AML customer due diligence for accountants in Italy: the steps

#1. Identify the client (art. 19 c. 1 lett. a)

• A valid identity document is required, checked against the verification date: an expired one must be replaced.
• Italian identity cards issued since 2012 expire on the holder's birthday (art. 7 c. 2 D.L. 5/2012).
• The codice fiscale is checked: its check character, and its consistency with birth date, sex, surname and name. For a company, also the partita IVA's check digit.

#2. The beneficial owner (art. 20)

• For a natural person acting for themselves, the beneficial owner is the client.
• For a company, rebuild the chain: each holder's share is nominal over capital; an indirect share is the product along each branch, summed over the branches. Above 25 % makes a beneficial owner.
• If nobody exceeds 25 %, the owner is whoever controls (above 50 % at every step); failing that, the legal representatives.
• A branch that cannot be traced, above 25 %, must be completed with the visura or the share register and the client's declaration.

#3. The client's declaration (art. 22)

The client declares, under their own responsibility, their data, the purpose and nature of the service, the beneficial owner and whether they are a politically exposed person. An unsigned declaration does not count; the declared names are checked against the chain from the visure.

#4. Assess the risk (CNDCEC Regole Tecniche)

The CNDCEC's Regole Tecniche (2025 update) combine two assessments:

• Inherent risk, from the service: for example bookkeeping 3, tax advice 2, extraordinary operations 4. With several services, the highest counts.
• Specific risk, ten factors scored 1 to 4: four on the client (legal form, activity, behaviour, geography) and six on the service (type, method, amount, frequency, reasonableness, destination area).

Effective risk weighs the inherent level at 30 % and the specific level at 70 %. The resulting level — not, slightly, fairly or very significant — sets the measures: simplified for the first two, ordinary for the third, enhanced for the fourth.

Measures are always enhanced with a high-risk third country on the EU list or a politically exposed person (art. 24 c. 5): then the origin of funds must be documented and the beneficial owner's ID obtained.

In the recorded example (a new sole trader, bookkeeping): 30 % × 3 + 70 % × 1 = 1.6, simplified measures.

#5. Cash

Cash of €5,000 or more between different persons is forbidden (art. 49 c. 1). If the payment happens, the professional reports it to the MEF within 30 days (art. 51) and assesses a suspicious-transaction report (art. 35).

#6. Lists and ongoing monitoring

• The names must be checked against the sanctions and asset-freezing lists (EU, UN, MEF).
• Ongoing monitoring (art. 18 c. 1 lett. d) sets the next review: the Regole Tecniche suggest, for example, every three years for simplified measures.
• The file is kept for 10 years (art. 31).

The final assessment is always the professional's (art. 17 c. 3).

#How the agent does it

The AML customer due diligence agent reads the identity document, the visure, the beneficial-owner declaration and the engagement letter (PDF or photo). Tax codes, the ownership chain, the scores and the level are computed by code; the result is a suggestion: the professional decides. It prepares the file in Word and PDF with what is left to complete, the questions to ask the client and the next review. It does not consult PEP or sanctions lists — it lists the names to check — and sends nothing.