There are not five legal stages of KYC

The phrase is popular because it looks like a syllabus. Checked against AUSTRAC's overview of initial customer due diligence on 5 October 2026. This is general information, not legal advice. This page does not reproduce that guidance. The matters in firm language are customer due diligence requirements. AUSTRAC's own wording is introduced in AUSTRAC customer due diligence. Person and entity are KYB and KYC. The sector map is /tranche-2.

A shorthand you can use, labelled as shorthand

If staff need a count, use five actions and tell them the count is yours, not the Act's. One: know who the customer is. Two: verify that identity with reliable independent data. Three: if the customer is a company or a trust, identify beneficial owners and anyone acting, and use KYB rather than a single personal check. Four: determine whether relevant people are politically exposed or designated for sanctions, and record the nature and purpose of the matter. Five: keep the file under ongoing customer due diligence for as long as the relationship runs. Source of funds is not step five for every client. AUSTRAC attaches it to particular politically exposed persons and to enhanced due diligence where it is relevant to the risk.

Numbering them is a memory aid. It becomes a problem when a template has five boxes and staff tick box five because the poster said so, without asking the purpose, or when they skip beneficial owners because “stage two passed”. The overview says you establish the matters on reasonable grounds before the designated service starts. If you cannot, you must not provide the service. A five-box form that is silent on beneficial owners is not that test.

What to stop calling a stage

• A certified copy is not a stage. It is one method of looking at a document. Electronic data can be the method instead.
• A CRM entry is not a stage. Typing the name is not verification.
• A clear identity is not “KYC complete” if purpose, authority or the people behind an entity are still blank.
• Monitoring is not part of the first link. It is what you do after, under ongoing due diligence.
• Reporting is not a KYC stage. A suspicious matter report is a separate duty. Do not put it on a client-facing checklist.

If a course you have already paid for uses five stages, keep the course and correct the labels in your own materials. Tell staff which of the course's stages map to AUSTRAC's matters and which are the provider's packaging. A box called “stage 5: report” on a client checklist is the one to delete. Reporting is not a step you show the customer. Ongoing monitoring is not something you finish on day one. The first check is done when the matters are established and the record exists, not when five boxes are ticked.

Where this page stops

This page is the false syllabus. Ongoing work after the first check is ongoing customer due diligence for a small firm.

What the client pays

On FreeAML the firm suite is A$0. The firm emails the client a link. Verification is client-pays. On the public list a personal KYC check is A$20 and a company or trust KYB check is A$40. There is no subscription. Confirm the live amounts on FreeAML pricing. FreeAML prices the check, not a five-stage course. The client pays KYC or KYB. The firm writes the program that says which matters that result supports.

Frequently Asked Questions