Accounting services rules and ethics: a practical framework

An accounting practice in England does not comply through one registration or one professional title. The accounting services rules and ethics framework depends on its legal entity, activities, staff, customers, memberships, data uses and marketing. Statutory audit sits under the Companies Act 2006, AML under the Money Laundering Regulations 2017, data protection under UK GDPR and the Data Protection Act 2018, and tax-agent registration under the Finance Act 2021. These are separate boundaries.

This guide describes primary and official sources checked on 5 September 2026. It does not determine the law, regulatory position or professional duties for a particular business. Obtain qualified legal, tax, accounting, AML and data-protection review for the actual facts, and reopen every source before using the material in 2027.

What to take away

An accounting practice must map every entity and activity to separate audit, AML and tax-agent duties.
Statutory audit requires firm registration and individual eligibility, not just accountancy body membership.
AML supervision depends on the specific services provided, so do not assume body membership covers all work.
Tax-agent registration, agent services accounts, service enrolment and client authorisation are four distinct concepts.
Data roles depend on who determines purposes and means, not on template contracts.

Build an activity and entity map first

England has no blanket licence for all accountants or bookkeepers. Duties attach to the entity, the service, any professional claim, the customer and the information handled. Map your activities instead of relying on a generic regulated label.

List every legal entity, trading name, office and online service. Against each, record whether it provides:

Entity and activity map

List every legal entity and trading name
Record each service activity per entity
Add people, subcontractors and overseas suppliers
Create obligation register with owner and evidence
Use statusesconfirmed, not applicable, uncertain
Hold launch or publication on uncertainty

Activity and entity map

bookkeeping or transaction processing;
payroll processing or payroll advice;
accounts preparation;
tax compliance or tax advice;
communication with HMRC for clients;
company secretarial or filing work;
management reporting or outsourced finance;
statutory audit;
software, directory or referral services;
client-money or payment-related activity.

Add the people who perform, review, advertise and contract for each service. Include subcontractors and overseas suppliers. A requirement may apply to one entity or activity without extending to the whole brand.

Create an obligation register containing source, scope, owner, operational control, evidence, review date and adviser. Use separate statuses for confirmed, not applicable, uncertain and awaiting evidence. Uncertainty should keep the affected launch or publication on hold.

Treat the register as a maintained deliverable. For every confirmed obligation, test one live record, such as an audit-register lookup or a client due-diligence file. Keep the version examined and correct failures before new work starts.

Separate statutory audit from general accounting

Statutory audit is governed by the Companies Act 2006. A business carrying out company audit must be a registered audit firm through a recognised supervisory body such as ICAEW, ACCA, ICAS or ICAI, and the FRC maintains the Register of Statutory Auditors. GOV.UK's registered auditor guidance describes qualified-auditor and professional-indemnity conditions.

The individual who may sign and the firm's registration both matter. Membership of an accountancy body or use of an accounting title does not necessarily establish eligibility to conduct a statutory audit.

Before accepting or listing audit work:

Audit work acceptance checks

Verify firm and individual on live audit register
Check recognised supervisory body current rules
Examine appointment, independence, competence, insurance
Approve marketing wording and letterhead details
Preserve evidence and next verification date
Keep audit referrals distinct from delivery

Keep audit referrals distinct from delivery. If an accountancy practice introduces a registered audit firm, the engagement and customer communication should identify which entity performs which work.

Identify AML supervision correctly

The Money Laundering Regulations 2017 set the AML duties for the accountancy sector. HMRC's accountancy-service-provider supervision page describes services including professional bookkeeping, accounts preparation, certain payroll work and customer-specific tax services. It notes that virtual and automated service models still require attention to customer due diligence.

Determine whether HMRC or an eligible professional body supervises the relevant practice under the Money Laundering Regulations 2017. Registration and renewal are required with the appropriate supervisor. Do not assume that body membership automatically covers every entity or activity. If relying on a stated exclusion, document how every condition is satisfied and monitor changes.

Operational implementation can include, as applicable:

AML operational implementation

Business-wide risk assessment
Customer and beneficial-owner checks
Purpose and intended-relationship information
Ongoing monitoring and refreshed evidence
Enhanced steps for higher risk
Internal and external reporting processes
Staff screening, training and record keeping

This is not an exhaustive legal checklist. Use current legislation, supervisor material and appropriate professional advice.

Supervision is not a service-quality award. Marketing should state the fact accurately without suggesting that the supervisor endorses the practice or every piece of work.

Distinguish tax-agent registration and access

The Finance Act 2021 provides the statutory basis for mandatory tax-agent registration. HMRC's current professional tax-agent registration guidance says paid advisers who interact with HMRC about clients' tax affairs must consider the staged registration requirement and published conditions.

Four separate tax-agent concepts

Concept

Registration: Adviser legal entity
Agent services: Online account used by firm
Enrolment: Particular tax service
Authorisation: Individual client consent

What it covers

Registration
Agent services
Enrolment
Authorisation

One does not prove the others. Map each service and user account to the correct entity and authorised staff. Keep leavers and role changes under access control. Never request a client's personal HMRC sign-in credentials.

The February 2026 HMRC standard for agents describes expectations for its population of agents. It covers integrity, professional competence, supported calculations, contemporary records, correction of inaccuracies, secure information and third-party inputs.

The standard says it does not replace law, HMRC guidance or professional-body duties. Those duties include the IESBA Code of Ethics, the ICAEW or ACCA Code of Ethics for members of those bodies, and the FRC Ethical Standard for audit work. Convert these principles into procedures and file evidence rather than simply copying them into an ethics policy.

Maintain competence at task level

Build a matrix of work, performer, reviewer, required knowledge, evidence, limits, expiry and deputy. "Tax" and "accounts" are too broad. Split tasks by entity, tax, transaction, reporting framework, software and customer complexity.

Assess competence through observed work and file review. Training attendance supports development but does not show that a person can resolve an ambiguous record or recognise when to escalate.

For each high-consequence output, define review and approval. Prevent commercial staff from promising specialist work or deadlines without technical acceptance. Record referrals and the basis on which a specialist was selected.

Where software or AI contributes, staff remain responsible for checking source, transformation and output within their role. Test third-party results and maintain a manual route for urgent work.

Determine data roles from the facts

UK GDPR and the Data Protection Act 2018 govern the handling of personal data. Accounting work can process identities, income, transactions, employment information, customer records and other sensitive context. An information inventory should cover enquiry, acceptance, delivery, filing, billing, complaints, termination and retention.

The ICO's controller and processor material explains that the role depends on who determines purposes and means. A practice may be a controller for its own acceptance, compliance and billing work while another processing operation has a different allocation.

Do not let a template decide the analysis. Document each purpose, lawful basis, individual affected, information source, recipient, location, retention and rights route.

The ICO's lawful-basis guidance says a suitable basis should be identified and recorded before processing. Consent to receive marketing, consent to participate in research and the basis for delivering accounting work are distinct questions.

Control processors and technology suppliers

Review bookkeeping, payroll, tax, document, cloud, signature, communication and AI services before live information enters them. Cover access, encryption, data location, subprocessors, incident notification, service continuity, model or feature changes, deletion, audit evidence and exit.

The ICO's controller-processor contract guidance identifies required processing details and topics such as instructions, confidentiality, security, subprocessors, rights assistance, end-of-contract action and audits. The page carries an update warning following legislative change, so check it again before drafting terms.

Use individual accounts, strong authentication, least privilege and prompt access removal. Keep test and production records apart. Prohibit uncontrolled downloads and use of client data in unapproved generative tools.

Exercise a misdirected payroll file, compromised user account and unavailable platform. Assign containment, evidence preservation, assessment, notification, communication and recovery decisions. Current contact details must remain accessible if the main system fails.

Write engagement terms that match delivery

The engagement should name the parties, service, period, records, cut-offs, customer decisions, practice review, completion, fee, data use, responsibility, complaint route and termination.

The Office of the Small Business Commissioner provides a business contract guide covering practical topics such as parties, scope, payment, duration and termination. It is general orientation rather than tailored legal drafting.

For each service, specify:

Engagement terms

Contract field	Accounting question
Scope	Which entities, tasks, periods and deliverables are included?
Client input	Which source records and approvals arrive by what date?
Review	Who checks technical and data quality, and to what standard?
Submission	Who authorises and what acknowledgement proves sending?
Change	What triggers new timing, fee, risk and competence review?
Termination	How are work, deadlines, access and records handed over?

Do not use a broad liability clause without legal and insurance review. Inconsistency between an engagement, proposal, website and oral promise can create risk even when each document appears polished alone.

Operate a variation log. Confirm changes in a durable record before expanding work. At renewal, compare the contract with what staff actually performed and correct recurring scope drift.

Identify business and consumer relationships

The legal treatment of a customer can depend on the purpose for which that person contracts. The CMA's fair-contract guidance concerns trader-to-consumer terms and notices. It points out that the same individual can act as a trader in one transaction and a consumer in another.

Do not assume a sole trader is always legally a consumer or always a business customer. Record the purpose and obtain legal advice where rights, cancellation or fairness requirements depend on status.

If a practice uses one contract for several customer types, have it reviewed for each applicable regime. A business-to-business clause should not be copied into a consumer engagement without analysis.

Substantiate advertisements before release

CAP Code section 3 covers misleading advertising, objective-claim evidence, material qualifications, comparisons and testimonials within its remit.

Create a claims register containing:

Substantiate advertisements

exact wording and likely interpretation;
source and calculation;
population, period and exclusions;
professional or regulatory verification;
publication channel;
approver and expiry;
correction history.

Avoid unsupported "leading", "best", "guaranteed savings", "error-free" or whole-market claims. A starting price needs the service, entity, volume, record condition, contract period and additional charges that materially affect it.

Use protected professional wording only in the approved form and for people currently entitled to it. Audit registration must be checked separately. HMRC registration or access should never be described as endorsement.

Treat testimonials and reviews as marketing evidence

Keep proof that a testimonial is genuine, permitted and connected to the advertised service. Factual claims inside a quotation need the same support as claims made directly by the practice.

Disclose incentives and material selection circumstances. Do not suppress negative reviews in a way that creates a misleading displayed sample. Never reveal confidential accounting details in a case study without a lawful and carefully approved basis.

The CMA's collection on reviews and social media endorsements supplies current UK consumer-law information. Apply the live rules to the particular audience, platform and presentation.

Make directory and referral interests visible

An accounting directory should publish its inclusion and ordering method. Label sponsored placement at the point where it affects what the user sees. Explain whether credentials and supervision are independently checked, declared by the provider or not assessed.

Disclose referral fees, affiliate commissions, ownership or exclusive arrangements where they could influence selection. A payment may purchase visibility; it must not be represented as proof of competence.

Give introducers approved scope and credential wording. Monitor live scripts and pages. Suspend a route that repeatedly promises unavailable work, HMRC endorsement or unsupported outcomes.

Verify the receiving entity before sharing a lead. Collect and transfer only the information required for the agreed purpose, with the appropriate privacy and authority controls.

Create a usable disclosure policy

Map every communication event from search result to engagement and complaint response. Decide what a person must know at each stage to understand identity, service, price, relationship and limitation.

Use layers. Put decisive information, such as sponsored ordering, limited comparison, starting price or third-party delivery, in the immediate view. Link to detailed methodology and evidence without burying the main qualification.

Test comprehension with likely users. Ask who they believe provides the service, what a ranking means, what price includes and which credentials were verified. Revise when the overall impression is wrong even if an isolated sentence is technically accurate.

Provide a correction route and record reports, evidence, interim action, decision and amendment. Preserve old versions so the organisation can reconstruct what customers saw.

Audit the operating evidence

Compliance review should sample files and live journeys, not just policies. Examine:

Audit operating evidence

accepted and declined client records;
identity, authority and risk evidence;
competence and technical review;
submitted versions and acknowledgements;
user access and supplier changes;
advertisements and claims records;
signed engagements and variations;
complaints, incidents and corrections;
terminations and handovers.

Record the failure, consequence, affected population, immediate action, root cause, owner and deadline. Retest after correction. Repeated issues should change capacity, training, workflow or service scope.

Maintain the framework over time

Assign source owners and expected update dates. Trigger review when legislation, HMRC service, supervisor guidance, professional rules, staff, software, provider relationship, customer segment or advertised claim changes.

Keep enacted requirements separate from consultations and future announcements. For example, Companies House currently states that mandatory commercial-software filing of annual accounts starts on 1 April 2028, not 2027. Publication must use the live software-filing timetable.

Require qualified approval for interpretations and contract changes. If a fact cannot be confirmed, state the uncertainty and hold the affected work.

The practical standard is traceability. A reviewer should be able to move from service and entity to requirement, procedure, file evidence and corrective action. That is more credible than a broad claim that an accounting practice is "fully regulated" or "fully compliant".

Before you act

Use this short pre-engagement list before you accept or advertise a service.

List every legal entity, trading name, office and online service.
Verify the exact firm and individual on the live audit register.
Determine whether HMRC or a professional body supervises each activity.
Map each tax service and user account to the correct entity.
Document each data purpose, lawful basis and retention period.
Review technology suppliers before live client information enters them.

Common questions

What must an accounting practice do before accepting or listing statutory audit work?

Verify the exact firm and individual on the live audit register. Check the recognised supervisory body's current rules. Examine appointment, independence, competence and insurance requirements. Approve marketing wording and letterhead details. Preserve the evidence and next verification date.

How should a practice determine whether HMRC or a professional body supervises its AML obligations?

Determine whether HMRC or an eligible professional body supervises the relevant practice. Do not assume that body membership automatically covers every entity or activity. If relying on a stated exclusion, document how every condition is satisfied and monitor changes.

What four concepts must remain separate in tax-agent registration and access?

Registration of the adviser legal entity, the agent services or online account used by the firm, enrolment for a particular tax service, and authorisation from the individual client. One does not prove the others. Map each service and user account to the correct entity and authorised staff.

Which activities trigger AML supervision rather than statutory audit registration?

Professional bookkeeping, accounts preparation, some payroll work and customer-specific tax services can require AML supervision. Statutory audit is a separate reserved activity. One does not imply the other.

Does membership of an accountancy body allow me to sign a statutory audit report?

No. The individual must be eligible and the firm must be registered through a recognised supervisory body. Check the live audit register for both.