Customer due diligence requirements, in plain English

AML in this guide is anti-money laundering for Australian firms. It is general information, not legal advice. AUSTRAC’s initial CDD overview (updated 27 March 2026) is the page to read next to your program.

It starts with a designated service

New reporting entities — lawyers, conveyancers, accountants, real estate professionals, and dealers brought in from 1 July 2026 — do not run customer due diligence on every person who has ever emailed the firm. The duty sits on a designated service. If the matter is not one, this procedure is the wrong tool. Map it with the designated-services decision trees and the Tranche 2 hub before you collect a passport “just in case”.

What you must establish

AUSTRAC’s overview, pointing at section 28 of the Act, says you establish these matters on reasonable grounds before the designated service starts:

• Who the customer is.
• Who, if anyone, the customer is receiving the service for. A trust beneficiary is the example they give.
• Who is acting for the customer, and that they have authority to act.
• If the customer is not an individual, who the beneficial owners are. That test is explained in what a beneficial owner is.
• Whether the customer, a beneficial owner, a person they are acting for, or a person acting for them is a politically exposed person or designated for targeted financial sanctions.
• The nature and purpose of the business relationship or the one-off transaction, so you have a baseline for what “normal” looks like later.

“On reasonable grounds” is not a vibe and it is not a photocopy for its own sake. It is a recorded basis for each matter. If you cannot get there, AUSTRAC says you must not provide the designated service. If you reasonably suspect the customer is not who they claim to be, that is also a suspicious-matter question.

Collect, then verify

Collection is gathering the information. It can come from the customer or from somewhere else. Verification is checking it against reliable, independent data. Sighting a document can do both at once. You do not have to verify every field. AUSTRAC expects at least one piece of KYC information verified for each matter you must establish, unless a rule says otherwise, and more where the risk is high or the request looks unusual.

Electronic data is allowed when it is reliable and independent. Your program should say what you do when the document and the story disagree: ask, check another source, or stop. You are not required to keep a scanned copy of a driver’s licence. You are required to keep a record of what you relied on.

Risk changes the depth, not the duty

Low, medium, and high are not optional labels. They decide how much you collect and verify. Simplified customer due diligence, where the risk is low, enhanced due diligence is not required, and your policies say how you will do it, still means you collect the required KYC information and establish the matters. It is not an exemption. High risk means more information, including on beneficial owners and other associated people, and enhanced steps your program already names.

Some delays exist. Real estate agents brokering a sale have a specific path for the party they are not acting for, including what “all reasonable steps” looks like if that party will not cooperate. Do not treat delay as the default for a new client of a law firm or an accounting practice. Read the delay guidance against the service you actually provide.

After the first day

Initial customer due diligence is the start. Ongoing due diligence is the rest of the relationship: watch for unusual behaviour, review KYC information when you doubt it or on the cycle your program sets, and notice when the nature of the work changes the risk. A customer who was straightforward on day one can stop being straightforward. The file should show that someone is still looking.

How long the record lasts

AUSTRAC’s overview says you keep records showing how you met initial CDD for seven years after the business relationship ends, or seven years after the last occasional transaction. That includes the data you collected and the risk decision. It does not require a folder of identity-document scans.

A plain sequence for a new reporting entity

1. Confirm the matter is a designated service and that your firm is the reporting entity for it.
2. Rate the money-laundering and terrorism-financing risk before you decide how deep to go.
3. Establish the matters: customer, anyone they act for, anyone acting for them, beneficial owners where the customer is not a person, PEP and sanctions, nature and purpose.
4. Collect KYC information and verify enough of it, with independent data, for the risk.
5. Do not start the designated service if a matter is still open. Record why you stopped or why you proceeded.
6. Diarise ongoing review. Keep the record for seven years.

This page versus the checklist

The AUSTRAC customer due diligence checklist is the how-to worksheet: which fields people tick for an individual and for a company or trust. Use it when you are building the form. Use this page when you need the requirement in plain English: what must be true before the service starts, and what “done” means. The checklist does not replace the program, and this page does not replace the Act.

Where FreeAML fits

The firm suite is A$0. When your program says a matter needs a check, FreeAML emails the customer a link and the verification is client-pays. The firm’s cash cost is A$0 when the customer pays. Prices are on FreeAML pricing. The product collects evidence. It does not decide whether the service is designated, whether the risk is high, or whether you may start work. That stays with the firm.

Frequently Asked Questions