Choosing AML/CTF software for an accounting practice

Start with the obligations, because a vendor's feature list is only useful if it maps onto them.

• Initial customer due diligence before you start. You must complete initial CDD before you start providing a designated service (Act s 28). That means establishing, on reasonable grounds, the client's identity, anyone acting for them and their authority, anyone the service is for, the beneficial owners of a client that isn't an individual, whether any of those people is a politically exposed person or designated for targeted financial sanctions, and the nature and purpose of the relationship. AUSTRAC's initial CDD guidance says that if you can't establish these matters, you must not start the service.
• Verification with reliable and independent data. You collect know your customer (KYC) information and verify it, as appropriate to the client's money laundering and terrorism financing (ML/TF) risk, using reliable and independent data. AUSTRAC expects at least one piece of KYC information to be verified for each matter, unless an exception in the Rules applies.
• Beneficial owners. For a company or trust client, a beneficial owner is an individual who ultimately owns 25% or more of the client, or controls it, directly or indirectly. You follow the chain of ownership until you reach people. How that works for each kind of entity is in CDD for company and trust clients.
• PEP and sanctions screening. You establish whether the client and each connected person is a politically exposed person, and whether they are designated for targeted financial sanctions. The Department of Foreign Affairs and Trade (DFAT) keeps the Consolidated List of everyone designated under Australian sanctions laws.
• Ongoing customer due diligence. Under section 30 you monitor clients for unusual transactions and behaviour. Where you have a business relationship, you also review and, where appropriate, update the client's risk rating and update and reverify their KYC information. AUSTRAC's sanctions guidance adds that you must check whether anyone becomes designated during the relationship.
• Records for 7 years. You keep records of how you established each matter, the type and content of the data you collected and your risk decisions, for 7 years after the business relationship ends, or 7 years after the last occasional transaction (Act s 111). AUSTRAC says copies of identity documents aren't required: recording their details is enough.
• Reporting stays with you. A suspicious matter report (SMR) is due within 3 business days of forming the suspicion, or within 24 hours if it relates to terrorism financing (Act s 41). A threshold transaction report is due within 10 business days when a service involves you receiving or paying A$10,000 or more in notes and coins (s 43). Telling a client about an SMR where it could prejudice an investigation is the criminal offence of tipping off (s 123).

Software can help with most of the first six. The decisions in them, and the reports in the last one, are your firm's.

Questions to ask a vendor

AUSTRAC's RegTech checklist is short, and every point on it is worth asking. It suggests you consider whether a vendor understands the AML/CTF framework and the obligations their solution addresses; understands your industry; can explain how the solution integrates with your existing systems and procedures; can explain the solution clearly, including its limitations and how far it supports your obligations; built the tool for Australia, because a tool developed for another jurisdiction will probably need changes; offers ongoing support such as set-up, training and updates; and can give a demonstration or testimonials from businesses like yours. The questions below turn that into specifics for an accounting practice.

StackGo's IdentityCheck is software for the CDD steps, run from the tools your practice already uses: Xero Practice Manager, FYI, Karbon, HubSpot and Pipedrive, or through the application programming interface (API). An Intake form collects the client's details, documents and consent. Each person completes a biometric ID check, document and selfie, covering 12,500 document types from more than 230 countries and territories (Verify). For an Australian company, beneficial ownership and business verification reports are available at extra cost. Every party is screened against PEP, sanctions and adverse media sources (Screen), your team records a High, Medium or Low rating and the decision (Assess), and Monitor re-screens monitored clients every month. A check against the government DVS is available as an add-on, quoted for your firm.

By default no personal details are written to your practice software or customer relationship management (CRM): it receives a link to the result, which opens only with an IdentityCheck login, and the audit record of what was checked, when, by whom, the outcome and the status. More can be written back where you need it, and what goes back to your CRM explains how and why we suggest checking your privacy policies first. Client data is held on Google Cloud in the European Union (EU) and Australia, and the vault keeps records for the 7 years the Australian Act requires. Plans are a monthly subscription whose fee is credit, drawn down by ID checks, screening, monitoring and some other usage; some reports, and the DVS add-on, are charged on top. The detail is on the pricing page.

StackGo doesn't write your risk assessment or policies, act as your compliance officer, monitor your clients' payments, decide a client's risk rating or who counts as a beneficial owner, read a trust deed for you, or lodge reports with AUSTRAC. Nothing is reported or submitted on your behalf. To put the questions above to us, book a demo.

Frequently asked questions

Do we have to buy AML/CTF software?

No. The Act requires you to do customer due diligence, screening, ongoing CDD, record keeping and reporting, not to use a particular tool. AUSTRAC says monitoring can be manual where that works for the size and nature of your business. Software is a way to do the work consistently and keep the record.

Does AUSTRAC approve AML/CTF software?

No. AUSTRAC says it doesn't recommend or endorse any specific RegTech business or product. It publishes a checklist of things to consider when you engage one.

Is a DVS check required?

No. You must verify KYC information using reliable and independent data appropriate to the client's risk. AUSTRAC names the DVS as one independent source you can use, for example if you are concerned about whether a document is valid.

Do we need to keep copies of clients' ID documents?

No. AUSTRAC says you aren't required to keep scanned copies or photocopies, and that recording the details of the documents is enough. You keep the record of how you established each matter for 7 years after the relationship ends.

If the software misses something, who is responsible?

Your firm. The obligations in the Act fall on the reporting entity. That is why AUSTRAC's checklist asks vendors to explain their solution's limitations and how far it supports your obligations.