Enhanced customer due diligence: when standard CDD is not enough

Standard customer due diligence asks who the customer is, and who owns or controls them when the customer is not a person. Enhanced customer due diligence asks why this file is riskier than that, and what you did about it. Checked against AUSTRAC’s enhanced customer due diligence page on 2 October 2026. This is general information, not legal advice, and it is not a copy of the Act. What the first check has to establish is customer due diligence requirements. Whether the matter is in the regime at all is /tranche-2.

When standard CDD is not the end of the file

AUSTRAC says enhanced customer due diligence must be applied in set circumstances. It can happen during the first check, during ongoing monitoring, or both. The measures have to be aimed at the specific risk, in proportion to it, and useful for as long as that risk lasts. A second identity document, with no note of why, is not enhanced work.

Nested services are a further trigger on the same page. Virtual-asset businesses have an extra source-of-funds rule there too. Read that row if it is you. This article is for the firms whose designated service is not that business. A suspicious matter report has its own clocks: when a Tranche 2 firm must lodge. Asking more questions does not pause them.

What enhanced adds

AUSTRAC expects the program to list measures that match the risk, not one universal extra form. Depending on why the file is enhanced, that can mean more know-your-customer information, the reason for the transaction, where value is going, a closer look at ownership and the financial picture, more frequent monitoring, or updating the file sooner than you would for other customers. It can also mean not providing the service, or refusing a cash channel your risk appetite does not allow.

• Source of funds and source of wealth. You must establish both on reasonable grounds, in the initial check, for a foreign politically exposed person and for a domestic or international-organisation politically exposed person whose risk is high. You must also hold them where they are relevant to why a customer is high risk, including where a shell company or a complex trust hides the owner. They are information you collect and record. They are not a fifth product you buy instead of identity.
• Complex ownership. A company with a readable register is not automatically enhanced. A chain that hides the individual can make the risk high, and high risk is the enhanced trigger. How far to follow the register is ultimate beneficial owner versus the ASIC extract.
• Senior manager. AUSTRAC expects you to be able to escalate the decision to senior management so the firm accepts the risk with its eyes open. In a one-person practice that person may be the owner. The role is can a sole trader be their own compliance officer. Escalation is not the customer check.

The same page says the program has to say when you will use each measure, who applies it, how you will know it worked, and how you will handle tipping off while you ask. Do not tell the customer that a report has been lodged. The boundary, with no script, is the suspicious matter report article. If you are unsure a sentence would disclose a report, do not send it.

The risk rationale is the record

AUSTRAC says you must document the enhanced measures. In practice the note shows the circumstance that pulled the file out of standard customer due diligence, why you chose those measures, what you collected, how you verified it, whether you lodged a suspicious matter report, and whether the risk rating changed. That note is the risk rationale. A later reviewer should be able to see why standard customer due diligence stopped being enough, without asking you to reconstruct it.

You can keep providing the service to a customer who needs enhanced customer due diligence, if the policies actually manage the risk. If they cannot, the program should say you stop. Write the decision either way. What an ordinary check collects, before any of this extra work, is what an AML check covers.

Where FreeAML fits

FreeAML stores the risk rationale with the check so the firm can show it later. The firm still writes the rationale. The product does not rate the customer, does not establish source of funds, and does not give senior-manager approval. Where the program requires a verification, the firm suite is A$0 and the check is client-pays by email. On the public list a personal KYC check is A$20 and a company KYB check is A$40. An enhanced file can need more than one. Confirm the live amounts on FreeAML pricing. There is no enhanced surcharge on the firm suite.

Frequently Asked Questions