Customer due diligence: what to establish, when, and how much

The short version

Before you start a designated service for a client, you must have established certain facts about them on reasonable grounds.¹ How much you collect and verify depends on the client's money laundering and terrorism financing (ML/TF) risk. Then you keep monitoring.

1. Identify the risk

   From what you already know about the client, before you start. s 28(3) s 28(4)

2. Establish the section 28 matters

   Who they are, who is behind them, whether they are a politically exposed person or sanctioned, and why they want the service. s 28(2)

3. Scale the checks to the risk

   Simplified where risk is low, enhanced where a trigger applies. s 31 s 32

4. Keep watching

   Monitor for unusual activity and refresh information at a frequency that suits the risk. s 30

5. Keep the record

   What you collected, how you verified it and what you decided, for 7 years after the relationship ends. s 111

Your client is your "customer" in the Act, and that includes a prospective customer.² For a real estate agent brokering a sale, the customer is both the seller and the buyer.³ See our real estate guide.

Initial CDD: before you start

You must not start providing a designated service until you have established each of these matters on reasonable grounds:¹

• the identity of the client;
• the identity of anyone the client is receiving the service on behalf of;
• the identity of anyone acting for the client, and their authority to act;
• if the client is not an individual, the identity of its beneficial owners;
• whether any of those people is a politically exposed person (PEP) or designated for targeted financial sanctions;
• the nature and purpose of the business relationship or one-off transaction;
• any other matter the Rules specify.

To get there, the Act sets the method. For an individual, take reasonable steps to establish that they are who they claim to be. Identify the client's ML/TF risk from the information reasonably available before you start. Collect KYC ("know your customer") information appropriate to that risk, and verify as much of it as is appropriate to the risk "using reliable and independent data".⁴ In rating the risk you must take into account your own ML/TF risk assessment, the kind of client, the service, how you deliver it, the countries involved and any matter the Rules add.⁵

The Rules set minimum KYC for sole traders, companies, partnerships and associations, trusts and government bodies (Rules 6-1 to 6-4). Your policies must say when you collect information and when you also verify it, including source of wealth and source of funds.⁶ AUSTRAC's overview of customer due diligence walks through each kind of client. AUSTRAC links open in a new window; AUSTRAC has not reviewed or endorsed this guide.

Beneficial owners

A beneficial owner of a company, trust or other non-individual is an individual who ultimately owns, directly or indirectly, 25% or more of it, or who controls it, directly or indirectly.⁷

• Listed companies and government bodies. You are taken to have established the beneficial owners of a listed public company subject to public disclosure requirements that make its owners transparent, of a government body, and of an entity controlled by either. Rules 6-7
• When you cannot find them. For a company, partnership or association, if you have taken all reasonable steps and still cannot identify the beneficial owners, record the steps and the difficulties, then identify the chief executive officer (or equivalent) and verify that information as the risk requires. If there are no beneficial owners, you identify the chief executive officer instead. Rules 6-8

Politically exposed persons and sanctions

A foreign PEP always brings enhanced CDD.⁸ Your policies must require a senior manager's approval before you start acting where the client, a beneficial owner or a person the client acts for is a foreign PEP, and where they are a domestic or international-organisation PEP and the client's risk is high.⁹ In those cases you must also establish the source of the PEP's wealth and funds.¹⁰ If one of those people becomes a foreign PEP during the relationship, or a domestic or international-organisation PEP while the client's risk is high, you review and, where appropriate, update and reverify the KYC information, and a senior manager decides whether you continue.¹¹

Your policies must also ensure you do not make assets available to a person designated for targeted financial sanctions in breach of the Autonomous Sanctions Act 2011 or the Charter of the United Nations Act 1945.¹² This guide does not explain how those Acts work.

Delayed CDD: starting before the checks are finished

The Act lets you start before CDD is finished only where all of these hold: the Rules allow it for the circumstance; you decide on reasonable grounds that starting first is essential to avoid interrupting the ordinary course of business; your policies complete CDD as soon as reasonably practicable and within any Rules period; you decide on reasonable grounds that the extra risk is low; and your policies manage that risk.¹³

Two of the circumstances the Rules set can apply to these sectors.

The general rule. For most services, the Rules allow a delay of up to 20 business days after you start. Before you start you must have taken reasonable steps to establish that an individual client is who they claim to be, identified the client's risk, collected KYC information on all the section 28 matters (except a PEP's source of wealth and funds), and established the client's identity and the identity and authority of anyone acting for them. Until initial CDD is complete you must not transfer money or property for the client or make it available to them, although you may hold it on deposit. The general rule does not apply where the real estate window below does. Rules 6-12

The real estate window. The Rules allow a delay in three real estate cases:¹⁴

• an agent brokering a sale, for the buyer, once the agent has started acting for the seller;
• an agent brokering a sale, for the seller, once the agent has started acting for the buyer;
• a conveyancer or lawyer assisting the buyer in the transaction (Table 6, item 1).

AUSTRAC gives the example of an auction, where the buyer may only be known after the fall of the hammer.¹⁵

Agent and conveyancer arrangements. Where your only service to the client is brokering or assisting a real estate transaction, you are taken to have established the matters in s 28(2)(b), (d), (e) and (g) (people the client acts for, beneficial owners, PEP and sanctions status, and Rules matters, but not the client's own identity, anyone acting for the client, or the nature and purpose) if you have taken reasonable steps on identity, identified the risk and collected KYC information, and you are part of an arrangement under which another participating reporting entity (often the conveyancer) will collect and verify the KYC information within 28 days after exchange, lets you have it and the verification data at least 3 days before the initially agreed settlement day, and documents each participant's responsibilities, including for records.¹⁶ Your policies must say how you will verify before settlement if that information does not arrive.¹⁷

A party who will not cooperate. An agent who has taken all reasonable steps with the other side of the sale, but could not complete CDD because that person would not cooperate, is taken to have met the requirement if the steps and difficulties are recorded and the agent records its consideration of whether a suspicious matter report is required. The refusal must be taken into account in that decision.¹⁸

Simplified and enhanced CDD

Simplified CDD is not a list of safe client types. You may apply simplified measures only where the client's risk is low, no enhanced-CDD trigger applies, and your policies deal with how you apply them.¹⁹

Enhanced CDD is mandatory, and must be appropriate to the risk, when any of these applies:²⁰

"Connected" here means the client, a beneficial owner, a person the client acts for or a person acting for the client. Where the high-risk, reporting or high-risk-jurisdiction trigger applies and it is relevant to the risk, establish the client's source of wealth and source of funds.²¹

Ongoing CDD

For as long as you act, you must monitor clients to identify, assess, manage and mitigate ML/TF risk.²² In practice that means:

• watching for unusual transactions and behaviour that may lead to a suspicious matter report: unusually large or complex, an unusual pattern, no apparent economic or lawful purpose, or out of line with what you know of the client;
• for an ongoing relationship, reviewing the client's risk rating after a significant change or unusual activity;
• refreshing and, where appropriate, reverifying KYC information at a frequency suited to the risk, and whenever you doubt that it is adequate or true.

If a suspicion forms, see our suspicious matter reports guide.

Clients you had before 1 July 2026

A client is a pre-commencement customer if your business relationship with them involved only real estate services, professional services or dealing in precious metals and stones as at the start of 1 July 2026.²³ You do not need to complete initial CDD for them, and the risk-rating review in s 30(2)(b) does not apply, until either:²³

• a suspicious matter reporting obligation arises for the client; or
• a significant change in the nature and purpose of the relationship makes the client's risk medium or high.

You must monitor for that kind of change, and the other ongoing CDD duties still apply.²⁴ Once you complete initial CDD, the client stops being a pre-commencement customer. AUSTRAC's transitioning existing customers page explains how it expects you to judge whether a relationship existed, including how long and how recently you acted for the client.²⁵

Relying on someone else's checks

• An agent collecting for you. You may authorise an agent to collect and verify KYC information for you, but you remain liable for it. s 37
• A written reliance arrangement. You may rely on another party's collection and verification under a written agreement or arrangement that meets Rules 6-29: among other things, the other party is a regulated entity, you can get the KYC information in time and the verification data on request, and each party's responsibilities, including record-keeping, are documented. A senior manager approves entering into it. Assess it at least every 2 years and after any significant change, and write up each assessment within 10 business days. s 37A s 37B Rules 6-30 Rules 5-5
• Case-by-case reliance. Without an agreement, you may rely on another regulated party's procedure where that is appropriate to the risk, you can obtain the information and data, and you document your reasons. s 38 Rules 6-31

Keep the record

Keep records that show your CDD complied with Part 2, including the type and content of the data collected and any risk analysis or decision you made. Keep them for 7 years from the end of the relationship, or from completing a one-off transaction.²⁶ See our record-keeping guide.

Where we fit

We do not carry out CDD for you and we do not act as your compliance officer. AUSTRAC's program starter kits are free. Our kit builds on them. Every edition includes onboarding CDD forms for each kind of client, an enhanced CDD form, ongoing review forms and a pre-commencement customer register. The real estate agency and conveyancer editions add a delayed CDD and settlement verification procedure. Our set-up service tailors them to your practice.

• Your sector: accounting practices, real estate agencies, conveyancers and legal practices.
• More guides: the guides page and every source on our sources page.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.