Customer due diligence under Tranche 2: practical steps businesses should be taking now
Customer due diligence is often reduced to a simple instruction: collect identification from the customer.
Under Australia’s reformed AML/CTF regime, that is not enough.
Identification may establish a customer’s name and basic details. Customer due diligence, or CDD, requires a business to understand who is really involved, why the regulated service is being requested and whether the customer presents a higher money laundering or terrorism financing risk.
For newly regulated businesses, these processes should now be operating. Tranche 2 obligations commenced on 1 July 2026, and AUSTRAC expects affected businesses to have an AML/CTF program, trained staff and processes that allow them to engage with customers and respond to suspicious matters.
The practical test is not whether the organisation owns a customer identification form.
It is whether staff can consistently:
identify the correct customer
verify the information collected
establish who owns or controls a customer
understand representatives and other involved parties
identify higher-risk indicators
assign and explain a customer risk rating
decide whether standard or enhanced due diligence is required
retain evidence supporting the decision.
Identification tells you who is in front of you. Due diligence tells you who is really involved, why the service is being requested and whether the explanation makes sense.
What is customer due diligence?
Customer due diligence is the process of collecting and verifying information about a customer so the business can understand and manage the customer’s money laundering, terrorism financing and proliferation financing risk.
CDD has two connected parts:
Initial CDD, conducted when the customer seeks a designated service.
Ongoing CDD, conducted throughout a continuing business relationship or while the customer continues to use designated services.
Initial CDD must generally be completed before the business starts providing a designated service. If the required matters cannot be established on reasonable grounds, the business must not begin providing that service. Limited delayed-verification arrangements may apply in specific circumstances, but they should not be treated as a general extension or used merely because completing CDD is inconvenient.
Businesses therefore need to decide exactly where CDD sits within their customer or matter-opening process. The point at which a regulated service begins should not be left unclear.
1. Define when CDD is triggered
The first practical step is to connect the organisation’s designated-service assessment with its customer onboarding process.
A business should not perform full AML/CTF onboarding for every enquiry without considering whether a designated service will be provided. Equally, staff should not be able to commence regulated work before recognising that CDD is required.
The organisation should document:
which services require initial CDD
which customer or matter types are outside scope
when a customer becomes a customer for AML/CTF purposes
at what point the designated service begins
who can determine whether an activity is regulated
what staff must do when the position is uncertain
when work must pause pending further checks.
This can be built into a client intake form, matter-opening checklist or sales workflow. For example, a professional services business may ask staff to select the type of service being requested before a matter can be opened. A real estate agency may connect its CDD process to the appointment of the agency and the parties involved in the transaction. A precious-metals dealer may use payment method and transaction value to determine whether a designated service is being provided.
The process should make the compliance decision visible rather than relying on staff to remember the rules unaided.
2. Use onboarding processes designed for different customer types
CDD requirements differ according to whether the customer is:
an individual
a sole trader
a company or other body corporate
a partnership
an unincorporated association
a trust
a government body.
A single identification form is unlikely to collect everything required for each of these structures.
The organisation should therefore have an onboarding process for each material customer type. The form or workflow should collect the minimum information needed to identify the customer, while allowing additional information to be requested where the customer or service presents greater risk.
AUSTRAC describes a risk-based sequence in which businesses collect KYC information, identify the customer’s ML/TF risk, determine whether PEP, sanctions or enhanced CDD requirements apply, collect additional information where necessary and verify information using reliable and independent data.
The onboarding process should also distinguish between collecting and verifying information.
Collecting information means obtaining details from the customer, their representative or another source. Verifying information means checking those details against reliable and independent information or data.
This distinction matters. Recording what the customer says does not automatically establish that the information is accurate.
3. Identify and verify the customer
The organisation needs a documented method for establishing the customer’s identity on reasonable grounds.
For an individual, this will ordinarily involve collecting and verifying information such as their name, date of birth and residential address using appropriate identity information or data.
For a company, trust or other structure, the process may involve:
confirming the entity’s legal name and registration details
understanding its legal form
identifying relevant trustees, partners or officeholders
examining ownership and control
checking information against government registers, governing documents or other reliable sources.
The level of verification should be appropriate to the customer’s ML/TF risk. AUSTRAC expects more information to be collected and verified in higher-risk or unusual situations than in lower-risk circumstances. Digital identity services may be used, but the reporting entity should consider whether the underlying data is independent, reliable, secure and current.
The organisation also needs a defined response when information is inconsistent.
A name discrepancy, an unexplained address history or a difference between an onboarding form and a company register may have an innocent explanation. It may also indicate that more information is required.
The process should tell staff:
when to ask the customer for an explanation
what supporting evidence may be accepted
when an independent source should be checked
when the matter must be escalated
what happens if the business cannot establish the customer’s identity.
Where the business reasonably suspects that a customer is not who they claim to be, a suspicious matter reporting obligation may also arise.
4. Understand beneficial ownership and control
For customers that are not individuals, identifying the legal entity is only part of the process.
The business must also understand who ultimately owns or controls the customer.
Under AUSTRAC’s guidance, a beneficial owner is an individual who directly or indirectly owns 25 per cent or more of the customer or otherwise controls the customer. There may be several beneficial owners, and the organisation may need to follow multiple layers of companies, trusts or other structures until it reaches the relevant individuals.
A practical beneficial ownership process should require staff to:
obtain information about the customer’s ownership and control structure
identify each person or entity within the ownership chain
follow the chain until the relevant individual owners or controllers are identified
collect appropriate KYC information about those individuals
verify the information to the level required by the customer’s risk
record any difficulties, inconsistencies or unresolved questions.
Potential evidence may include:
ASIC information
company constitutions
trust deeds
partnership agreements
shareholder information
organisational charts
annual statements or other corporate records.
The purpose is not simply to obtain an ownership chart from the customer. It is to form a reasonable view about who ultimately owns or controls the structure.
Where a structure is unnecessarily complex, involves unexplained intermediaries or does not align with the stated purpose of the transaction, the business should consider whether the customer’s risk rating should increase and whether enhanced CDD is required.
5. Confirm who is acting for whom
CDD must also establish the identity of people acting on behalf of a customer and their authority to act.
This is common where a company interacts through an employee, an individual uses an agent, a buyer engages a representative or a person operates under a power of attorney.
The organisation should determine:
who the actual customer is
who is communicating with the business
whether that person is acting for themselves or someone else
the nature of their authority
whether the authority has been verified
whether another person is receiving the benefit of the service.
Evidence of authority could include an agency agreement, power of attorney, employer confirmation, board authority, court appointment or another reliable record. AUSTRAC does not require every representative associated with a customer to be identified; the focus is on representatives who engage with the reporting entity in relation to its designated services. This step should not be treated as an administrative detail.
An unclear relationship between the customer, the person giving instructions and the person benefiting from the service can be an important risk indicator.
6. Establish the nature and purpose of the relationship
The business should understand why the customer wants the designated service and how they expect to use it. This provides a baseline against which future behaviour can be assessed.
Relevant information may include:
the service being requested
whether the transaction is personal or commercial
the expected size, volume or frequency of transactions
how the service will be delivered
the customer’s occupation or business activity
where funds or assets are expected to come from
the relationship between the customer and other involved parties
the expected duration of the relationship.
In straightforward cases, the nature and purpose may be apparent. A couple seeking conveyancing services to purchase a home in which they will live may require little additional explanation.
Other cases may require more questions. A newly incorporated company acquiring high-value assets through several overseas entities, for example, may require the business to understand the commercial rationale, ownership structure and source of funds in greater detail.
AUSTRAC says that understanding the nature and purpose of the relationship helps the reporting entity assess customer risk, establish expected behaviour and later identify activity that does not align with the stated purpose.
A useful onboarding question is therefore not simply, “What service do you require? It is, “Why are you seeking this service, who is involved and what should we reasonably expect to occur?”
7. Screen for higher-risk indicators
The business should have a reliable process for determining whether the customer or associated parties present specific higher-risk indicators.
This includes establishing whether relevant people are:
politically exposed persons
designated for targeted financial sanctions
associated with higher-risk countries or jurisdictions.
The checks may need to cover the customer, beneficial owners, persons acting on the customer’s behalf and persons on whose behalf the customer receives the designated service. Screening should not be reduced to a system result that nobody reviews.
The organisation should define:
which parties must be checked
what data is needed for an accurate search
which screening tool or source will be used
how potential matches will be investigated
who can clear a false match
when the compliance officer must be involved
how the result and decision will be recorded
whether and how customers will be rescreened.
A PEP match does not automatically mean the customer has committed wrongdoing. It means the business needs to understand and manage the additional risk in accordance with the applicable requirements.
Similarly, a sanctions match requires careful and immediate handling. Staff should know not to proceed simply because a customer disputes the result.
8. Assign a customer risk rating
CDD should result in a documented assessment of the customer’s ML/TF risk. A risk rating should not be an unexplained label selected at the end of the form.
The methodology should connect the customer to the risk factors identified in the organisation’s broader ML/TF risk assessment, including:
the customer type
the designated service
the delivery channel
countries and jurisdictions involved
ownership and control complexity
representatives and third parties
transaction size and payment method
PEP or sanctions considerations
unusual behaviour or inconsistencies.
AUSTRAC expects businesses to develop a consistent method that checks which risk factors are present, considers their nature and scale and reaches an overall customer risk rating. The rating then informs the additional KYC information required and the intensity of ongoing monitoring.
A simple small-business methodology may use low, medium and high categories with clearly defined triggers.
The important issue is that different staff considering similar customers should reach broadly consistent outcomes, and that the business can explain why the rating was assigned.
9. Escalate higher-risk customers for enhanced due diligence
Where a customer is assessed as high risk, the organisation must apply enhanced CDD.
Enhanced CDD may also be required in specific circumstances, including certain PEP or high-risk-jurisdiction situations, unusual or highly complex activity, or where an SMR obligation arises and the organisation intends to continue providing designated services.
Enhanced measures should respond to the reason for the elevated risk. They may include:
collecting additional KYC information
verifying information from further independent sources
obtaining more detail about ownership or control
establishing source of funds
establishing source of wealth
obtaining senior management approval
increasing ongoing monitoring
restricting the service
deciding not to proceed.
Source-of-funds and source-of-wealth checks should not become generic requests for documents with no clear purpose. The business should understand what question it is trying to answer and whether the information obtained reasonably supports the customer’s explanation.
A higher-risk customer is not automatically prohibited. The business must decide whether it can understand and manage the risk within its risk appetite and AML/CTF controls.
10. Do not forget existing customers
Newly regulated businesses should distinguish between new customers and qualifying pre-commencement customers.
AUSTRAC’s guidance allows businesses, in certain circumstances, to continue providing designated services to pre-commencement customers without immediately completing full initial CDD. However, ongoing CDD obligations still apply.
Initial CDD must be completed for a pre-commencement customer if an SMR obligation arises or if there is a significant change in the nature and purpose of the relationship that results in the customer’s risk being medium or high. Businesses must also monitor these customers, review and update KYC information where appropriate, and respond to changes in the relationship.
This means organisations should not assume that every historical customer needs to be fully re-onboarded immediately. They should instead:
identify which customers qualify as pre-commencement customers
document that classification
apply ongoing monitoring
define events that trigger updated checks
complete initial CDD when the legislative triggers arise.
A blanket approach may create unnecessary customer disruption while still failing to focus attention on the relationships that present the greatest risk.
11. Make CDD an ongoing process
CDD does not end once the customer has passed onboarding. Businesses must monitor customers for unusual transactions and behaviour, review customer risk when circumstances change and update or reverify KYC information where appropriate.
Triggers may include:
a change in ownership or beneficial owners
a new representative
a move into a higher-risk jurisdiction
a different designated service
an unexplained increase in transaction value or frequency
a change in the customer’s business model
inconsistent or outdated information
unusual payment arrangements
behaviour that may give rise to an SMR.
The frequency and depth of reviews should reflect customer risk. Higher-risk customers should ordinarily receive more frequent and intensive review than lower-risk customers.
The organisation should also test whether its ongoing CDD process is working. This can include sample reviews, exception reporting and regular reporting to the AML/CTF compliance officer.
What organisations should review now
Businesses that have commenced CDD should use their first completed customer files to test whether the process works in practice. A practical review should ask:
Was the service correctly identified as regulated?
Was CDD completed before the service commenced, unless a valid exception applied?
Was the correct customer type used?
Was information both collected and appropriately verified?
Were beneficial owners traced to the relevant individuals?
Were representatives and their authority understood?
Was the nature and purpose of the relationship recorded?
Were relevant PEP and sanctions checks completed?
Was the customer risk rating supported by the information collected?
Were higher-risk matters escalated and approved?
Can the business reconstruct how and why the decision was made?
Are ongoing review triggers recorded?
AUSTRAC has said it expects newly regulated businesses to continue embedding and improving their processes during the 2026–27 financial year. Its expectation is effort rather than immediate perfection, but that effort should be visible through implemented controls, documented decisions and active remediation.
Customer due diligence should improve the decision
The purpose of CDD is not to collect the largest possible quantity of customer information.
It is to obtain enough reliable information to make a defensible decision about:
who the customer is
who owns, controls or represents them
why they are seeking the service
what risks they bring
what level of control is appropriate
whether the business should proceed.
A process that collects identification but does not influence the customer risk rating, approval decision or ongoing monitoring is incomplete.
Good customer due diligence does not end with a verified identity. It ends with an informed decision, supported by evidence.
Branova helps newly regulated businesses design practical customer due diligence processes, including onboarding workflows, beneficial ownership checks, risk-rating methodologies, enhanced due diligence procedures and evidence requirements.
This article provides general information and does not constitute legal advice. The obligations applying to a business will depend on its designated services, customers and particular circumstances.
Comments