Guide · Checklist
Client Onboarding Checklist for Professional Firms
Most professional firms build their client onboarding checklist by memory, adding a step whenever something got missed last time. This is the same checklist written down properly once: the items a typical onboarding needs to cover, in a sensible order, with a short note on how it varies for an accountant, a lawyer, a broker or a clinic.
- Seven steps, from engagement terms to record keeping
- The order matters as much as the list itself
- A short variation note per profession at the end
Engagement terms and scope
Before anything else, the client needs to agree what the firm will actually do for them and on what terms, fees, scope, cancellation, liability. This is usually the engagement letter or terms of service, and it belongs at or near the start of the process, since everything that follows, identity checks, document collection, is being done under an engagement the client has agreed to, not before it. Skipping ahead to collect documents before terms are agreed is a common shortcut that creates awkward conversations later if the client disputes what was agreed.
Identity: who is the client, actually
Confirm the client is who they say they are, with a document check at minimum, and a biometric or database verification step where the firm's risk policy or an AML obligation calls for it. For an individual client this is usually straightforward: a government ID and, where needed, a matching photo. For a business client, this step actually covers the individuals representing the company, the directors and signatories, not only the company's registered name, since a verified company with an unverified signatory has confirmed very little about who is actually agreeing to anything.
Company data, if the client is a business
For a business client, pull the company's registered details from an official source, its registration number, status and registered address, rather than accepting whatever the client typed into a form. A registry lookup also confirms the company is actually active and not dissolved or struck off, which a form field alone cannot show. This step feeds directly into the documents that follow, since a contract naming a company incorrectly or citing an outdated registration number is a real, if avoidable, problem later.
Beneficial owners, for company clients
Identify the individuals who own or control the company above the relevant ownership threshold, or through other means such as board control, and record who they are as part of the same file. This step is easy to skip because it feels redundant once the company itself is verified, but a verified company with an undeclared owner is exactly the gap AML rules are designed to close, and it is the step most likely to be missing when a file is later reviewed.
Risk assessment and screening
Where the firm's obligations or its own risk policy call for it, screen the client and any beneficial owners against sanctions, politically-exposed-person and criminal watchlists, and form a basic risk view of the relationship, low, standard or enhanced. This step should happen before or during onboarding, not as a periodic batch check run separately months later, since the point of screening is to catch a problem before the relationship starts, not to discover one after the fact. A clear case passes straight through; anything flagged should wait for a reviewer rather than continuing on its own.
Consents, documents and signatures
Collect the specific consents the engagement actually needs, a data-protection notice acknowledgement, a power of attorney for a tax or regulatory portal, any document-specific waiver, alongside the documents themselves, and close the process with a signature that covers the whole pack rather than one document at a time. This is the step clients experience as the most visible part of onboarding, so it is worth making it a single, unhurried action at the end rather than a scattered series of separate emails and attachments.
Delivery and record keeping
Once the client has finished, the structured data and the signed pack need to land somewhere your firm actually uses, a practice management system, a CRM, or a case file, by webhook, REST or email rather than sitting in an inbox waiting to be manually filed. Alongside delivery, keep the record for however long your applicable rules require, an AML record-keeping period if one applies, or your own file-retention policy otherwise, and note that period somewhere your firm can point to later.
How this varies by profession
An accountant's checklist adds a UBO declaration and an AML client-acceptance questionnaire ahead of the engagement letter. A law firm often adds a conflict-of-interest check before terms are agreed at all. A real-estate agency runs the beneficial-owner and screening steps on both sides of a transaction, buyer and seller, rather than one client alone. A clinic typically drops the beneficial-owner and screening steps entirely, since AML rules do not usually apply, and instead adds a health-history consent and any specific medical intake form in their place. The order stays the same across professions; which steps are switched on changes.
In Braigest
This checklist, running as one link instead of nine separate steps
Engagement terms, identity, company data, beneficial owners, screening, consents and signature all run in one onboarding flow, delivered to your systems automatically, starting on Solo at €29 a month.
Frequently asked questions
What is the right order for a client onboarding checklist?
Engagement terms first, then identity and company data, beneficial owners, risk screening, consents and signatures, and finally delivery and record keeping. Terms belong first because everything else happens under an agreed engagement.
Do all professions need the same onboarding checklist?
The order stays similar, but which steps are switched on varies: accountants and lawyers typically add AML and beneficial-owner steps that a clinic or a broker with no AML duty would drop.
Which step is most commonly skipped in practice?
Beneficial-owner identification for company clients. It is easy to treat a verified company as sufficient, which leaves exactly the gap AML rules are meant to close for firms with that duty.
Should risk screening happen before or after signing?
Before, ideally as part of the same intake, so a flagged case reaches a reviewer before the relationship is confirmed rather than after a contract is already signed and filed.
Explore more of the platform
Ready to fix your onboarding?
See the whole flow in a 30-minute call, or explore the full Braigest platform.