Company and trust client CDD: a checklist
What to collect, verify, screen and record for a company, partnership, trust or SMSF client under the AML/CTF Rules 2025, one entity type at a time.
Use this checklist for every client that isn’t an individual: a company, a partnership, a trust or a self-managed super fund (SMSF). Each item is the minimum the AML/CTF Rules 2025 require, plus the verification Australian Transaction Reports and Analysis Centre (AUSTRAC) suggests in its guides. Your anti-money laundering and counter-terrorism financing (AML/CTF) policies may ask for more, especially when the client is medium or high risk.
The reasons behind each item are in our guide, ID checks are not onboarding: CDD for company and trust clients. How to trace beneficial owners in practice is in getting UBO right under Tranche 2.
Every entity, before you start
- Which rule
- Companies and partnerships: Rules s 6-2. Trusts, SMSFs included: s 6-3
- When
- Before you start the designated serviceAct s 28(1)
- Delayed verification
- Finish within 20 business daysOnly if delay is essential and the extra risk is low. The entity and the representative’s identity and authority come first (Rules s 6-12)
- Pre-commencement customer
- You were acting for them on 1 July 2026Initial CDD only if a suspicious matter reporting obligation arises, or a significant change takes their risk to medium or high
- Beneficial owner
- An individual with 25% or more, or controlDirectly or indirectly. Control has no percentage (Act s 5)
- Screening
- The entity for sanctions; every individual for sanctions and PEP status
- Records
- 7 years after the relationship endsDetails of documents are enough; copies are optional
Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 5, 28); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 6-2, 6-3, 6-12); AUSTRAC, Delayed initial customer due diligence; AUSTRAC, Transitioning existing customers; AUSTRAC, Overview of initial customer due diligence Reviewed
- Confirm the work is a designated service. If it is, initial customer due diligence (CDD) must be done before you start (Act s 28(1)).
- Check whether the client is a pre-commencement customer, meaning you were already acting for them on 1 July 2026. If so, initial CDD is only needed if a suspicious matter reporting obligation arises or a significant change takes their risk to medium or high.
- Identify the person dealing with you. Record who they are and their authority to act, such as their role as a director or trustee, an employer’s letter, or a power of attorney.
- Collect the nature and purpose: what the entity does, and why it wants your services.
- Identify the client’s money laundering and terrorism financing (ML/TF) risk from what you have, then decide whether simplified, standard or enhanced CDD applies.
- If you plan to start before verification is finished, record why delaying is essential and why the extra risk is low. The entity’s identity and the representative’s identity and authority must still be established first, and the rest finished within 20 business days (Rules s 6-12).
Company checklist
From section 6-2 of the Rules, with verification examples from AUSTRAC’s body corporate guide.
| Collect | Verify with, for example |
|---|---|
| Full name, any business names and other names | The Australian Securities and Investments Commission (ASIC) register search by name and Australian Company Number (ACN) |
| ACN or Australian Business Number (ABN) | ASIC register, ABN Lookup |
| Principal place of business, and registered office if different | The addresses held by ASIC |
| Evidence that the company exists | ASIC organisation extract or certificate of registration |
| The powers that bind and govern it | Constitution, or the Corporations Act replaceable rules if it uses them |
| Full name and director identification number of each director | Names against the ASIC extract; the ID number from the director |
| Ownership and control structure: shares issued, kinds of shares, how decisions are made | Constitution, current and historical ASIC extracts, annual statements, member distribution statements |
| Each beneficial owner: every individual who owns 25% or more, directly or indirectly, or controls the company | Follow each corporate shareholder up the chain until you reach individuals, then verify each as you would an individual client |
Partnership checklist
Partnerships use the same section of the Rules, with the partnership agreement doing most of the work.
- Full name. If the partnership has no business name, AUSTRAC says this is the names of all the partners.
- ABN, if it has one, and the principal place of business.
- Evidence that it exists and the powers that govern it: the partnership agreement, or a reliable copy or extract of it.
- The partners and anyone responsible for governance and executive decisions.
- Ownership and control: each partner’s share and voting rights, and how decisions are made. In AUSTRAC’s limited partnership example, a limited partner with 25% of the capital and no votes is a beneficial owner, and so is the owner of the general partner that holds all the votes.
Trust checklist, SMSFs included
From section 6-3 of the Rules, with verification examples from AUSTRAC’s trust guide, which lists self-managed super funds among the activities a trust can carry on.
| Collect | Verify with, for example |
|---|---|
| Full name, business names and other names | Trust deed, ABN Lookup |
| Kind of trust: discretionary, unit, bare, deceased estate or other | Trust deed |
| ABN or other identifier, if it has one | ABN Lookup |
| Principal place of business or operations. For a trust that isn’t a business, often each trustee’s residential address | AUSTRAC’s trust guide doesn’t suggest verifying this one |
| Evidence that the trust exists | Trust deed and deeds of variation, or the will or letters of administration for an estate |
| The powers that govern it | Trust deed |
| Who runs it: usually all trustees, appointors, guardians and protectors (for a bare trust, the beneficiaries) | Trust deed and deeds of variation |
| Each beneficiary, or a description of each class if the nature of the trust makes naming them impossible | Verify named beneficiaries as you would that type of client. For classes, the deed or records of distributions |
| Each trustee’s identity and authority to act | Trust deed and instrument of appointment |
| Control structure: duties, rights and how decisions are made | Trust deed, trustee resolutions, memorandum of trust |
| Any settlor, appointor, guardian or protector | Verify each individual as you would an individual client |
For a corporate trustee, run the company checklist on the trustee as well. Its beneficial owners are beneficial owners of the trust, and the person at the trustee company who deals with you is the representative. If the deed isn’t available, AUSTRAC also accepts letters or documents from the trust’s lawyer or accountant, as long as that adviser plays no role in the trust.
Screening checklist
Check everyone below against targeted financial sanctions, using the DFAT Consolidated List or a screening service. Check each individual for politically exposed person status as well. More on this in what is a politically exposed person.
- The entity itself (sanctions only)
- Each person dealing with you for it
- Each beneficial owner
- For a trust: every trustee, every identifiable beneficiary, and every individual settlor, appointor, guardian, protector or other controller.
Where beneficiaries are described as a class, their screening is treated as done (Rules s 6-6(3)). Record the result for each person, including no match.
When you can stop, and when you must go further
| Situation | What the Rules allow or require |
|---|---|
| The client is, or is controlled by, a listed public company with disclosure requirements that make its owners transparent, or a government body | Beneficial owners, and their screening, are taken as established (s 6-7) |
| The client is low risk and is, or is controlled by, an entity overseen by a prudential, insurance or investor protection regulator, or a strata or community title body | The same, under s 6-18 |
| A company, partnership or association whose beneficial owners you can’t find | Take all reasonable steps, record the steps and difficulties, and collect and verify the chief executive’s identity as the risk requires (s 6-8(1)) |
| A company, partnership or association with no beneficial owners | Establish the identity of the chief executive or equivalent (s 6-8(2) and (3)) |
| Low risk, no enhanced CDD triggers, and your policies cover simplified CDD | Beneficiaries, representatives and beneficial owners can be established from the information you collected without verifying it, if nothing makes you doubt it (s 6-17) |
| High risk; a foreign PEP among the client, its owners, beneficiaries or representatives; any of them present in or formed in a high-risk jurisdiction Financial Action Task Force (FATF) has called for enhanced CDD on; an unusually large or complex service, or one with no clear purpose; or a suspicious matter report you must lodge while you keep acting | Enhanced CDD, including source of funds and source of wealth where relevant. See AUSTRAC on enhanced CDD |
What goes on file
Under the initial CDD guidance, you keep these records for 7 years after the business relationship ends:
- the entity’s details, and which register searches or documents verified them
- the ownership and control structure, and the path to each beneficial owner
- for a trust, the kind of trust, the beneficiaries or classes, and each controller
- each representative’s identity and the evidence of their authority
- screening results for every person and the entity
- the risk rating, the level of CDD applied and the reasons
- any steps and difficulties, if a beneficial owner couldn’t be found.
You don’t have to keep copies of the documents. AUSTRAC says recording their details is enough.
Where StackGo fits
Where StackGo fits in the checklist
The multi-entity Intake form is on the Growth plan and above
Source: StackGo workflow definitions Reviewed
A multi-entity Intake form, on the Growth plan and above, collects the entity and the people behind it in one link. Each person completes an ID check (Verify), and every party is screened (Screen). An Australian company can have an ultimate beneficial owner (UBO) report from register data at extra cost, and your team records the rating and decision (Assess). Reading the trust deed, and deciding when simplified or enhanced CDD applies, stays with your team. If you are still choosing a product, what to ask a software vendor covers entities, screening and records. To see it run on a trust with a corporate trustee, book a demo.
Frequently asked questions
The client won’t give us the trust deed. Can we go ahead?
Not until each matter is established on reasonable grounds. Other reliable documents can help, such as a letter from the trust’s independent lawyer or accountant. If you still can’t establish the matters, AUSTRAC says you must not provide the designated service, and you lodge a suspicious matter report if you suspect the client isn’t who they claim to be.
Do we keep a copy of the ASIC extract?
You must keep a record of the data you used and what it showed. AUSTRAC doesn’t require a copy, though its own worked example keeps the ownership path and each company extract on file.
Sources
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006, sections 5, 28 and 29 (compilation in force from 1 October 2026)
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025, sections 6-2, 6-3, 6-6 to 6-8, 6-12, 6-17, 6-18, 6-20 and 6-21 (compilation in force from 31 March 2026)
- AUSTRAC: Initial CDD for body corporate, partnership or unincorporated association (updated 25 August 2026)
- AUSTRAC: Initial CDD for trust (updated 5 May 2026)
- AUSTRAC: Determining ownership and control structures (updated 20 October 2026)
- AUSTRAC: Overview of initial customer due diligence (updated 27 March 2026)
- AUSTRAC: Delayed initial customer due diligence (updated 27 October 2026)
- AUSTRAC: Enhanced customer due diligence (updated 15 July 2026)
- AUSTRAC: Transitioning existing customers (updated 1 July 2026)