Digital ID for KYC: what 1 December 2026 means for firms
What the private sector opening of the Australian Government Digital ID System means for KYC at Tranche 2 firms, AUSTRAC's test and myID charges from 2027.
From 1 December 2026, the Australian Government Digital ID System (AGDIS) is set to support private sector participation, and the Digital ID Regulator says private businesses can apply to join as relying parties from December 2026. That means an accounting, legal or real estate firm could accept a client's myID or an approved private Digital ID as part of its know your customer (KYC). It is optional, it covers only one part of customer due diligence, and businesses that use myID as a relying party will be charged for it from 1 January 2027 at the latest.
This article sits under our Digital ID Act hub. It is written for Tranche 2 firms deciding whether a Digital ID belongs in their onboarding, and answers three questions page one of Google mostly skips: does it satisfy the AML/CTF Rules, what does joining involve, and what will myID cost a business.
A quick look at current search results shows government pages on how to create a Digital ID, ministerial releases on the private sector phase, and vendor pages saying digital checks meet anti-money laundering (AML) duties. None of them connects the Digital ID Act's relying party duties to AUSTRAC's initial customer due diligence test.
What changes on 1 December 2026
The Digital ID Act 2024 set up AGDIS in phases. The Finance Minister announced on 26 June 2026 that the framework is moving to support private sector participation from 1 December 2026. Some government pages describe the same opening as "after 30 November 2026".
- Private relying parties can apply. Businesses can apply to the ACCC, as Digital ID Regulator, for approval to participate.
- Private providers can join. Accredited private Digital ID providers who join may be used by selected government services and can charge commercially for their use.
- myID is the incumbent. The Digital ID System's agency guide says myID, offered by the Australian Taxation Office (ATO), is currently the only accredited Digital ID service provider approved to participate in AGDIS.
Can a Digital ID be used to verify identity under the AML/CTF Rules?
It can be part of it. AUSTRAC's initial customer due diligence (CDD) guidance says you can use third-party digital identity services to verify KYC information if the data you receive is reliable and independent. AUSTRAC expects you to consider whether the data is independent and reliable, who maintains it (for example a government body), whether the system is secure and kept up to date, and any other factors relevant to you. We did not find a provision in the AML/CTF Rules that names AGDIS or myID specifically; the general test applies.
Three limits matter in practice:
- A Digital ID speaks to the individual's identity only. Initial CDD also requires you to establish, on reasonable grounds, persons acting on the customer's behalf and their authority, beneficial owners of non-individual customers, whether anyone is a politically exposed person or designated for targeted financial sanctions, and the nature and purpose of the relationship. A Digital ID does none of that.
- Identity strength varies. A Basic myID needs only entered personal details. A Standard myID needs two Australian identity documents verified. A Strong myID adds a one-off face check against the passport photo (or a WA driver licence). Your anti-money laundering and counter-terrorism financing (AML/CTF) policies should say which strength, if any, you accept for which customers and risk levels.
- You still own the decision and the record. AUSTRAC expects you to keep records of how you established each matter on reasonable grounds, for each customer, for 7 years after the relationship ends.
What joining AGDIS as a relying party involves
A firm does not need to be accredited to be a relying party. The Digital ID System says relying parties are not required to be accredited to use a Digital ID provider, though existing privacy obligations still apply. Joining AGDIS itself needs approval and brings duties.
Before you apply
Under the Digital ID Rules 2024, a relying party must first run a risk assessment of cyber security incidents and Digital ID fraud incidents for the service it plans to offer. When it applies it must have three written plans approved by its governing body and reviewed at least yearly: a cyber security plan, a Digital ID fraud management plan, and a disaster recovery and business continuity plan.
After approval
- Tell the Digital ID Regulator about a change to your contact details within 7 days.
- Notify the System Administrator of material IT changes or outages within 5 business days of becoming aware.
- Collect and store the pairwise identifier issued for each individual.
Voluntariness
Section 74 of the Digital ID Act says a participating relying party must not require an individual to create or use a Digital ID as a condition of providing a service. You must offer another way that is reasonably accessible and not substantially less favourable. The Act's own example is a bank that lets customers verify in a branch instead. Two exceptions are relevant to professional firms:
- The duty does not apply where the individual is acting on behalf of another entity in a professional or business capacity. The ACCC says whether this applies depends on the case and recommends legal advice.
- The Regulator may grant an exemption, and may consider whether the applicant is a small business or provides services solely online. The ACCC says exemptions are not automatic and can only be applied for after approval.
For most firms this means a Digital ID can be one choice in onboarding, never the only one.
What myID will cost a business
The government's charging settings, published 26 June 2026, say:
| Item | Position |
|---|---|
| Who pays for myID | Businesses using myID as a relying party listed on the AGDIS Register |
| When | From 1 January 2027 at the latest |
| How | Envisaged as a simple per transaction fee, invoiced in arrears |
| Price | Not yet set; a mandatory 28-day public consultation on fees is expected first |
| Individuals | Not charged to create or use a myID |
| Machine-to-machine myID use (such as accounting software talking to the ATO) | Not charged at this stage |
| ATO Relationship Authorisation Manager, Digital ID Exchange, accreditation fees | Not charged at this time; may be introduced later |
| Private Digital ID providers | Can charge commercially for their services |
The settings will be reviewed after a year in operation. Until fees are published, any cost comparison with your current identity checks is an estimate.
Deciding whether it fits your firm
For an accounting, legal or real estate firm, the decision usually comes down to four questions:
- Who are your clients? myID's Strong level depends on an Australian passport or a WA driver licence. Clients with foreign documents may not reach it; the Finance Minister's release notes some government services may prefer private providers for that reason.
- What else must you establish? If most clients are companies or trusts, the Digital ID covers the individuals but not beneficial ownership or authority to act.
- Can you carry the relying party duties? Three governing-body plans, incident notifications and a voluntary alternative channel are a real commitment for a small firm.
- What does your AML/CTF program say? Whatever you choose, document it in your policies, including which identity strength you accept and what you do when a client declines.
What StackGo does here
IdentityCheck does not accept myID or other Australian Government Digital IDs today. It verifies identity with a biometric check: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories (see Verify). In Australia, government document verification through the Document Verification Service (DVS) is an add-on, quoted on request. It also screens against politically exposed person (PEP), sanctions and adverse media sources (see Screen), which a Digital ID does not cover.
Frequently asked questions
Will Digital ID be mandatory for my clients?
No. Section 74 of the Digital ID Act requires participating relying parties to offer another reasonably accessible way, subject to limited exceptions and exemptions.
Does a myID check satisfy AUSTRAC on its own?
No. AUSTRAC accepts digital identity services where the data is reliable and independent, but a Digital ID covers the individual's identity only. You still need the other initial CDD matters, including PEP and sanctions checks.
When can a private business join AGDIS?
The government's date for private sector participation is 1 December 2026. The Digital ID Regulator says private sector entities can apply from December 2026; applications go to the ACCC as Digital ID Regulator, and joining requires approval.
How much will myID cost a business?
The price has not been set. The government plans a per transaction fee from 1 January 2027 at the latest, after a 28-day public consultation.
Sources
- Minister for Finance: Digital ID expands to the private sector (26 Jun 2026)
- Digital ID System: The Australian Government Digital ID System (AGDIS) (9 Nov 2026)
- Digital ID System: Policy settings for charging and user choice in the Australian Government Digital ID System (26 Jun 2026)
- AUSTRAC: Overview of initial customer due diligence (5 Nov 2026)
- AustLII: Digital ID Act 2024 (Cth), section 74 (5 Nov 2026)
- ACCC (Digital ID Regulator): Voluntariness obligation in the Australian Government Digital ID System (5 Nov 2026)
- Federal Register of Legislation: Digital ID Rules 2024 (compilation from 30 Sep 2026) (30 Sep 2026)
- Digital ID System: Using Digital ID for your business or organisation (5 Nov 2026)
- Digital ID System: Step-by-step guide for Commonwealth agencies (5 Nov 2026)
- myID: How to set up myID (identity strength) (5 Nov 2026)
- ACCC: Digital ID regulation (5 Dec 2025)