Customer due diligence for Finnish accounting firms: 8 KYC steps

Customer due diligence, often called KYC (Know Your Customer), starts before the first engagement and continues throughout the client relationship. An accounting firm needs to understand who its client is, who ultimately controls the business and what activity to expect.

Providers of bookkeeping services on assignment fall within the scope of Finland’s Anti-Money Laundering Act 444/2017. Before individual client checks, prepare your firm’s risk assessment, assign responsibilities and check registration obligations. These matters are covered in chapter 1, section 2; chapter 2, section 3; chapter 5; and chapter 9, section 1.

The eight steps below provide a practical structure for business-client checks. Adjust the extent of enquiries to the client and the risk. The firm must be able to demonstrate its own decision and reasoning even when software supports the checks. Finnish legislation links below lead to the Finnish statutory text.

1. Collect and verify the client’s basic details

Request the company’s legal name, business ID, address, registered domicile and industry. Verify them against current records such as YTJ and the Trade Register. Also collect the legally required details of board members or the equivalent governing body. For a sole trader, identify the entrepreneur personally.

Record in practice: the register source, date, reviewer and differences from information supplied by the client. Resolve discrepancies before acceptance.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 3, sections 2–3.

2. Verify the representative’s identity and authority

Identify the person acting for the client and verify their identity using a reliable method, such as a valid identity document or strong electronic identification. Check their right to represent the company against the Trade Register or a power of attorney. Record the verification method, required identification details and check date.

Record in practice: who is acting, the basis of their authority and how their identity was verified. For remote onboarding, also address the statutory requirements for remote identification.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 3, sections 2–3 and 11.

3. Establish the ownership chain and beneficial owners

Request an ownership and control structure down to natural persons. Identify ownership or voting rights above 25 per cent and other forms of effective control. Compare the client’s explanation with beneficial ownership records and resolve discrepancies. Record identifying details and the basis of control. If no such owners exist or can be identified, follow the statutory senior-management procedure and document your enquiries.

Record in practice: an ownership or control chart, beneficial-owner details and the enquiries performed. Do not rely solely on a register entry. PRH’s beneficial ownership guidance also explains indirect control.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 1, section 5, and chapter 3, section 6.

4. Understand the business and money flows

Ask what the business sells, to whom and in which countries. Record the purpose of the service, expected turnover, payment volumes, cash use and foreign connections. Establish the origin of funds to the extent required by the risk and circumstances. This gives you a baseline for assessing later exceptions.

Record in practice: the client’s explanation of its business and expected payments. For example, frequent payments from a domestic consultancy to private individuals abroad call for an explanation of their background.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 3, section 4.

5. Check PEP status and sanctions risks

Use risk-based procedures to establish political exposure of the client and beneficial owners, including relevant family members and close associates. Carry out sanctions and freezing-order checks under your separate procedure and investigate potential matches. PEP status requires enhanced due diligence; it does not itself mean a sanction or a ban on the relationship.

Record in practice: who was checked, sources, date, results and how potential matches were resolved. Use additional identifiers to assess a name match. Compliance with sanctions obligations is required even for a low-risk client.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 3, sections 13 and 16.

6. Document risk and any additional enquiries

Assess industry, ownership, countries, services and delivery channels against your firm’s risk assessment. Explain the risk rating and planned checks. Where legislation or higher risk requires enhanced due diligence, obtain further evidence and any required management approval before starting. A PEP relationship also requires enquiries into the source of funds and wealth.

Record in practice: the reasoned risk rating, outstanding evidence, responsible person and conditions for acceptance. Low risk may permit simplified due diligence, but ongoing monitoring still applies.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 2, section 3, and chapter 3, sections 1, 8, 10 and 13.

7. Record the acceptance decision

Name the approver and record the decision, reasons and date. Do not start a relationship if you cannot meet statutory due diligence requirements. Consider whether a suspicious transaction report is needed. A green status in software is not an acceptance decision on its own.

Record in practice: the decision, approver, date, any conditions and the next review. Where the statutory conditions are met, report a suspicious transaction to the Financial Intelligence Unit without delay. Do not disclose the report to the client.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 3, section 1, and chapter 4, sections 1 and 4.

8. Plan monitoring and retain the evidence

Set a review frequency based on risk and update information when ownership, representatives or activity change. Compare transactions with the business you understand and investigate exceptions. Store due diligence records and evidence securely, generally for five years after a permanent client relationship ends. Restrict access to those who need it.

Record in practice: the monitoring owner, review frequency and changes that trigger updates. Explain personal-data processing to the client, restrict access and define deletion when retention periods expire.

Legal provisions: Finnish Anti-Money Laundering Act, chapter 3, sections 3–4.

What belongs in a client’s KYC file?

Keep basic details and register sources, representative verification, beneficial ownership evidence, the business description, PEP and sanctions checks, risk assessment, acceptance and monitoring records together. Record who performed each check and when. This is a practical filing structure; chapter 3, section 3 of the Anti-Money Laundering Act sets out the precise statutory information requirements.

Information and documents obtained to meet suspicious transaction reporting obligations must be kept separate from the ordinary client register. Chapter 4, sections 3–4 contain specific rules on their retention and confidentiality.

Relevant legislation and official guidance

• Anti-Money Laundering Act 444/2017: customer due diligence, risk assessment, monitoring, reporting and record retention.
• Act 659/1967 on fulfilling certain obligations arising from Finland’s UN and EU membership and Act 325/2013 on freezing funds to combat terrorism: national sanctions and freezing provisions. Check applicable EU sanctions regulations separately; a name-list search does not cover every restriction.
• EU General Data Protection Regulation 2016/679: in particular, articles 5, 6, 13–14 and 32 cover data minimisation, lawful basis, information duties and security.
• PRH: who is a beneficial owner? (Finnish): practical guidance on ownership and control.

For more on sanctions screening, read Sanctions list checks for accounting firms. If you are starting a practice, return to the accounting firm founding guide.