Guide

Enhanced due diligence checklist for Australia

An enhanced due diligence checklist records what triggered it, the extra KYC checks you ran, source of funds and wealth where required, senior manager approval for PEPs, closer monitoring and your decision. Australia’s AML/CTF Act section 32 sets the triggers, and the measures must match the customer’s risk.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 5·5 min read

This checklist is for compliance officers and practice managers at reporting entities, including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. Use it each time a client needs enhanced due diligence. For what the term means, see our enhanced due diligence definition.

In brief

Triggers: high money laundering and terrorism financing (ML/TF) risk, a suspicious matter report, an unusual transaction, a foreign politically exposed person (PEP), a FATF-listed country or nested services.
Measures: targeted and proportionate to the reason the customer is high risk. The Australian Transaction Reports and Analysis Centre (AUSTRAC) expects you to manage the risk, not only monitor it.
Source of funds and wealth: always for a foreign PEP, or a high-risk domestic or international organisation PEP. For other triggers, where relevant to the risk.
Approval: a senior manager approves before you serve a foreign PEP, a high-risk domestic or international organisation PEP, or a nested services relationship.
Records: document why enhanced due diligence applied, what you did and what you decided. Keep it for 7 years after the relationship ends.

What triggers enhanced due diligence?

Section 32 of the AML/CTF Act lists the triggers. They apply during initial due diligence, ongoing due diligence, or both:

High risk: the customer’s ML/TF risk is high, at onboarding or later
Suspicious matter report: you must lodge one and you plan to keep serving the customer
Unusual service: no apparent economic or legal purpose, unusually large or complex transactions, or an unusual pattern
Foreign PEP: the customer, a beneficial owner, anyone acting for them or anyone the service is for
High-risk jurisdiction: any of those people is present in, or formed in, a country the Financial Action Task Force (FATF) has called for enhanced due diligence on
Nested services: the service is part of a nested services relationship

Key point

Under Australia’s AML/CTF Act, a reporting entity must apply enhanced due diligence when a customer’s ML/TF risk is high.

Your risk rating decides the first trigger, so record why you rated the customer as you did. For the PEP trigger in detail, see enhanced due diligence for PEPs.

What goes on an enhanced due diligence checklist?

The enhanced due diligence checklist, with its legal basis

Checklist item	What you do	Legal basis
1. Record the trigger	Note which trigger applies: high risk, a suspicious matter report, an unusual transaction, a foreign PEP, a FATF-listed jurisdiction or nested services	AML/CTF Act s 32; Rules 6-20
2. Collect and verify more KYC information	Extra identity documents, the purpose of the service, the customer’s background and ownership, re-verified from other independent sources	AML/CTF Act s 32, measures appropriate to the risk
3. Establish source of funds and wealth	Always for a foreign PEP, or a high-risk domestic or international organisation PEP. For other triggers, where relevant to the risk	Rules 6-21 and 6-23
4. Get senior manager approval	Before you serve a foreign PEP, a high-risk domestic or international organisation PEP, or a nested services relationship	Rule 5-5
5. Monitor more closely	Review the relationship and update KYC information more often; look at transactions in more depth	AML/CTF Act ss 30 and 32
6. Decide and act	Add controls, limit or decline the service, or end the relationship. Lodge a suspicious matter report where required	AML/CTF Act s 26F (AML/CTF policies); s 41
7. Keep the record	Why enhanced due diligence applied, the measures, what you found and what you decided	AML/CTF Act s 111: 7 years after the relationship ends

Sources: AUSTRAC, Enhanced customer due diligence; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 30, 32, 111); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (rr 5-5, 6-20, 6-21, 6-23) Reviewed 21 Oct 2026

Seven items, each tied to the AML/CTF Act or Rules 2025. The measures in items 2 and 5 are chosen to fit the reason the customer is high risk.

Seven items cover what the Act and the AML/CTF Rules 2025 require. The table sets each one against its legal basis.

The measures are not one fixed set. AUSTRAC expects them to be targeted to the customer’s specific risk, proportionate to its level, effective, and kept up for as long as the risk lasts.

Your anti-money laundering and counter-terrorism financing (AML/CTF) policies must set out how you apply enhanced due diligence. AUSTRAC expects them to say who is responsible, when each measure applies and how you review whether the measures work.

Which measures fit which risk?

Start from the reason the customer is high risk, then pick the measures that address it. AUSTRAC’s enhanced customer due diligence guidance gives these examples:

collect more know your customer (KYC) information, such as a second identity document
re-verify it from other independent sources
ask the reason for a transaction, and where transfers of value are going
find out more about the customer’s background, ownership and financial position
monitor transactions in more depth, and review them manually
review the relationship and update KYC information more often

Enhanced due diligence should manage the risk, not only watch it. AUSTRAC gives examples such as declining a service outside your risk appetite, or limiting cash transactions. Escalate to senior management where your policies say so.

A trust or company with layered ownership needs its beneficial owners identified. Under the Act, a beneficial owner is an individual who ultimately owns 25% or more of the entity, or controls it.

When must you establish source of funds and wealth?

Source of funds is how the customer got the money for this transaction, such as salary or a property sale. Source of wealth is how they built their overall net worth.

Under Rule 6-21, you must establish both where they are relevant to the risk. This applies when enhanced due diligence is triggered by high risk, a suspicious matter report or a high-risk jurisdiction.

Key point

Under the AML/CTF Rules 2025, a reporting entity must establish a foreign PEP’s source of funds and source of wealth before providing the service.

The same applies to a domestic or international organisation PEP when the customer is high risk. AUSTRAC lists evidence such as bank statements, tax returns, a probated will, sale agreements and audited financial statements. Its source of funds and wealth guidance has the full list.

Who has to approve the client?

A senior manager must approve before you start to serve a foreign PEP. The same applies to a high-risk domestic or international organisation PEP, and to a nested services relationship. Rule 5-5 sets this out.

If an existing customer becomes one of those PEPs, a senior manager decides whether to continue the relationship. For other cases, Rule 5-5 says your AML/CTF policies must set out when approval is needed.

What should the record show?

You must document the enhanced due diligence you apply. Section 111 of the Act requires you to keep records of your risk assessments and decisions for 7 years after the relationship ends. AUSTRAC suggests the file shows:

what required enhanced due diligence, and why you chose each measure
the extra information you collected, and how you verified it
whether you lodged a suspicious matter report
any change to the risk rating, and your decision

When you go back to the customer for more information, follow your tipping off obligations. Never let them know you have reported, or plan to report, a suspicion.

Where does each check sit in client onboarding?

Where each enhanced due diligence check sits

Checklist items mapped to the five workflows

Intake Details, documents and consent, plus enhanced due diligence forms (items 2 and 3)
Verify Identity, companies and beneficial owners (item 2)
Screen PEP, sanctions and adverse media, on every party (item 1)
Assess High, Medium or Low risk rating and the decision (items 1, 4 and 6)
Monitor Monthly re-screening (item 5)

A customer can become high risk later. Monitor re-screens clients against PEP, sanctions and adverse media every month.

Sources: StackGo, Assess workflow; StackGo, Monitor workflow Reviewed 21 Oct 2026

Screen finds a foreign PEP, Assess sets the risk rating that triggers enhanced due diligence, and Monitor re-screens clients every month after onboarding.

Most items attach to a step you already run. The flow shows where each one fits, from intake to ongoing monitoring.

Ongoing due diligence matters most here, because a customer can become high risk after onboarding. See ongoing customer due diligence for what to monitor.

Frequently asked questions

Can you still serve a customer who needs enhanced due diligence?

Yes. AUSTRAC says you can, if your AML/CTF policies manage and mitigate the risk. Where they cannot, you may limit the service, decline it or end the relationship.

Do you finish enhanced due diligence before lodging a suspicious matter report?

No. AUSTRAC says you do not have to complete it first. The report must still go in within the required time.

Is sanctions screening part of enhanced due diligence?

It applies to every customer. Before you provide a service, you must establish whether the customer and related parties are designated for targeted financial sanctions. Check DFAT’s Consolidated List. See sanctions screening.

How often should you review a high-risk customer?

AUSTRAC’s guidance sets no fixed interval. It lists more frequent reviews as one measure. Set the interval in your policies, matched to the risk.

What happens if you skip it?

Enhanced due diligence is part of the customer due diligence duties in sections 28 and 30, which are civil penalty provisions. In Australia the maximum under section 175 is A$36.4 million per contravention for a company and A$7.28 million for an individual. See AML non-compliance penalties.

Next steps

Check your AML/CTF policies name each trigger, the measures you use for each, and who approves. Then check your high-risk clients have a file that shows why. Our customer due diligence checklist covers the standard checks underneath.

StackGo’s IdentityCheck records a High, Medium or Low risk rating against each client, and links Medium and High risk clients to enhanced due diligence forms. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.

Sources

The facts on this page come from these sources, checked on 21 October 2026.