AML customer due diligence checklist: CDD steps
Customer due diligence means establishing who your customer is, who owns or controls them and whether they are a politically exposed person or sanctioned, before you provide a designated service. You then monitor them for the whole relationship and keep the records for at least 7 years.
Customer due diligence (CDD) is how you establish who a customer is before you provide them with a designated service. Under Australia’s AML/CTF Act, you identify the customer and their owners, screen them and rate their risk. You record how you did each step, in the order below.
What must CDD establish?
The Australian Transaction Reports and Analysis Centre (AUSTRAC) lists the matters you must establish on reasonable grounds before you start a designated service:
- the identity of the customer
- the identity of anyone acting for the customer, and their authority to act
- the identity of anyone the customer is receiving the service on behalf of
- for a customer that is not an individual, its beneficial owners
- whether any of those people is a politically exposed person or designated for targeted financial sanctions
- the nature and purpose of the business relationship
If you cannot establish these matters, you must not start the service. You also keep a record of how you established each one.
CDD applies only to designated services, and it is step 5 of our AML compliance checklist. Preparing tax returns or giving tax advice is not a designated service on its own. Our guide to designated services for accountants shows where the line sits.
When do you have to complete CDD?
When customer due diligence happens
Australia’s AML/CTF Act and Rules
- Before the service
Complete initial CDD
Identity, owners, PEP and sanctions status, and the purpose of the relationship.
-
You start the designated service
Not before initial CDD is complete, unless a delay is allowed.
- If delay is allowed
Finish delayed initial CDD
As soon as reasonably practicable.
No later than 20 business days after you start. Only where a delay is essential and the extra risk is low.
- For the whole relationship
Ongoing CDD
Monitor, and update and reverify information in line with risk.
-
Relationship ends
Keep CDD records for at least 7 years.
Sources: AUSTRAC, Overview of initial customer due diligence; AUSTRAC, Delayed initial customer due diligence; AUSTRAC, Overview of ongoing customer due diligence; AUSTRAC, Record keeping checklist Reviewed
You complete initial CDD before you start the service. The one exception is delayed initial CDD. It applies only where a delay is essential to avoid interrupting the ordinary course of business and the extra risk is low.
Key point
Under Australia’s AML/CTF Rules, a business that delays verifying a customer must complete initial CDD within 20 business days of starting the service.
Some services have their own timeframes. In a real estate sale, CDD on the buyer can wait until the earlier of 28 days after exchange or 3 days before the agreed settlement date.
How deep do your checks need to go?
Simplified, initial and enhanced CDD compared
| Depth | When it applies | What you do |
|---|---|---|
| Simplified CDD | The customer’s risk is low, enhanced CDD is not required, and your policies deal with it | Collect all the required information; verify and monitor less intensively |
| Initial CDD | Every customer, before you start a designated service | Establish each required matter on reasonable grounds, and record how |
| Enhanced CDD | The customer’s risk is high; you lodged a suspicious matter report and continue; or the transaction is unusually large or complex | Collect more, such as source of funds and wealth, and monitor more closely. Senior manager approval for foreign PEPs |
Sources: AUSTRAC, Overview of initial customer due diligence; AUSTRAC, Enhanced customer due diligence; AUSTRAC, Politically exposed persons (PEPs) Reviewed
The depth of CDD follows the customer’s risk, which you rate using your AML/CTF risk assessment. Simplified CDD is not an exemption: you still collect all the required information.
For politically exposed persons, a senior manager must approve the service when the customer, a beneficial owner or the person they act for is a foreign PEP. The same applies to a domestic or international organisation PEP when the customer’s risk is high. Our guide to enhanced due diligence for PEPs covers source of wealth.
How do you verify identity?
For an individual you collect their full name, date of birth and residential address. You verify them against independent and reliable data, such as documents or electronic sources.
AUSTRAC’s guidance uses no points system. If your firm still runs a 100-point check, treat it as an internal checklist, not the legal test. Collect enough to tell the customer apart from someone with a similar name.
Our Verify workflow checks documents and records the method used. For the options, see what identity verification is.
How do you trace beneficial owners?
A beneficial owner is an individual who owns 25% or more of the customer, or controls it. Follow the chain of ownership until you reach individuals, not just the directors on the Australian Securities and Investments Commission (ASIC) register:
| Level | Entity | Owned by |
|---|---|---|
| Customer | ABC Trust | XYZ Pty Ltd, as trustee |
| Trustee | XYZ Pty Ltd | Jane Citizen, 100% |
| Beneficial owner | Jane Citizen | Verify her identity |
For a trust, that includes trustees, settlors, appointors and anyone else with control. Our guide to collecting beneficial owner details has the forms to use.
Who do you screen, and against what?
Screen the customer, each beneficial owner and anyone acting for them. You check for targeted financial sanctions before the service starts, using DFAT’s Consolidated List.
You keep checking for as long as the relationship lasts, because the list changes often. You also check whether each person is a politically exposed person. Our Screen workflow runs both checks; sanctions screening explains the lists.
What happens after onboarding?
Ongoing CDD lasts for the whole relationship. AUSTRAC sets no fixed review interval: your policies decide how often you update and reverify, in line with each customer’s risk.
For example, your policies might review high-risk customers every 12 months and low-risk customers less often. If you lodge a suspicious matter report and keep serving the customer, you must apply enhanced CDD.
Keep CDD records for at least 7 years after the relationship ends. Our Monitor workflow keeps reviews on schedule, and IdentityCheck stores each check on the client record in your customer relationship management (CRM). For more on reviews, see ongoing CDD under AUSTRAC.
Sources
Primary sources, checked 21 October 2026:
- AUSTRAC, Overview of initial customer due diligence
- AUSTRAC, Delayed initial customer due diligence
- AUSTRAC, Enhanced customer due diligence and Politically exposed persons
- AUSTRAC, Determining ownership and control structures
- AUSTRAC, Overview of ongoing customer due diligence
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (s 6, table 6)