Initial customer due diligence
- Collect identification information: name, date of birth and address for an individual; name, registration number and address for a company; the deed and parties for a trust.
- Verify it against reliable and independent sources: a driver licence or passport, an ASIC extract, a trust deed, or an electronic verification service.
- Identify and verify beneficial owners: the individuals who ultimately own 25 per cent or more of an entity, or control it by other means.
- Check whether the customer or a beneficial owner is a politically exposed person.
- Understand and record the purpose and intended nature of the relationship.
- Rate the customer's risk and decide whether enhanced due diligence applies.
Enhanced and simplified due diligence
Higher-risk customers, including politically exposed persons, cash-intensive matters, complex structures and clients you never meet, get enhanced due diligence: source of funds and wealth, senior management approval and closer monitoring. Lower-risk customers can get simplified measures where your program justifies it. The decision and the reasons must be recorded.
Ongoing due diligence
Due diligence continues after onboarding: files are reviewed at intervals set by risk, transactions are compared against the stated purpose, and identification is refreshed when something changes. A common small-firm schedule is six months for high risk, twelve for medium and twenty-four for low.
Records
Keep the identification records, the verification evidence, the beneficial ownership findings, the risk rating and the reasons for seven years after the relationship ends. Never delete a client file; archive it.
Questions people ask
- Is KYC the same as verification of identity in conveyancing?
- No. VOI verifies identity for electronic conveyancing. AML customer due diligence adds beneficial ownership, purpose, risk rating, reviews and records. Conveyancers do both.
- Can I use an electronic identity verification service?
- Yes. Electronic verification against reliable and independent data is an accepted method, and is the practical option for clients you never meet.
- What if a client refuses to provide identification?
- You must not provide the designated service until identification is complete. Record the refusal; it may itself be grounds for a suspicious matter report.
General information about Australian AML/CTF law, not legal advice. The Act, the Rules and AUSTRAC's guidance are the primary sources.