How to automate client onboarding for accounting firms, and what to keep human

What does client onboarding involve at an accounting firm?

Client onboarding covers everything between a prospect saying yes and the first job starting: acceptance checks, the engagement letter, identity verification, ATO agent nomination, setting the client up in your practice-management system and collecting records. Most of it is the same for every client, which is why it suits automation. The judgement calls do not.

The table shows a typical sequence for an Australian firm on Xero Practice Manager (XPM), and where automation fits at each step.

Which onboarding steps can you automate safely?

Automate the steps that move information, not the steps that make decisions. Collecting details, drafting documents, sending reminders and creating records are rules-based and repeatable. They are also where staff time goes and where re-keying errors start.

• One intake form, used everywhere. Capture each person and entity once, then reuse the data for the engagement letter, the identity request and the XPM record. The same address typed four times is four chances to get it wrong.
• Engagement letters from templates. An automation, or an AI drafting step, assembles the letter from the services selected and attaches the standard terms. A partner reviews and approves it, then e-signature reminders go out until it is signed.
• Client creation in XPM. Proposal tools can do this for you. Ignition, for example, says its XPM integration can deploy jobs automatically when a proposal is accepted and sync client information between the two systems.
• Reminders for the steps only the client can do. Signing, uploading ID and nominating the firm with the ATO all wait on the client. Scheduled, polite reminders stop those steps stalling without a staff member chasing by hand.

Pylon Digital builds these workflows through its AI Automation service, with human approval before anything leaves the firm and a full audit log of every action. The automation layer stores client data in fully GDPR-compliant data centres.

What identity checks do accountants need to do?

Two separate regimes can apply. The Tax Practitioners Board’s proof-of-identity requirements apply to tax and BAS work. The AML/CTF regime applies only when the firm provides a designated service.

TPB proof of identity. The TPB’s guidance statement TPB(GS) 42/2022 sets minimum proof-of-identity requirements. Tax practitioners must verify a new client’s identity before providing tax agent or BAS services, and verify existing clients on an ongoing basis where appropriate. The TPB says that failing to do so may breach the Code of Professional Conduct. Some practice software records this directly: MYOB AE/AO has a Proof of Identity tab that logs the documents sighted and keeps a new record for every change. Whatever you use, record who verified the client, when and against which documents.

AML/CTF tranche 2. Since 1 July 2026, accountants who provide designated services under the AML/CTF Act have been reporting entities regulated by AUSTRAC. The designated services include helping clients buy or sell real estate, companies or other legal arrangements, creating or restructuring companies and trusts, receiving or holding client money and other assets, assisting with equity or debt financing, acting as a director, secretary, trustee or nominee shareholder, and providing a registered office (CPA Australia; AUSTRAC). Preparing tax returns and financial statements is not on that list.

Firms that provide these services must enrol with AUSTRAC (for firms already providing them on 1 July 2026, the deadline was 29 July 2026), maintain an AML/CTF program, appoint an AML/CTF compliance officer, complete customer due diligence before providing the designated service, report suspicious matters and threshold transactions, and keep the required records, generally for seven years.

For onboarding, that means one extra question at intake: will this engagement include a designated service? The form gathers the facts; the compliance officer decides. If the answer is yes, that part of the engagement follows the firm’s AML/CTF program before work starts.

What must the engagement letter pack include?

The engagement pack should set out scope, fees and responsibilities, and it should carry the information the TPB requires you to give clients. Under section 45 of the Tax Agent Services (Code of Professional Conduct) Determination 2024, registered practitioners must tell current and prospective clients, in writing, that the TPB keeps a register of tax and BAS agents and how to search it, how to make a complaint, including through the TPB, and what obligations the practitioner and the client each have under the tax laws.

For practices with 100 or fewer employees at 31 July 2024, this has applied since 1 July 2025; for larger practices, since 1 January 2025 (TPB(GS) 54/2024). Automation handles this kind of rule well: attach the required information to every engagement pack by default, so nobody leaves it out during a busy week.

How does ATO client-to-agent linking fit in?

For business clients, the client, not the firm, has to act first. Since 13 November 2023, entities with an ABN other than sole traders must nominate their registered agent in the ATO’s Online services for business before the agent can add them. The agent then has 28 days to add the client, and the client can extend the nomination if more time is needed (ATO).

The firm cannot complete the nomination for the client, and nor can an automation. What automation can do is send clear instructions at the right moment, remind the client until it is done, and prompt a staff member to check the pending nominations report in Online services for agents before the 28 days run out.

How do you set up the client in Xero Practice Manager?

Set the client up once, from the intake data, and let the recurring work follow from templates. XPM, now part of Xero Partner Hub, runs from one client record and supports job templates, categories and statuses (Xero).

A good automated setup creates the client record with the right entity type and contacts, records how a family’s entities relate, assigns the responsible partner and manager, and creates recurring jobs such as the annual return from templates. Those jobs are then ready for time recording and scheduling from the first week. Consistent jobs also make automating WIP and utilisation reporting much simpler later.

Building directly on the XPM API is possible, but as at September 2026 Xero requires an annual security self-assessment from every XPM API consumer, and its developer pricing places XPM API access in the Advanced tier with use-case approval. For most firms, an app that already integrates with XPM is the shorter path.

What should stay human?

Keep people on every decision that carries professional or regulatory risk, and on anything that goes to the client. Automation prepares; people decide.

• Accepting or declining the client, including conflicts.
• Deciding whether a service is a designated service, and assessing money laundering risk.
• Setting scope and fees.
• Resolving identity mismatches or documents that look wrong.
• Approving every letter, request and email before it leaves the firm.

A worked scenario: one family group, four client records

Consider an illustrative 20-person firm taking on a family group: a trading company, a discretionary trust and two individuals, who are also the company’s directors. Without automation, the same names, addresses and ABNs are typed into the engagement letter, the ID requests, XPM and a string of emails.

1. The family completes one intake form covering all four entities.
2. The partner reviews the acceptance checklist. The family also wants help restructuring the trust, which is a designated service, so the compliance officer routes that work through customer due diligence.
3. The engagement letter is drafted with the TPB information attached. The partner edits scope and fees, approves it, and reminders go out until it is signed.
4. Identity requests go to both individuals, and a staff member reviews the results.
5. The company and the trust, assuming both hold ABNs, each nominate the firm in Online services for business, with reminders until they do.
6. On acceptance, four XPM client records and their recurring jobs are created from templates, with the partner and manager assigned.

The partner’s time goes on acceptance, scope and fees, not data entry. Collecting the records that follow is its own workflow; our guide to how AI agents chase client documents at tax time covers it.

This is general information, not legal advice.