Ongoing customer due diligence for a small firm
Ongoing customer due diligence is the review you keep doing after the first check. For a small firm, that is triggers and a record, not a payments desk.
Quick answer
Ongoing customer due diligence for a small firm is the review your program already names: a trigger, a look at the risk and the KYC information, and a record of what you did. It is not a bank alerts desk. FreeAML stores that ongoing evidence. FreeAML does not sell transaction monitoring as ongoing customer due diligence.
A small practice hears “ongoing customer due diligence” and pictures a room of analysts watching payments. That is one way a large bank monitors a high volume of account activity. It is not the only shape the obligation can take. AUSTRAC’s monitoring page says you must monitor customers while you provide a designated service, and that the method can be manual, automated, or both, depending on the nature, size, and complexity of the business. Checked against the overview of ongoing customer due diligence, how to monitor your customers, and reviewing and updating ML/TF risk and KYC information on 2 October 2026. This is general information, not legal advice, and it does not copy those pages. What the first check has to establish is customer due diligence requirements. Whether the matter is in the regime is /tranche-2.
Write the refresh triggers you will actually keep
Your risk assessment is what the triggers should come from. A trigger you will not notice is not a control. These are examples a small firm can see without a payments feed. They are not a substitute for the list in your program, and they are not AUSTRAC’s list.
Matter-level triggers. The standard for what you must watch stays on AUSTRAC’s monitoring pages.
| What changed | What you open | What you do not pretend |
|---|---|---|
| A new matter for a client you last saw years ago | Whether the KYC information and the risk still describe this client | That the old file is still current because nobody complained |
| A new director, trustee, or beneficial owner | The customer record, and the people the program says you must identify | That the engagement letter name is enough |
| Instructions that sit outside the original matter | Whether the purpose and the risk rating still fit | That you will notice it later, at the annual tidy-up |
| The review date your program set for a higher-risk file | The risk, the KYC information, and whether re-verification is required | A diary note that says “still fine” with nothing attached |
If the review shows the file is now high risk, the extra work is enhanced customer due diligence. Do not rename a missed review as enhanced due diligence after the fact.
Monitoring without a bank alerts desk
You still monitor. For an occasional matter, that is while you provide the designated service. For a business relationship, it continues through the relationship, including how the customer uses the service. A practice that can see every matter can do that by hand: the partner reads the new instruction against the file. AUSTRAC expects an automated system where the volume is too high to monitor effectively by hand. Read that page against your own volume. Do not skip monitoring because you are small, and do not buy a feed because a bank uses one.
A transaction-monitoring product watches a stream of payments. Many professional matters do not have that stream. Filing the invoice for a feed is not the review, and it is not the record of what you decided. FreeAML does not sell transaction monitoring as ongoing customer due diligence. If your volume means you cannot review matters manually, get a tool that does that job and say so in the program. Do not describe FreeAML as that tool.
What the free suite stores
Keep the trigger, what you looked at, whether the risk or the KYC information changed, and whether you re-verified. The FreeAML firm suite is A$0 and it stores that ongoing evidence with the customer file. When the program says the client must be checked again, the firm sends the request by email and verification is client-pays. Amounts are on FreeAML pricing. The stored note does not approve the program, and it does not lodge a report.
📚 Related Resources
Free KYC Check →
Verify customer identity in 60 seconds. Government ID + AML screening.
Free AML Program →
Board-ready AML/CTF Program template. All 10 AUSTRAC sections included.
Risk Assessment Generator →
AI-powered ML/TF risk assessment. 20-page compliant report in 5 minutes.
Free AML Training →
Online courses for staff. CPD-certified certificates included.
AUSTRAC Reporting Tools →
File SMRs, TTRs, IFTIs directly to AUSTRAC. Pre-filled forms.
Frequently Asked Questions
Store the refresh. Do not buy a fake monitoring feed.
The firm suite is A$0 and keeps the ongoing evidence. A fresh check, when the program requires one, is client-pays.
View pricingQuestions: team@freeaml.com.au