Customer onboarding checklist for AML/CTF in Australia
Under Australia’s AML/CTF Act, a business must complete initial customer due diligence before it provides a designated service. The checklist runs in order: collect KYC information, rate the risk, screen for PEPs and sanctions, then verify. If you cannot establish who the customer is, you do not start.
This checklist is for practice managers and compliance officers at businesses Australian Transaction Reports and Analysis Centre (AUSTRAC) regulates. That includes the accountants, lawyers, conveyancers and real estate agents covered from 1 July 2026. Each step follows AUSTRAC’s initial customer due diligence guidance, checked on 21 October 2026.
When does onboarding need customer due diligence?
CDD applies when you provide a designated service. For professionals, examples include holding client money as part of a transaction, or creating a company or trust. Giving tax advice on its own is not a designated service.
Our guide to designated services for accountants shows where the line sits. A client who receives no designated service still goes through your normal client onboarding, without the anti-money laundering and counter-terrorism financing (AML/CTF) steps.
Where CDD applies, it comes first. You must complete initial CDD before you start providing the service, by establishing a set of matters on reasonable grounds.
Key point
Under Australia’s AML/CTF Act, a business that cannot establish a customer’s identity on reasonable grounds must not provide them a designated service.
Reasonable grounds is an objective test. Another person with similar training, looking at the same material, should reach the same conclusion.
Under the Act, the civil maximum is A$36.4 million per contravention for a company and A$7.28 million for an individual. See AML non-compliance penalties.
What are the onboarding steps, in order?
The seven steps of initial customer due diligence
Before you start a designated service
- Step 1
Collect KYC information
Most often through an onboarding form.
- Step 2
Identify the customer’s risk
From the KYC information you collected.
- Step 3
Check for PEPs and sanctions
Is anyone a politically exposed person, or designated for targeted financial sanctions?
- Step 4
Decide if enhanced CDD applies
Required for high-risk customers and foreign PEPs.
- Step 5
Decide if simplified CDD applies
Only for low-risk customers, and only if your policies cover it.
- Step 6
Collect more as the risk requires
To manage and mitigate that risk.
-
Verify with reliable and independent data
If you cannot establish a matter on reasonable grounds, do not start the service.
Source: AUSTRAC, Overview of initial customer due diligence Reviewed
AUSTRAC sets out seven steps that usually make up initial CDD. They start with an onboarding form and end with verification against reliable and independent data.
Some steps can run at the same time. What a customer tells you about their identity and why they want the service also helps you rate their risk. As you learn more, you may need to collect or verify more.
Your AML/CTF policies must say what you collect, and what you also verify, for each kind of customer. The checklist below assumes those policies exist; our AML compliance checklist covers writing them.
What do you collect for each customer type?
What to collect and verify, by customer type
| Customer type | Collect | Verify with, for example |
|---|---|---|
| Individual | Full name, other names, date of birth, residential address and any unique identifier such as a passport number | Photo ID such as a current driver’s licence or passport, or a birth certificate plus a utility bill or government notice |
| Sole trader | The individual’s details, plus any business name, the ABN if there is one and the principal place of business | The individual’s ID, and ABN information on the Australian Business Register |
| Company, partnership or association | Full name, business names, ABN or ACN, principal place of business and registered office, evidence it exists, its governing rules and the people responsible for governance | ASIC registers for a company, or the partnership agreement or constitution |
| Trust | Full name, kind of trust, ABN if any, principal place of business or administration, the trust deed and the trustees, appointors and others with control | The trust deed and any variations, ABN Lookup, or a letter from the trust’s independent lawyer or accountant |
Sources: AUSTRAC, Initial CDD for individuals; AUSTRAC, Initial CDD for sole traders; AUSTRAC, Initial CDD for body corporate, partnership or unincorporated association; AUSTRAC, Initial CDD for trust Reviewed
The details change with the kind of customer. AUSTRAC publishes a guide for each type: individuals, sole traders, bodies corporate and partnerships, trusts and government bodies.
For an individual, collect enough to tell them apart from someone with a similar name. That usually means full name, other names, date of birth and residential address.
For a company, partnership, association or trust, you also collect evidence that it exists and the powers that govern it. You record the individuals responsible for its governance and executive decisions, such as the directors or the trustees.
Who else must you identify?
The customer is not the only person you check. You must establish the identity of anyone acting for the customer, and their authority to act. You also identify anyone the customer is receiving the service for, such as a trust beneficiary.
If the customer is not an individual, you identify its beneficial owners. A beneficial owner is an individual who directly or indirectly owns 25% or more of the customer, or otherwise controls it.
Follow the chain of ownership until you reach individuals. If a company controls a trust, you identify the people who own or control that company. Our guide to collecting beneficial owner details walks through it.
How do you screen and rate the risk?
Before the service starts, you establish whether the customer, any beneficial owner or anyone acting for them is a politically exposed person. You also check whether any of them is designated for targeted financial sanctions.
Key point
Under Australia’s AML/CTF Act, a business must establish whether a customer is designated for targeted financial sanctions before it starts the service.
For sanctions, AUSTRAC points you to DFAT’s Consolidated List. The list changes often, so always check the latest version. Sanctions screening explains the lists, and our Screen workflow runs the checks.
Then give the customer a risk rating, such as low, medium or high. Base it on your risk assessment: the kind of customer, the service, how you deliver it and the countries involved.
The rating sets the depth of your checks. High risk means enhanced CDD; foreign PEPs always trigger it. Low risk may allow simplified CDD, which is not an exemption: you still collect all the required information.
How do you verify, and what if something does not match?
You verify KYC information against reliable and independent data, as the customer’s risk requires. AUSTRAC expects at least one verified piece of information for each matter you must establish, and more when the risk is high.
A third-party digital identity service can do this if its data is reliable and independent. AUSTRAC asks you to consider who maintains the data, such as a government body, and whether the system is secure and up to date.
If the details do not match, your policies should say what happens next. AUSTRAC gives these options:
- Cross-check: verify the details with other independent and reliable data
- Ask the issuer: contact the issuing authority to confirm a document is valid
- Ask the customer: request an explanation, such as for a name spelling, and evidence if needed
- Review the cause: decide whether it is an admin error or a sign of fraud
If you still cannot establish a matter, do not provide the service. If you reasonably suspect the customer is not who they claim to be, you must lodge a suspicious matter report.
What should the onboarding record show?
You must keep a record of how you established each matter, for each customer. Write it so a reviewer can follow the decision without asking you.
You do not have to keep copies of identity documents to meet your record keeping obligations. You can record their details instead.
Keep CDD records for at least 7 years from the date the business relationship ends. After onboarding, ongoing CDD takes over: you review the customer’s risk and update and reverify their details where appropriate.
Frequently asked questions
Can I start work before verification is finished?
Only in limited cases. Delayed initial CDD applies where a delay is essential to avoid interrupting the ordinary course of business and the extra risk is low. You must then finish within 20 business days of starting the service.
What if a customer has no standard ID?
AUSTRAC allows alternative identification procedures when a person cannot obtain or access identity documents for reasons beyond their control. Your policies must manage the extra risk, and you still take reasonable steps to confirm who they are.
Do I need to collect ID documents at the first step?
No. AUSTRAC says no identification documents are necessarily required at the collection stage. You can collect details through an onboarding form, then verify them against documents or electronic data.
How is a sole trader different from an individual?
You identify both the person and their business. That adds any business name, the Australian Business Number (ABN) if they have one and the principal place of business. AUSTRAC suggests checking the ABN on the Australian Business Register.
Next steps
Compare your current onboarding form with the table above for each customer type you serve. Then confirm your policies say who rates the risk and when you apply enhanced CDD. Our customer due diligence checklist covers each matter in more depth.
StackGo’s IdentityCheck verifies individuals, companies and their beneficial owners, and screens every party against PEP, sanctions and adverse media. It records a High, Medium or Low risk rating and writes each result back to the client record. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.
Sources
The facts on this page come from these sources, checked on 21 October 2026.
- AUSTRAC, Overview of initial customer due diligence
- AUSTRAC, Initial CDD for individuals, and the guides for sole traders, bodies corporate and partnerships and trusts
- AUSTRAC, Assigning customer risk ratings
- AUSTRAC, Persons designated for targeted financial sanctions
- AUSTRAC, Delayed initial customer due diligence
- AUSTRAC, Record keeping checklist
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 28, 32, 111)