), and any other Yes on top makes the client High.
20: a minor factor that matters mainly in combination. Two together make Medium.
0: a limitation that applies to almost every client. It's recorded so your file shows you considered it, but never changes the rating.
A score never replaces judgement. You can always choose a different level with a justification, and a confirmed sanctions match means stop work and report, whatever the total says. See Risk scoring for how scoring works in the app.
1.1 Owners, directors, trustees or controllers could not be confirmed, or the ownership structure is unusually complex (Yes = 100)
Check Companies House, the Charity Commission register, or the trust deed and Trust Registration Service (TRS) proof. Yes if you can't trace ownership or control back to real people, there are layers of companies or nominees with no obvious reason, or a trust that should be on the TRS isn't. (HMRC 10)
1.2 The client has an owner or parent company based outside the UK (Yes = 20)
Yes for any owner or parent registered outside the UK, including the Channel Islands and Isle of Man. (HMRC 3)
1.3 Screening has returned a PEP, sanctions or adverse media result that has not been ruled out (Yes = 100)
Yes if any hit is confirmed, or not yet ruled out using date of birth, nationality or address. For a possible sanctions match, pause work and follow the OFSI procedure. Ignore adverse media that is minor or about someone else. (MLR 35)
1.4 The client has been evasive, secretive or reluctant to provide CDD, ownership or payroll supporting information (Yes = 100)
Yes if the client won't provide ID, ownership or trust details, NI numbers or other support for payroll instructions, or gives explanations that don't add up. Slow replies from a busy client are a No. (HMRC 20, 25)
1.5 Ownership, directors or trustees have changed frequently, or in a way that doesn't fit the client (Yes = 40)
Compare Companies House or the Charity Commission with your last review. Yes if there's been more than one change in a short period, or a new owner has no apparent link to the client. A single, explained change is a No, but refresh your CDD and screening. (HMRC 11)
1.6 The client is dormant, or appears to be a shell company with no real trading activity (Yes = 100)
Check Companies House. Yes if accounts are filed as dormant, or there's no sign of premises, trading or income to support the payroll. (HMRC 7, 10)
1.7 We have not yet verified the identity of the beneficial owners or controllers, or of the person instructing us and their authority to act (Yes = 100)
Yes if any ID check is outstanding, failed or out of date, or a new contact's authority hasn't been confirmed. Where no one owns over 25%, the senior managing official counts as the beneficial owner. Don't process work until this is resolved, then re-run the assessment. (MLR 28, 31)
1.8 The client is a non-charitable trust, or a trust whose settlor or trustee is a company (Yes = 40)
Yes for private or family trusts, and any trust with a corporate settlor or trustee. A charitable trust registered with the Charity Commission, or one set up by a public body, is a No.
1.9 The client is an LLP, partnership or chambers with a large or frequently changing membership, and members aren't regulated professionals (Yes = 20)
Yes if membership is large or changes often and you can't check members on a professional register. Medical LLPs, surgeries, dental practices and barristers' chambers whose members are on the GMC, GDC or Bar Standards Board registers are usually a No.
2.1 The client is a cash-intensive business or deals in high-value goods (Yes = 40)
Yes if most of the client's income is cash (cafés, takeaways, retail, car washes), or it deals in jewellery, precious metals, metal trading, vehicles or art. (HMRC 9)
2.2 The client works in a labour-intensive or low-paid sector, or relies heavily on government grants or employment support schemes (Yes = 40)
Yes for cleaning, construction, care, childcare, hospitality, car washes, nail bars, agriculture, warehousing and recruitment. Also Yes if grants or funded schemes pay a large share of the wage bill. (HMRC 18, 28)
2.3 The client's activities carry terrorist or proliferation financing exposure (Yes = 40)
Yes if products could be sold to defence or surveillance customers or need export licences, or the client is a charity that works or sends money abroad. The Charity Commission register shows where a charity operates. (MLR 18A)
2.4 The client's business or finances have changed significantly without a clear reason (Yes = 40)
Yes if the client has moved into new work, locations or customers without a clear reason, pays wages or HMRC late, mentions cash-flow problems, or has a new investor or buyer that seems unusual. (HMRC 13, 16)
3.1 The client, an owner or a controller has material links to a high-risk third country, a country with weak AML controls or a sanctioned country (Yes = 100)
Check the countries against HMRC's high-risk third countries notice and UK sanctions. Overseas links to countries not on these lists are covered by 1.2. (MLR 33(1)(b), HMRC 2, 3)
4.1 The client has asked for something outside our service (Yes = 40)
For example non-UK payroll or bank accounts, foreign-currency payments, personal tax returns, bookkeeping, tax advice, or handling money. Yes if the client has asked for any of these, even if you declined. (HMRC 4, 14)
4.2 The client has made unusual payroll requests, or pressured us on tax treatment (Yes = 40)
Yes if asked to backdate or rebuild past periods (other than a routine correction this tax year), pay something tax-free, add payments that don't fit the business, make large one-off payments without paperwork, or reduce PAYE or NIC in a way you're not comfortable with. If the client can't explain it, also answer 7.1 Yes. (HMRC 24, 26)
4.3 Headcount, pay or employer costs have changed significantly outside the client's normal pattern (Yes = 40)
Compare with previous periods. Yes for a jump or drop in staff or total pay outside the normal pattern, and ask the client why. If the client can't explain it, also answer 7.1 Yes. (HMRC 13, 25)
4.4 There are concerns about employee identities (Yes = 40)
Yes if starter details or NI numbers are missing, duplicated or invalid, or there are unexplained shared addresses, and the client can't explain why. Consider a SAR if it stays unexplained. (HMRC 27)
4.5 Payroll shows signs of possible worker exploitation (Yes = 100)
Yes if you see pay below National Minimum Wage, everyone paid the same despite different hours, round-sum pay, large accommodation or transport deductions, or too few staff for the business. See the NCA indicators. (HMRC 28)
4.6 The payroll is an umbrella, agency-worker or labour-supply arrangement (Yes = 40)
Yes for umbrella, agency-worker or labour-supply payrolls. (HMRC 29)
4.7 The client limits or prevents our reporting to HMRC, or can't evidence its own submissions (Yes = 100)
Yes if the client wants to submit RTI themselves without showing you, removes you as agent without a clear reason, or HMRC's figures don't match yours and the client can't explain it. (HMRC 27)
5.1 We have no visibility of the client's bank transactions or how wages are actually paid (Yes = 0)
Yes for almost all clients, so it's recorded but not scored. No only if you can see how wages are paid, for example you make the BACS payments or the client sends bank confirmations.
5.2 We make BACS payments on the client's behalf (Yes = 20)
Yes if you submit the BACS file or make wage payments for this client. (HMRC 25)
5.3 Bank details or payroll instructions have come from an unverified or unusual source (Yes = 40)
Yes if bank details changed close to a pay date, several changed at once, or a change didn't come through an authorised contact. Also Yes if instructions came from a new email address or domain, or a new contact wasn't approved by an existing one.
5.4 Wages are paid into, or funded from, shared or third-party accounts without a clear explanation (Yes = 100)
Yes if several employees share an account, wages go to a third party or company account, or you know wages are funded from someone else's account, and there's no clear reason. A married couple's joint account is fine: answer No and note it. (HMRC 25, 28)
6.1 We have not met the client's authorised contact face to face, in person or by video call (Yes = 40)
Yes if you've never met them in person or on video. If you've only met on video, make sure their ID has also been checked electronically and note it. (HMRC 8, MLR 33(6)(b)(iii))
6.2 The client is new, taken on within the last 2 years (Yes = 20)
Yes if taken on within the last 2 years.
6.3 It's unclear how or why the client came to us (Yes = 20)
No for referrals, long-standing clients, and clients who found you through your normal marketing. Yes if you can't see why they came to you.
6.4 There are concerns about the client's other advisers or intermediaries (Yes = 40)
Most clients use a separate accountant, which is normal. Yes if the client changes advisers often or splits services for no sensible reason, instructions come through a third party, or an adviser involved isn't AML supervised. Check HMRC's supervised business register if unsure. (HMRC 5, 6, 12, 19)
7.1 In my overall judgement, does anything else about the client suggest a higher than normal risk? (Yes = 100)
Yes if the client can't explain an unusual request or change (4.2, 4.3), or anything else worries you that no other question covers. Write down why. (MLR 33(1)(f))