KYC verification in Australia for professional firms, not a bank refresh

A search for “kyc verification australia” often lands on a bank page about refreshing a product. A law practice, an accounting practice, or a conveyancing practice is not running a deposit account. Know your customer information, in AUSTRAC’s glossary, is information that gives you reasonable grounds for the matters in initial customer due diligence, or that helps you identify the customer’s money-laundering and terrorism-financing risk. Checked against AUSTRAC’s KYC information glossary and the overview of initial customer due diligence on 2 October 2026. This is general information, not legal advice, and it does not copy those pages. Whether the firm is in the regime is /tranche-2.

Why this is not a bank refresh

A bank’s refresh follows an account that keeps moving. The professional firm’s question is narrower: are you providing a designated service to this customer, and what does the program say you must establish before you do? A retail checklist for a transaction account is the wrong shape. So is a yearly “update your details” email that a bank sends because the product is still open.

• The trigger is the service. Initial customer due diligence sits before the designated service. A file you opened for advice that is not a designated service is not automatically a KYC file. The map of services is /tranche-2.
• The customer is the one in the engagement. The person who emailed the firm may be the customer, a director, or someone with no authority. Write down which.
• Verification of identity is one input. A licence photo can support identity. It does not establish beneficial ownership, authority, or the purpose of the matter. That split is is AML just VOI?.

What to collect

AUSTRAC’s customer-type guides set the matters. This page does not paste their field lists. Use the guide that matches the customer, then collect only what your program says that risk requires.

Who pays, and how the request reaches the client, is client-pays KYC. Whether the engagement letter can pass that cost on is can you charge the client for an AML check?.

Privacy

KYC information is personal information. Collect what the program needs for this matter. Do not ask the client to email a passport image to a shared inbox “just in case”, and do not keep a second copy in a personal mailbox after the check is done. If the Privacy Act applies to the practice, the Australian Privacy Principles are the OAIC’s explanation of collection, use, and security. A small-business threshold exists. Check whether it applies to you before you treat this paragraph as your privacy notice.

The client completes the verification. FreeAML stores the evidence of that check. The practice still decides what its own privacy notice says. FreeAML does not replace that notice, and it does not decide that a matter is a designated service.

The firm stays on the free suite

The FreeAML firm suite is A$0. There is no monthly AML seat. The firm sends the request by email. The client completes it and verification is client-pays. On the public list a personal KYC check is A$20 and a company KYB check is A$40. Confirm the live amounts on FreeAML pricing. The firm does not absorb the check to make the engagement look simpler.

Frequently Asked Questions