ID checks are not onboarding: CDD for company and trust clients
What the AML/CTF Rules require when your client is a company, trust or partnership: the entity, its owners and controllers, who acts for it, and why.
A new client signs your engagement letter for a family trust with a company as trustee. The director does an ID check on their phone and passes. Under the AML/CTF Act, that is one person verified. Your customer is the trust, and section 28 of the Act lists six matters you must establish about it before you start work.
This page covers the whole job for clients that aren’t individuals: companies, trusts (SMSFs included), partnerships and associations. It sets out what the AML/CTF Rules 2025 make you collect for each, who you verify and screen, when you can do less or must do more, and what to keep on file. How to trace beneficial owners in practice is in getting UBO right under Tranche 2, and the general steps for any client are in our CDD checklist.
The six matters, for an entity
Section 28(2) of the Act applies to every customer. For an entity, each matter points to different people. The Rules then set the minimum information to collect: section 6-2 for a body corporate, partnership or unincorporated association, and section 6-3 for a trust.
| What you must establish | Company or partnership | Trust |
|---|---|---|
| The identity of the customer | The company or partnership itself | The trust itself, including what kind of trust it is |
| Anyone the customer receives the service on behalf of | Usually taken as met once you have the customer’s identity (Rules s 6-6(1)) | Each beneficiary, or a description of each class of beneficiary |
| Anyone acting on behalf of the customer, and their authority | The people who deal with you, such as a director or the client’s bookkeeper | The trustees, and anyone else who deals with you for the trust |
| The beneficial owners | Individuals who own 25% or more, or control it | Individual trustees, the owners of a corporate trustee, the settlor, appointor, guardian, protector and anyone else with control |
| Whether any of these people is a politically exposed person (PEP) or designated for targeted financial sanctions | All of the above | All of the above |
| The nature and purpose of the relationship | What the business does and why it wants your services | What the trust does and why it wants your services |
The ID check on the director covers one row, the person acting for the customer, and part of another if they are also an owner. That is why it isn’t onboarding.
When the work is due
Starting before verification is finished
The exception, not the rule: by default every matter is established before you start (Act s 28(1))
- First
Establish the entity and its representative
The entity’s identity, and the identity and authority of the person acting for it.
- Then
Start the designated service
Only if delaying is essential to avoid interrupting the ordinary course of business, and the extra risk is low.
Inconvenience is not a reason to delay.
- Within 20 business days
Finish verification
As soon as reasonably practicable, and no later than 20 business days after you start.
Sources: Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (s 6-12); AUSTRAC, Delayed initial customer due diligence Reviewed
Before you start providing the designated service. Section 28(1) of the Act says you must not start until each matter is established on reasonable grounds. In the accountant starter kit examples, Australian Transaction Reports and Analysis Centre (AUSTRAC) puts it as before entering into an agreement and actioning the instructions. Which of your services are designated services is set out in designated services for accountants.
Some of the work can wait. Under section 6-12 of the Rules, you can start before verification is finished if delaying is essential to avoid interrupting the ordinary course of business and the extra risk is low. You must still have established the entity’s identity and the identity and authority of the person acting for it, and you must finish as soon as reasonably practicable and within 20 business days. AUSTRAC is clear that inconvenience is not a reason to delay.
Clients you already acted for on 1 July 2026 may be pre-commencement customers. They don’t need initial customer due diligence (CDD) unless a suspicious matter reporting obligation arises, or a significant change in the relationship takes their risk to medium or high. AUSTRAC’s own example is a firm that set up a company for a client in June 2026, committed to restructuring their family trust, and started that work in July.
Companies, partnerships and associations: what to collect
Section 6-2(2) of the Rules sets the minimum for the customer’s identity:
- full name, any business names and any other names it is commonly known by
- a unique identifier if it has one, usually the Australian Company Number (ACN) or Australian Business Number (ABN)
- the principal place of business, and the registered office if different
- evidence that it exists
- information about the powers that bind and govern it, such as the constitution or partnership agreement
- the full name of each person with primary responsibility for governance and executive decisions, and their director identification number if they have one.
Section 6-2(3) adds information about the ownership and control structure, and section 6-2(4) the nature of the customer’s business or operations. For a partnership without a business name, AUSTRAC says the full name is the names of all the partners.
AUSTRAC’s guide for these customers suggests verifying an Australian company’s name and ACN on the Australian Securities and Investments Commission (ASIC) registers, and a partnership’s name from the partnership agreement. If a company uses the replaceable rules in the Corporations Act, you can get its governing rules from public sources.
Trusts: what to collect
A trust with a corporate trustee: three layers
| Layer | Its role | What you do |
|---|---|---|
| The trust | The customer | Identify it under Rules s 6-3: the trust, its beneficiaries or classes, and any settlor, appointor, guardian or protector |
| The trustee company | The trustee | Identify it as you would a company customer (Rules s 6-2). Its beneficial owners become beneficial owners of the trust |
| The person at the trustee company who deals with you | The representative of the trustee, and so of the trust | Establish their identity and their authority to act |
Sources: AUSTRAC, Initial CDD for trust; Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 6-2, 6-3) Reviewed
Section 6-3 of the Rules sets out more for a trust, because it has more roles to identify:
- The trust: full name, the kind of trust (discretionary, unit, bare or other), business names, other names, any unique identifier such as an ABN, the principal place of business or operations, evidence that it exists, and the powers that govern it
- Who runs it: the full name of each person with primary responsibility for its governance and executive decisions. AUSTRAC says this is typically all the trustees, appointors, guardians and protectors
- Who it benefits: the identity of each beneficiary or, if the nature of the trust makes that impossible, a description of each class of beneficiary (s 6-3(3))
- Who acts for it: the identity of the trustees (s 6-3(4))
- Who controls it: the control structure, and the identity of any settlor, appointor, guardian or protector (s 6-3(5)).
The trust deed and any deeds of variation do most of the work. AUSTRAC’s trust guide also accepts ABN Lookup and letters from the trust’s lawyer or accountant, if that adviser has no role in the trust. A trust usually isn’t on a public register, so this is the part that rests on documents rather than a search.
With a corporate trustee, you deal with three layers: the trust, the trustee company, and the person at that company who deals with you. You identify the trustee company the way you would a company customer, and its beneficial owners become beneficial owners of the trust. AUSTRAC’s trust guide names self-managed super funds among the activities a trust can carry on, so an SMSF client follows these rules.
Beneficial owners: ownership and control
Section 5 of the Act defines a beneficial owner as an individual who ultimately owns, directly or indirectly, 25% or more of the customer, or who controls it, directly or indirectly. Control has no percentage. Under section 11 of the Act it includes more than half the votes or share capital, control of the board, or practical influence over financial and operating decisions.
Follow the chain of ownership until you reach individuals. In AUSTRAC’s ownership and control guidance, updated on 20 October 2026, a company’s sole shareholder is another company, which is owned by a third. Current and historical ASIC searches find Sarah, who owns 76% of the third company, and she is verified and screened as the beneficial owner. In the same guidance, a limited partner with 25% of the capital and no votes is a beneficial owner, and so is the sole shareholder of the general partner that holds all the votes.
Three rules change the work:
- Listed companies and government. If the customer is, or is controlled by, a listed public company subject to disclosure requirements that make its beneficial owners transparent, or a government body, you are taken to have established its beneficial owners (Rules s 6-7). AUSTRAC’s guide shortens this to “a listed public company”. The disclosure condition is in the Rules.
- Regulated or strata entities. For a low-risk customer that is, or is controlled by, an entity overseen by a prudential, insurance or investor protection regulator, or a strata or community title body, the same applies (Rules s 6-18).
- When you can’t find them. For a company, partnership or association, section 6-8 treats the matter as established if you took all reasonable steps, recorded the steps and difficulties, collected the identity of the chief executive (or equivalent), and verified it as the risk requires. If there are no beneficial owners, the chief executive’s identity is a matter you must establish. Section 6-8 doesn’t cover trusts.
Who you verify and screen
For each person acting for the entity, you establish their identity and their authority to act. Section 6-19 of the Rules lets you rely on the information you collected about the representative without verifying it, if their authority is established, the extra risk they bring is low and nothing makes you doubt the information. AUSTRAC says you still verify the authority itself, for example with the trust deed and instrument of appointment for a trustee, or written confirmation from an employer.
Then screen. You check whether the entity and everyone connected to it is designated for targeted financial sanctions, using the DFAT Consolidated List or a screening service, and whether each individual is a politically exposed person. For a trust, AUSTRAC lists the trust, its trustees and representatives, all identifiable beneficiaries, and every individual settlor, appointor, guardian, protector or other controller. Where you have described beneficiaries as a class, section 6-6(3) of the Rules treats their screening as done.
Simplified, standard or enhanced
The same entity can need more or less work depending on its risk.
| Level | When it applies | What changes |
|---|---|---|
| Simplified | The customer is low risk, enhanced CDD doesn’t apply, and your anti-money laundering and counter-terrorism financing (AML/CTF) policies cover it (Act s 31, Rules s 6-16) | Beneficiaries, representatives and beneficial owners can be established from the information collected, without verifying it, if nothing gives you reason to doubt it (Rules s 6-17). You still collect it, and you still establish the entity’s own identity |
| Standard | Neither simplified nor enhanced applies | Collect and verify as appropriate to the risk. The nature and purpose doesn’t need verifying unless enhanced CDD applies (Rules s 6-9) |
| Enhanced | The risk is high; the customer, a beneficial owner, a beneficiary or a representative is a foreign PEP or is in a high-risk jurisdiction Financial Action Task Force (FATF) has called for enhanced CDD on; the service is unusually complex or large or has no apparent purpose; or you must lodge a suspicious matter report and plan to keep acting | More information, and the source of funds and source of wealth where relevant. See AUSTRAC on enhanced CDD |
AUSTRAC’s starter kit examples show both ends for trusts. Setting up a trust and corporate trustee for an overseas client through a representative you never meet is rated medium risk. A family trust to buy a garage with a $650,000 cash deposit is rated high: the case goes to the compliance officer, a suspicious matter report (SMR) is lodged, and a senior manager approves in writing before the work continues.
What to keep on file
The initial CDD guidance says you must keep records of how you established each matter, the type and content of the data you collected, and your risk decisions, for 7 years after the business relationship ends. For an entity client, that file holds:
- the entity’s details and the register searches or documents that verified them
- the ownership and control structure, and how you reached each beneficial owner. AUSTRAC’s bank example keeps the ownership path and all three company extracts
- for a trust, the deed details, the beneficiaries or classes, and each controller
- each representative’s identity and the evidence of their authority
- screening results for every party, and the risk rating with the reasons
- any reasonable steps and difficulties, if a beneficial owner couldn’t be found.
You don’t have to keep copies of the documents themselves. AUSTRAC says recording their details is enough.
What StackGo does, and where the rest happens
Entity onboarding in StackGo
The multi-entity Intake form is on the Growth plan and above
Source: StackGo workflow definitions Reviewed
StackGo runs entity onboarding as one workflow. A multi-entity Intake form, on the Growth plan and above, collects the company or trust details and the people behind it, and creates the records in your practice software, as set out in why one client is usually five records. Each individual completes an ID check on their phone (Verify), and an Australian company can have a business verification report and an ultimate beneficial owner (UBO) report from register data, each at extra cost. Every party is screened against PEP, sanctions and adverse media lists (Screen), and your team records a High, Medium or Low rating with the decision (Assess).
Some of the job stays with your team. ASIC holds no trust details, so reading the trust deed and recording the beneficiaries and controllers is your work. No tool can find an entity the client forgets to mention. Your AML/CTF policies decide when simplified or enhanced CDD applies.
To see a company or trust client onboarded end to end, book a demo.
Frequently asked questions
We verified the director. Is that enough for a company client?
No. The director is a person acting on behalf of the customer. You still establish the company’s identity, its beneficial owners, whether anyone is a PEP or sanctioned, and the nature and purpose of the relationship.
Do we have to name every beneficiary of a discretionary trust?
Each beneficiary, unless the nature of the trust makes that impossible. Then you record a description of each class instead (Rules s 6-3(3)). AUSTRAC gives the example of secondary beneficiaries defined by their relationship to a primary beneficiary, such as a spouse, children or future descendants.
Nobody owns 25% of the company. Does it have no beneficial owners?
Not necessarily. A beneficial owner can be someone who controls the company without owning a quarter of it. If you establish there really are none, you identify the chief executive or equivalent (Rules s 6-8(2) and (3)).
The trustee is a company. Who do we check?
The trust, the trustee company as a company, the individuals who own or control the trustee company, the person who deals with you, and the trust’s other roles: beneficiaries, settlor, appointor, guardian and protector.
Do we keep a copy of the trust deed?
AUSTRAC says you aren’t required to keep copies of the documents you used, and can record their details instead. Many firms keep the deed anyway because they need it for the work.
Sources
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006, sections 5, 11, 28, 29, 31 and 32 (compilation in force from 1 October 2026)
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025, sections 6-2, 6-3, 6-6 to 6-9, 6-12, 6-16 to 6-21 (compilation in force from 31 March 2026)
- AUSTRAC: Initial CDD for body corporate, partnership or unincorporated association (updated 25 August 2026)
- AUSTRAC: Initial CDD for trust (updated 5 May 2026)
- AUSTRAC: Determining ownership and control structures (updated 20 October 2026)
- AUSTRAC: Overview of initial customer due diligence (updated 27 March 2026)
- AUSTRAC: Delayed initial customer due diligence (updated 27 October 2026)
- AUSTRAC: Enhanced customer due diligence (updated 15 July 2026)
- AUSTRAC: Transitioning existing customers (updated 1 July 2026)
- AUSTRAC: Accountant program starter kit, examples of dealing with clients (updated 2 April 2026)
- AUSTRAC: Updates to the accountant program starter kit (release 1.1, 10 June 2026; page updated 20 August 2026)