Guide

Enhanced due diligence: what it is and when it applies

Enhanced due diligence is the extra customer due diligence Australia’s AML/CTF Act requires when a customer’s risk is high. Other triggers include a foreign politically exposed person and a high-risk jurisdiction. You apply measures targeted to the risk, such as checking source of funds and wealth, closer monitoring and, where needed, senior manager approval.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 5·6 min read

This page is for compliance officers and practice managers at Australian reporting entities, including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. It explains what enhanced due diligence is, when the law requires it and how it differs from the standard checks.

In brief

What it is: extra due diligence measures, appropriate to a customer’s risk, applied during initial and ongoing customer due diligence (CDD) under section 32 of the AML/CTF Act.
When it is mandatory: high risk, a suspicious matter where you keep serving the customer, a foreign politically exposed person (PEP), a high-risk jurisdiction, unusual transactions or nested services.
What it involves: measures targeted to the risk, such as source of funds and wealth checks, deeper monitoring, more frequent reviews and escalation to senior management.
Not a ban: you can still serve the customer if your anti-money laundering and counter-terrorism financing (AML/CTF) policies manage and mitigate the risk.
Records: document each measure and decision, and keep CDD records for 7 years after the relationship ends.

What does enhanced due diligence mean?

Enhanced due diligence means taking extra steps to identify a customer and the people around them, and to manage their money laundering and terrorism financing (ML/TF) risk. It is not a separate process. Under section 32 of the AML/CTF Act, you apply it as part of your initial and ongoing customer due diligence.

The Act says the measures must be appropriate to the customer’s risk. The Australian Transaction Reports and Analysis Centre (AUSTRAC) expects them to be targeted and proportionate to the risk, effective at managing it, and kept up while it lasts.

Enhanced due diligence should act on the risk, not only watch it, for example by declining a service outside your risk appetite or limiting cash transactions.

These rules apply from 31 March 2026 for businesses that were already reporting entities, and from 1 July 2026 for tranche 2 businesses.

When is enhanced due diligence required?

Key facts When enhanced due diligence is mandatory

High risk: The customer’s ML/TF risk is highFound at onboarding or later, for example after a monitoring alert. Act s 32(a)
Suspicious matter: An SMR obligation arises and you keep serving the customerLodge the SMR on time; you need not finish enhanced due diligence first. Act s 32(b)
Foreign PEP: The customer, a beneficial owner, a person acting for them or a person the service is forAct s 32(c). A domestic or international organisation PEP only where the customer is high risk
High-risk jurisdiction: Any of those people is present in, or formed in, a country the FATF has called for enhanced due diligence onAct s 32(d)
Unusual services: Unusually complex or large transactions, an unusual pattern, or no apparent economic or legal purposeRules s 6-20
Nested services: The service is part of a nested services relationshipAct s 32(e)
Cash for virtual assets: A virtual asset service customer deposits or receives physical currencyRules s 6-22, including through a crypto ATM

Sources: AUSTRAC, Enhanced customer due diligence; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (s 32); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 6-20, 6-22) Reviewed 21 Oct 2026

Any one of these triggers makes enhanced due diligence mandatory, at onboarding or at any point in the relationship.

Section 32 of the Act and Division 4 of Part 6 of the AML/CTF Rules 2025 set the triggers. If any one applies, enhanced due diligence is mandatory, whether you find it at onboarding or later.

The most common trigger is a high risk rating. A customer can be high risk at onboarding, or become high risk later, for example after a monitoring alert or a move to another country.

Key point

Under Australia’s AML/CTF Act (s 32), a reporting entity must apply enhanced due diligence when a customer’s ML/TF risk is high.

Two triggers reach beyond the customer: a foreign PEP and a link to a high-risk jurisdiction. Each counts if it applies to the customer, a beneficial owner, a person acting for them or a person the service is for.

A high-risk jurisdiction here is one where the FATF has called for enhanced due diligence. A domestic or international organisation PEP is not an automatic trigger. Our guide to enhanced due diligence for PEPs explains when they are, and when enhanced due diligence is required works through each trigger.

How does enhanced due diligence differ from standard CDD?

Simplified, standard and enhanced customer due diligence

	Simplified measures	Standard: initial and ongoing CDD	Enhanced measures
When	Risk is low, no enhanced trigger applies and your policies cover it (Act s 31)	Every customer: initial CDD before the service, ongoing CDD after it (ss 28, 30)	Any section 32 trigger, such as high risk or a foreign PEP
Required?	Optional	Always	Always, once triggered
KYC information	All required information collected; verification can be lighter	Collected and verified as appropriate to the risk	More collected and verified, or re-verified from other sources
Beneficial owners	Can be taken as established for government bodies, regulated entities and strata bodies (Rules s 6-18)	Identified, with PEP and sanctions status established	Also their background and ownership and, where relevant, source of funds and wealth
Monitoring	Less intensive, with KYC information updated less often	At a frequency appropriate to the risk	More in depth, with more frequent reviews
Sign-off	Under your AML/CTF policies	Under your AML/CTF policies	Senior manager approval for a foreign PEP, or a high-risk domestic or international organisation PEP (Rules s 5-5)

Sources: AUSTRAC, Overview of initial customer due diligence; AUSTRAC, Overview of ongoing customer due diligence; AUSTRAC, Enhanced customer due diligence; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 28, 30, 31, 32); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 5-5, 6-16 to 6-18) Reviewed 21 Oct 2026

Every customer gets initial and ongoing CDD. Simplified measures are optional for low-risk customers; enhanced measures are required when a section 32 trigger applies.

The Act has no tier called standard CDD. Every customer gets initial CDD before the service and ongoing CDD after it. Simplified and enhanced measures change how you carry those out.

Simplified measures are open only when the customer’s risk is low, no enhanced trigger applies and your AML/CTF policies cover them. They are not an exemption. You still collect all the required know your customer (KYC) information.

The Rules give one shortcut for the beneficial owners of a low-risk customer. It covers a customer that is, or is controlled by, a government body or a strata or community title body. It also covers an entity overseen by a prudential, insurance or investor protection regulator.

Enhanced measures sit at the other end. For the two checks side by side, see enhanced due diligence vs customer due diligence.

What measures can enhanced due diligence include?

The law sets no single list. Your AML/CTF policies choose the measures, based on why the customer is high risk. AUSTRAC’s enhanced CDD guidance gives these examples:

collect and verify more KYC information, such as a second identity document
establish the source of funds and source of wealth of the customer or a beneficial owner
find out the reason for a transaction, and where transfers of value are going
learn more about the background, ownership and finances of the customer and other parties
monitor transactions and behaviour in more depth, with manual review of unusual ones
review the relationship and update KYC information more often
escalate the decision to senior management

Source of funds is where the money for this transaction came from, such as a salary or a property sale. Source of wealth is how the customer built their overall net worth.

Key point

Under Australia’s AML/CTF Rules 2025, a reporting entity must establish a high-risk customer’s source of funds and source of wealth when relevant to that risk.

Some measures are fixed. A foreign PEP needs senior manager approval, and their source of funds and wealth established, before you provide the service. A virtual asset service provider must apply enhanced due diligence to a customer who deposits or receives cash for virtual assets.

The customer’s risk rating drives most of this, so record why you rated them high. Our enhanced due diligence checklist sets out the steps in order.

What records do you need to keep?

You must document the enhanced measures you apply. Section 111 of the Act requires CDD records, including your risk analysis and decisions, for 7 years after the business relationship ends. AUSTRAC suggests the file show:

the circumstances that triggered enhanced due diligence
why you chose each measure
the extra information you collected, and how you verified it
whether you submitted a suspicious matter report
any change to the customer’s risk rating, and what you decided

Breaching the initial or ongoing CDD obligations (ss 28 and 30) is a civil penalty contravention. Under Australia’s AML/CTF Act (s 175), the maximum is 100,000 penalty units (A$36.4 million) per contravention for a company and 20,000 units (A$7.28 million) for an individual. See AML non-compliance penalties.

Frequently asked questions

Can you still act for a customer who needs enhanced due diligence?

Yes. AUSTRAC says you can still provide designated services, as long as your AML/CTF policies manage and mitigate the risk. If the measures cannot manage it, you can limit the service or end the relationship.

Do you have to finish enhanced due diligence before lodging an SMR?

No. Lodge the suspicious matter report on time: within 3 business days, or 24 hours for terrorism financing. If you plan to keep serving the customer, enhanced due diligence then applies.

Is a domestic PEP an automatic trigger?

No. Only a foreign PEP is. A domestic or international organisation PEP needs enhanced due diligence, and senior manager approval, where the customer is high risk.

Does simplified due diligence mean skipping checks?

No. For a low-risk customer you may verify less, monitor less intensively and update KYC information less often. You still collect the required information and establish whether the customer is a PEP or subject to sanctions.

How often should you review a high-risk customer?

The law sets no fixed interval. You review KYC information at a frequency appropriate to the customer’s risk, so a high-risk customer is reviewed more often. Ongoing monitoring keeps checking between reviews.

Next steps

Check that your AML/CTF policies name each section 32 trigger, the measures you apply for each and who approves the outcome. Our ongoing customer due diligence guide covers the reviews that follow.

StackGo’s IdentityCheck screens every party for PEP, sanctions and adverse media inside the practice software your team already uses. It records a High, Medium or Low risk rating against the client. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.

Sources

The facts on this page come from these sources, checked on 21 October 2026.