Guide

Initial CDD under the AML/CTF Rules 2025 and the 2029 transition

What initial customer due diligence requires under the AML/CTF Rules 2025, what changed from ACIP, and how the transition to 31 March 2029 works.

By Matt Collis·Updated 12 November 2026·Reviewed 12 November 2026·7 min read

Under the AML/CTF Rules 2025, initial customer due diligence means establishing a set list of matters about each customer on reasonable grounds before you provide a designated service, using know your customer (KYC) information collected and verified in proportion to the customer's risk. Existing reporting entities enrolled on 30 March 2026 may keep using their old customer identification procedures for classes of customers named in their policies until 31 March 2029, but only for initial CDD.

This guide sits under our AML/CTF Rules 2025 hub. It covers what changed from the old KYC rules, what "establish on reasonable grounds" asks of you, how the transition works, and why most Tranche 2 firms cannot use it.

Search results for this topic lead with AUSTRAC's guidance and law firm summaries of the transitional rules. They describe each piece well. What they rarely do is put the old and new models side by side, or turn the transition into a plan with dates.

What initial CDD now requires

AUSTRAC's guidance, citing sections 28(2) and 111 of the Act and sections 6-21 and 6-23 of the Rules, says you must establish these matters on reasonable grounds before you start providing a designated service:

  • the identity of the customer;
  • the identity of anyone on whose behalf the customer is receiving the service, such as a trust beneficiary;
  • the identity of anyone acting on the customer's behalf, and their authority to act;
  • for a customer that is not an individual, the identity of its beneficial owners;
  • whether the customer or any of those people is a politically exposed person or designated for targeted financial sanctions;
  • the nature and purpose of the business relationship or occasional transaction;
  • source of funds and source of wealth for foreign PEPs and high-risk domestic or international organisation PEPs; and
  • where enhanced CDD applies, source of funds and wealth if relevant to the risk.

If you cannot establish these matters on reasonable grounds, you must not start providing the service. Where risk is low, no enhanced CDD is needed and your policies deal with it, you may apply simplified CDD. AUSTRAC says simplified CDD is not an exemption from your initial or ongoing CDD obligations.

What "establish on reasonable grounds" means

AUSTRAC calls it an objective standard: a reasonable person in your position would decide the matter is established, based on the facts, circumstances and information you knew or could reasonably be expected to have known at the time. AUSTRAC expects you to be able to explain how each matter was established, so that a reasonable person with similar knowledge and training, reviewing the same material, would likely reach the same conclusion. You must keep a record of how you established each matter for each customer.

To get there, AUSTRAC lists four things you must do: for an individual, take reasonable steps to establish they are who they claim to be; identify the customer's money laundering and terrorism financing (ML/TF) risk; collect KYC information appropriate to that risk; and verify KYC information using reliable and independent data appropriate to that risk. In practice:

  1. Collect KYC information, usually through an onboarding form.
  2. Identify the customer's ML/TF risk.
  3. Check for PEPs and targeted financial sanctions.
  4. Decide whether enhanced CDD applies.
  5. Decide whether simplified CDD or deemed compliance applies.
  6. Collect more KYC information where the risk calls for it.
  7. Verify KYC information with reliable and independent data.

AUSTRAC expects you to verify at least one piece of KYC information for each matter, unless an exception applies, and more for higher risk or unusual requests.

What changed from the old KYC rules

TopicBefore 31 March 2026 (ACIP)AML/CTF Rules 2025
Core testCarry out the applicable customer identification procedure in Part B of the program and be reasonably satisfied of identityEstablish a list of matters on reasonable grounds, an objective standard, before providing the service
Program structurePart A and Part B programsAnti-money laundering and counter-terrorism financing (AML/CTF) policies must set out when you collect, or collect and verify, kinds of KYC information
SanctionsNot among the ACIP elements listed in AUSTRAC's pre-reform guidanceWhether anyone is designated for targeted financial sanctions is a listed matter
TrustsACIP was required on the trusteeInitial CDD is conducted on the trust
Copies of IDThe Office of the Australian Information Commissioner (OAIC) says copies made before 31 March 2026 are AML/CTF records that may be kept for 7 yearsAUSTRAC says you are not required to keep scanned copies or photocopies of identity documents

Records of initial CDD must be kept for 7 years after the business relationship ends, or 7 years after the last occasional transaction.

How the transition to 31 March 2029 works

Part 3 of the AML/CTF Transitional Rules 2026 lets an existing reporting entity keep using its ACIP instead of the new initial CDD obligations. AUSTRAC says it applies if both of these are true:

  • you were enrolled as a reporting entity on 30 March 2026; and
  • you maintain AML/CTF policies requiring ACIP that complied with the Rules in force on that date.

The period runs from 31 March 2026 to 31 March 2029, when section 7 of the Transitional Rules ceases to have effect. The conditions:

  • By 1 July 2026 your policies had to list the classes of customers you apply ACIP to and the date you will stop applying it to each class.
  • One approach per class. You can define classes by legal form, location, service type or business line, and move them across at different times, but each class is under ACIP or the new framework at any one time.
  • Old safe harbours stay with ACIP. For ACIP classes you may rely on the pre-reform delayed verification and safe harbour provisions, including sections 33 and 34 of the Act as they stood.
  • New tools wait. You cannot use the new deemed compliance or delayed CDD provisions for services in Australia until a class has moved to the new framework.
  • Ongoing CDD is new now. The new ongoing CDD obligations have applied to all customers since 31 March 2026.

Customers on whom you completed ACIP before 31 March 2026 are treated as meeting initial CDD under section 6-42 of the Rules, though ongoing CDD still applies. AUSTRAC also expects a documented implementation plan if you cannot meet updated obligations by the required date, showing how you manage risk in the meantime, what gaps you found and how you will close them.

Why most Tranche 2 firms cannot use the transition

The ACIP transition depends on being enrolled on 30 March 2026. Accountants, lawyers, conveyancers, real estate professionals and trust and company service providers became reporting entities from 1 July 2026, so they had no ACIP to continue. They apply the new initial CDD framework from the start. Their separate relief is for pre-commencement customers: people they were already acting for before 1 July 2026. AUSTRAC says initial CDD is needed for those customers when a suspicious matter reporting obligation arises, or when a significant change in the relationship makes the customer's risk medium or high.

What to do now

  1. Check your status. Enrolled on 30 March 2026, or a Tranche 2 entity starting fresh.
  2. If you use the transition, confirm your policies name each class and its stop date, and that your implementation plan shows progress. AUSTRAC asks for sustained effort against the plan.
  3. Move higher-risk classes first. Classes where you already need more information, such as trusts and complex structures, gain most from the new model.
  4. Write down your reasonable grounds. For each customer type, set out which KYC information you collect, which you verify, from what source, and what happens on a discrepancy.
  5. Review your records. Keep what shows how each matter was established. Revisit holding full copies of ID documents where you no longer need them.
  6. Do not wait for 2029. Ongoing CDD obligations already apply to every customer.

What StackGo does here

IdentityCheck covers several of the collection and verification steps in initial CDD. Onboarding forms collect KYC information, including multi-entity forms that collect each person and entity on a structure (Intake). It verifies individuals with a biometric document and selfie check with liveness (Verify), screens against PEP, sanctions and adverse media sources (Screen), and runs risk assessment forms with scoring and enhanced due diligence steps (Assess). It does not write your AML/CTF policies, decide your customer classes, monitor transactions or lodge reports with AUSTRAC.

Frequently asked questions

When does the ACIP transition end?

31 March 2029, when section 7 of the AML/CTF Transitional Rules 2026 ceases to have effect.

Can a Tranche 2 firm use ACIP until 2029?

No. The transition is for entities enrolled on 30 March 2026. Tranche 2 entities apply the new initial CDD framework from 1 July 2026.

Does the transition cover ongoing CDD?

No. The new ongoing CDD obligations have applied to all customers since 31 March 2026.

Do I have to verify every piece of KYC information?

No. AUSTRAC expects at least one piece for each matter you must establish, and more for higher-risk or unusual customers.

Sources

Ready to make onboarding minutes, not hours?

Start free and run your first check today, or book a demo and we will walk you through it.

Start freeBook a demo

Cookie settings

Choose which optional cookies we can use. You can change this at any time from Cookie settings at the bottom of every page.