بقلم Lexi Team
Law firm client onboarding starts before work begins
Law firm client onboarding begins before a firm accepts a new matter. An instruction can appear straightforward at first contact, yet the firm may not have identified the client, confirmed who can give instructions, assessed a potential conflict or agreed how sensitive documents will be handled.
These are not merely administrative gaps. They can create uncertainty about representation, scope and fees, or allow confidential information to arrive before the firm has decided whether it can act.
This checklist separates intake into two layers:
- Layer one: baseline steps for every prospective client and matter.
- Layer two: additional checks triggered by the jurisdiction, work, client, transaction or information involved.
The aim is a consistent process with a clear decision-maker. A completed form does not, by itself, clear a conflict, establish authority or satisfy a matter-specific legal requirement.
Layer one: baseline checks for every new client
A reliable client intake process needs an identified owner, a central record and a clear gate for beginning substantive work. The owner may be a partner, matter lawyer, conflicts team, practice manager or compliance function. What matters is that responsibility is assigned and unresolved issues have an escalation route.
For in-house teams appointing external counsel, the same structure helps: identify the instructing entity, confirm the internal approver, define the requested work and allow the chosen firm to complete its conflict and engagement process.
1. Run and record a conflict check
Start with a sufficiently broad list of names. Include the proposed client, relevant group entities, known connected entities and individuals, the intended counterparty or opposing party, and others needed to make the search meaningful.
Search the firm’s matter records before accepting instructions. Record the search terms, date, person conducting the search, systems searched and outcome. If a potential match appears, escalate it to the responsible lawyer or conflicts function before accepting the engagement or receiving more substantive confidential information than is needed to assess the proposed instruction.
A database match is a prompt for legal and factual assessment, not a conclusion. Names may be similar, records may be incomplete, and the significance of an earlier matter depends on the relationships, issues, confidential information, applicable duties and facts.
In Singapore, rules 20 and 21 of the Legal Profession (Professional Conduct) Rules 2015 deal with conflicts between clients and with former and prospective clients, and rule 22 with conflicts between a practitioner’s own interests and a client’s. Apply the relevant rules to the proposed instruction rather than treating a search result or a client’s willingness to proceed as clearance.
2. Confirm identity and authority to instruct
Record who the client is, who is communicating with the firm and who may make decisions. For a company or other organisation, identify the legal entity being represented rather than assuming that the contact person, brand name or corporate group is the client. Ask for a suitable basis for the representative’s authority, particularly where the instruction concerns a significant transaction, dispute, settlement, confidential material or control of funds.
Baseline identity and authority checks help prevent directions being taken from the wrong person and clarify who is entitled to receive advice. The evidence requested should be proportionate to the matter; intake should not become indiscriminate collection of personal data.
For India-based instructions, distinguish this ordinary matter-opening check from any prescribed verification that applies because of a particular transaction, role, sector or court process. Do not assume that a single KYC procedure is legally required for every legal engagement.
For Singapore instructions, a basic identification record likewise does not replace any additional customer due diligence required for work within the applicable anti-money-laundering framework. Classify the proposed work before deciding which checks are sufficient.
3. Agree the engagement, scope and responsibilities
Use an engagement letter or equivalent written record before substantive work begins where practicable. It should identify the client and matter, state what work is included and excluded, identify responsible contacts, set assumptions and explain how scope changes will be approved.
The record should also state who may instruct the firm, who may receive advice, whether the firm acts for one entity or more than one, and how urgent issues will be communicated. If a group company, investor, director, insurer or affiliate is involved, do not assume it is a client merely because it has an interest in the outcome.
For an in-house legal team, a clear outside-counsel instruction also helps prevent business stakeholders from assuming that a firm has been retained for a broader mandate than the legal team approved.
4. Set out fees, billing and payment arrangements
Document the fee basis, billing frequency, currency where relevant, taxes, disbursements, any advance-payment arrangement and the process for approving work outside the agreed scope. State how the firm will address overdue invoices or a material change in estimates.
Have the responsible lawyer check the professional rules and client-specific terms applicable to the arrangement. In Singapore, rule 17 of the Legal Profession (Professional Conduct) Rules 2015 requires information on the basis of fees to be given to the client, and client money is governed by the Legal Profession (Solicitors’ Accounts) Rules. If the firm will receive or hold client money, property or third-party funds, involve the appropriate legal and accounts teams before funds move; a standard engagement letter is not a substitute for the applicable handling controls.
5. Establish data-handling and communication practices
Agree how instructions and documents will be exchanged, who needs access, which channels are permitted and how sensitive information should be labelled. Record client constraints on hosting, access locations, retention, deletion, encryption, privilege review or onward disclosure.
Collect what the matter needs. A generic intake form should not prompt collection of identity documents, commercial records or personal information that are unnecessary for conflict checks, engagement administration or the defined work.
Where personal data is involved, assess the privacy and confidentiality requirements applicable to the India or Singapore work and to any cross-border sharing. For India, account for the provisions of the Digital Personal Data Protection Act, 2023 that are in force for the processing concerned. The Digital Personal Data Protection Rules, 2025 phase in commencement, with most Data Fiduciary obligations taking effect 18 months after notification; check the commencement status for the obligation concerned. Checking DPDP commencement is not the whole India privacy assessment: also assess section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 where they remain in force and apply to the organisation and information involved. For Singapore, consider the Personal Data Protection Act 2012 where applicable. Set access and retention practices against the actual information being received, not only the form used to collect it.
6. Request and organise the documents needed to start
Use a matter-specific request list, not a request for every available document. For a dispute, that may mean pleadings, notices, key contracts, correspondence, a chronology and material deadlines. For a transaction, it may mean constitutional documents, approvals, relevant agreements, ownership information and documents needed for the defined workstream.
Track what has arrived, what is missing, the current version, the source and any preservation concern. An intake register helps prevent lawyers from beginning analysis with an incomplete or superseded file.
Layer two: apply jurisdiction- and matter-specific checks
The baseline layer does not answer every compliance question. The type of work, client profile, movement of funds, jurisdiction, role being performed or presence of sensitive data may call for further checks. Route an uncertain trigger to the responsible lawyer or compliance lead before proceeding.
Singapore: classify work for customer due diligence
For a Singapore instruction, determine whether the proposed services involve relevant matters under Part 5A of the Legal Profession Act 1966, read with the Legal Profession (Prevention of Money Laundering and Financing of Terrorism) Rules 2015. Do not assume that every legal instruction calls for identical customer due diligence, or that a routine intake form completes the checks required for work within the rules’ scope.
Flag proposed work involving property transactions, company or other entity arrangements, or the handling of funds for classification by the responsible lawyer. These are prompts for review, not an exhaustive list of regulated work. Where the rules apply, determine the required due diligence, timing, records and escalation steps under the rules in force when the matter is accepted.
Keep this classification separate from the ordinary conflict and engagement checks. A firm can have enough information to search for conflicts but still need additional information before it may proceed with a particular service.
India: separate conflict review from identity checks
For Indian matters, examine whether earlier or current representations, confidential information, adversity or a lawyer’s personal interest affect the proposed instruction. For advocates in India, the Bar Council of India Rules, Part VI, Chapter II (Standards of Professional Conduct and Etiquette) govern duties to clients; rule 33, for example, bars an advocate who has advised a party in a matter from acting or appearing for the opposite party in the same matter. The responsible advocate should decide whether the firm can act on the facts; a completed search or disclosure to a prospective client is not, on its own, a clearance decision.
Likewise, do not describe every prudent identity check as a prescribed legal KYC duty. Advocates are not reporting entities under the Prevention of Money-laundering Act, 2002 merely by practising as advocates, unlike certain other professionals performing notified activities. Record enough to establish the proposed client and authorised contact, then identify any further requirements arising from the transaction, client type, sector, handling of funds, court process or another applicable regime.
For an India and Singapore matter, assign responsibility for each jurisdictional assessment. The location of the client, the work and the people handling information may differ; one office’s completed intake should not silently stand in for the other’s review.
Turn the checklist into a repeatable intake process
A matter-opening record makes the workflow easier to review and hand over. It can contain:
- the proposed client, related entities and connected parties;
- conflict-search terms, result, reviewer and clearance decision;
- identity and authority information, including open questions;
- engagement terms, scope, responsible lawyer and authorised contacts;
- fee and billing arrangements;
- data-handling instructions and approved communication channels;
- requested documents, received items, versions and missing information;
- jurisdictional or matter-specific triggers, approvals and escalations; and
- the final acceptance decision, with any remaining conditions.
Build escalation gates into the process. A potential conflict should be assigned to a lawyer for assessment, not silently converted into a routine intake task. A Singapore matter that may require customer due diligence should not proceed merely because the standard form has been completed.
Where technology can help and where lawyer sign-off stays
Technology can support document-intensive intake without taking over professional judgment. Intake forms can structure responses and make missing information visible. Document-organisation tools can group files by matter, identify duplicates or versions and maintain a request list. Summaries can help a lawyer orient to submitted materials before deciding what needs closer review.
These uses have limits. Extracted facts must be checked against source documents. A tool can flag a blank field or a name resembling an existing record; it cannot decide whether a conflict exists, whether authority is sufficient, whether a regulatory trigger applies or whether the firm should accept the instruction.
Lawyer review and sign-off should remain central to conflict decisions, client identity and authority, engagement terms, compliance classifications, material data-handling choices and matter acceptance. For a related operational framework, see How Lawyers Can Use AI Safely: A 5-Step Checklist.
Lexi’s AI-native legal technology supports law firms, litigators and in-house teams with document-intensive workflows. The design principle for onboarding is to use structured intake, organised documents and review-ready information to support the responsible lawyer, not replace their decisions.
A final law firm client onboarding checklist
Baseline checks for every new client:
- Identify the proposed client, connected parties and relevant opposing parties.
- Run and record the conflict search; escalate potential matches.
- Confirm the client identity, instructing contact and authority to act.
- Agree the engagement, scope, exclusions and instruction protocol in writing.
- Document fees, billing, disbursements and scope-change arrangements.
- Set data-handling, communications, access and retention practices.
- Request the documents needed and track completeness, versions and deadlines.
Conditional checks for the jurisdiction and matter:
- Classify Singapore work for applicable customer due diligence.
- Assess conflicts and professional duties for the proposed Indian instruction.
- Identify transaction-, sector-, fund-handling or court-specific requirements.
- Assess applicable Indian and Singapore privacy requirements for the information involved.
- Obtain lawyer or compliance approval before substantive work starts.
A disciplined onboarding process does not treat every matter as identical. It applies a reliable baseline, identifies the conditions that require more and keeps legal and compliance decisions with the people accountable for the engagement.
Legal information disclaimer: This article provides general information, not legal advice. Requirements depend on the facts and the rules in force when a matter is accepted; obtain advice from qualified counsel for a specific instruction.
Next step: Explore legal workflows at Lexi.
