A 100-point check is not AML/CTF customer identification

You still hear it from a client who says the bank already did it. Checked against AUSTRAC's initial CDD guide for individuals and the AML/CTF Act on legislation.gov.au on 14 October 2026. This is general information, not legal advice. This page does not reproduce that guidance or the Act. Document examples are primary ID documents for AML KYC. Certified copies are a separate question. Electronic data is electronic identity verification. The sector map is /tranche-2.

What a points score is doing

A 100-point check adds documents until a form says you have reached 100. Publishers use different tables. Older account-opening forms that grew out of the Financial Transaction Reports Act 1988 used one version. Other identity checks, outside this Act, still publish their own. This page does not set out any points table, and it does not say what a document is worth. When the points reach 100, that method is finished.

That finish line is the problem on an AML/CTF file. The points method asks whether the papers add up. It does not ask who the customer is, who they act for, who owns a customer that is not an individual, whether anyone is a politically exposed person or designated for sanctions, or what the service is for. An old account-opening bundle can leave every one of those questions blank.

What section 28 asks you to establish

Section 28 says a reporting entity must not commence to provide a designated service to a customer unless it has established stated matters on reasonable grounds. The simplified outline of that Part says initial customer due diligence comes before the service, with special cases where it may come after, and with exemptions the Act and the AML/CTF Rules set out. This page does not list the exemptions. If you think a special case might apply, read the current section and get advice on the service. Do not treat this page as the exemption.

In short, you establish the identity of the customer, of any person the service is for, and of any person acting for the customer, with their authority to act. Where the customer is not an individual, you establish any beneficial owners. You establish whether any of those people is a politically exposed person or designated for targeted financial sanctions, and the nature and purpose of the business relationship or occasional transaction. The Rules can add matters. You then collect the KYC information that fits the customer's risk, and you verify what is appropriate to that risk, using reliable and independent data.

A points total with no underlying record is not reliable and independent data. AUSTRAC's examples are a primary photographic document, or a non-photographic document with a secondary document. Those are evidence, not a score. The next page walks through them.

Where a 100-point file still falls short

• The customer is a company or a trust. Points on a director's passport do not identify beneficial owners. An individual who owns 25% or more, or who controls the customer, is still a person you have to see.
• Someone else gives the instructions. Section 28 asks who is acting, and with what authority. A bundle in the signatory's name does not answer that.
• The purpose is missing. Nature and purpose is its own matter. A passport does not say why the client wants the service.
• Screening is separate. A clean document check can leave a politically exposed person or a sanctions question open. Your program says how you screen.
• Risk can ask for more. A thin bundle is not permission to stop when your program says otherwise. Enhanced due diligence is a further step, not a higher score.

Keep a points habit only where a different law or a licence condition still asks for it. That other check does not replace section 28 when you provide a designated service. Do not tell the client that 100 points covers AML. If you are not sure the service is designated, read /tranche-2 and get advice. The new designated services commenced on 1 July 2026. Enrolment sits on AUSTRAC Online. FreeAML does not enrol you.

Where this page stops

This page is the difference between a score and customer identification. The examples of primary photographic and non-photographic documents are primary ID documents for AML KYC. Who you look through to on a company or trust is a beneficial owner. How a digital ID fits the same question is MyID and an AML check.

What your client pays

FreeAML is a full AML/CTF platform for firms of every size. On FreeAML you pay $0 for the suite. There is no subscription. Your client can pay, and you can add a per-verification service charge. Verification is client-pays. On the public list a personal KYC check is $20 and a company or trust KYB check is $40. Confirm the live amounts on FreeAML pricing. FreeAML does not score documents out of 100, and it does not decide that section 28 is met.

Frequently Asked Questions