Client onboarding checklist for CA firms: KYC, the engagement letter and the first WhatsApp messages

A new client's first week decides how the rest of the year goes. Collect the KYC details and the documents once, put the scope and fee in writing, do the checks the rules ask for, and get the client's yes to WhatsApp before the reminders start. Most of it is the same list for every client, so it can be written once and sent the same day.

The KYC details ICAI asks for

ICAI's Council issued its KYC norms to be observed by members in practice with effect from 1 January 2017. They are mandatory and apply to all assignments pertaining to attest functions.¹ The details differ by type of client:²

• Individuals and proprietors: name, PAN or Aadhaar number, a description of the business, a copy of the last audited financial statements, and the type of engagement.
• Companies: name and address, business description, the parent company for a subsidiary, the last audited financial statements, the type of engagement, the company's PAN and CIN, and the directors' names, addresses and DINs.
• Firms and other non-corporate entities: name and address, a copy of the PAN, business description, the partners' names and addresses with their PAN, Aadhaar or DIN, the last audited financial statements, and the type of engagement.

The norms are written for attest work. Our recommendation is to collect the same details for tax and accounting clients as well. You will need most of them for the first return anyway, and it means one list for everyone.

Taking over an audit from another CA

Clause (8) of Part I of the First Schedule to the Chartered Accountants Act makes it misconduct to accept a position as auditor previously held by another chartered accountant without first communicating with them in writing. ICAI's guidance says a letter sent by ordinary post is not enough: send it by registered post with acknowledgement due, or by hand against a written acknowledgement, and keep positive evidence that it was delivered.³

Fees matter too. The same guidance says that if the previous auditor's undisputed fees for a statutory audit have not been paid, the incoming auditor should not accept the appointment until they are. Fees provided for in accounts signed by both the auditor and the client count as undisputed.³ Ask the client about it before you accept, not after.

Put the terms in writing

For an audit, SA 210 requires the auditor to agree the terms of the engagement with management and record them in an audit engagement letter or another suitable form of written agreement, covering the objective and scope of the audit, the auditor's and management's responsibilities, the financial reporting framework and the expected form of the report.⁴

Nothing in the standards requires a letter for a return or for bookkeeping. Our recommendation is a one-page letter anyway, because most fee disputes start with a different memory of what was agreed. It should cover:

• the services, and what is not included;
• the fee, when it is billed, and what happens if documents arrive late;
• what the client must send, and by when;
• who on each side is the contact, and how you will reach each other.

The fee terms you write here are the ones our fee reminder templates refer back to later.

Check whether PMLA applies to the work

Since the Finance Ministry's notification of 3 May 2023, a practising chartered accountant who carries out certain financial transactions on behalf of a client is a reporting entity under the Prevention of Money-laundering Act. The transactions are buying and selling property, managing the client's money, securities or bank accounts, organising contributions for companies, creating, running or managing companies, LLPs or trusts, and buying and selling business entities. Reporting entities must carry out client due diligence and keep records.⁵

Ordinary audit, tax and accounting work is not on that list. Our recommendation: ask the question at onboarding, and note the answer on the client's file, so that a new engagement that does fall under the notification is noticed when it starts.

WhatsApp: ask first

WhatsApp's Business Messaging Policy covers both the WhatsApp Business app and the WhatsApp Business Platform. It says you may contact people only if they have given you their mobile number and have given you opt-in permission to receive messages from you on WhatsApp. You must also respect any request, on or off WhatsApp, to stop.⁶ The welcome message below asks for that yes in writing, in the same chat that the reminders will later use.

Messages you can copy

Replace the words in brackets, and write them in English or Hindi, whichever the client uses.

Once the client is set up, the reminders take over: our GST reminders for monthly and quarterly returns, our ITR documents checklist for the yearly return, and, for company clients, the AOC-4 and MGT-7 list. All the year's dates in one place are in our compliance calendar.

What can run by itself

• The welcome and the KYC list, sent the day a new client is added, with the list chosen by type of client.
• A checklist per client that ticks off each document as it arrives and files it in the client's folder, as in our document processing.
• A follow-up that names only what is still missing and stops once the file is complete, as in our client reminders.
• The client's choice: WhatsApp or email, recorded from the YES or the STOP, so that every later reminder respects it.

What stays with your team

• Whether to take the client on. The previous auditor's reply, unpaid fees, and anything that does not feel right.
• The engagement letter. The scope and fee are agreed by a partner, not filled in by software.
• The PMLA answer. Deciding whether an engagement falls under the notification is a professional judgment.

More of what we write for CA practices is on the blog.

Questions CAs ask