Secure Client Onboarding on Dataverse for a UK Accountancy Firm

The client is a chartered accountancy firm in London. It works with high-net-worth individuals, entrepreneurs and international groups. Under the Money Laundering Regulations, every UK accountancy firm must identify and verify a new client before it can act for them. Staff did this verification in an internal model-driven Power Apps app built on Dataverse. On the client side, though, there was no proper channel at all.

Where it fell short

• Personal data travelling by email. Passports, addresses and other personal details came in as attachments, with no controlled system around them.
• Typing before checking. Before verification could begin, staff had to copy each client's information into the internal app by hand.
• Questions going missing. Clients reported problems by phone or email, and nothing linked those conversations to their case.
• Checks that took too long. Driving licence and public-information checks were manual and happened outside the app.
• A weak first impression. For a high-net-worth client, an awkward onboarding is the first thing they experience of the firm.

Every new client goes through the same secure onboarding process. When staff open their model-driven app, the client's data is already in it, structured and ready for verification.

• A proper, secure onboarding process for clients, replacing email.
• Clients take issues straight to the staff handling their case, within the portal.
• Staff use structured data that is already in their model-driven app, with no retyping.
• The app itself runs driving licence and public-record checks.

This engagement did not record any time-saving or volume figures. The numbers on this page describe its scope.

What teams often underestimate

A portal that collects clients' passports is a security project before it is a user-experience project. External users need an identity separate from staff identity. Personal data must end up in a system that controls who can see it. Nothing sensitive should stay in the portal any longer than the handover takes. Client sign-in through Entra B2C, with data moved directly into Dataverse, where access controls set by the firm already apply, keeps the portal light and the sensitive data in a single governed location.