# Core customer due diligence (CDD) checklist

Prepared by InvestPass. Reviewed 7 November 2026 (Australia/Sydney).

> **Important.** General information, not legal advice. Adapt this checklist to your own AML/CTF policies and risk assessment. It does not replace your program, AUSTRAC guidance or specialist advice.

## How to use

- Complete one copy per customer, kept with your CDD records.
- Initial CDD is generally completed before you provide a designated service. Check whether an exception, delayed CDD or a transitional rule for existing customers applies, and record why.
- Verify information using reliable and independent sources appropriate to the customer's risk.

## Customer

- [ ] Customer type recorded (individual, company, trust, partnership, association, other)
- [ ] Identity established and verified with reliable, independent data or documents
- [ ] Verification method and date recorded

## Beneficial owners and control

- [ ] Individuals who ultimately own 25% or more identified
- [ ] Individuals who otherwise control the customer identified (control is not limited to a 25% threshold)
- [ ] Ownership structure documented (diagram or notes)
- [ ] Beneficial owners verified to a level appropriate to risk

## People acting for the customer

- [ ] Persons acting on behalf of the customer identified
- [ ] Their authority to act confirmed and recorded
- [ ] Any person on whose behalf the designated service is received identified

## Nature and purpose

- [ ] Nature and purpose of the relationship or transaction recorded
- [ ] Expected activity noted so unusual activity can be spotted later

## PEPs and sanctions

- [ ] PEP check completed for the customer, anyone acting on their behalf, relevant beneficial owners and any person on whose behalf the service is received (statutory PEP definitions include specified family members and close business associates, not every associate)
- [ ] Targeted financial sanctions check completed for the same relevant persons; any potential match escalated before proceeding
- [ ] PEP category recorded (none, domestic, foreign, international organisation)
- [ ] Targeted financial sanctions check completed and result recorded
- [ ] Potential or confirmed sanctions match escalated immediately to the compliance officer. Do not proceed without specialist review.

## Risk and enhanced CDD

- [ ] Customer risk rating recorded with reasons
- [ ] Enhanced CDD applied where required, including source of funds and source of wealth for foreign PEPs and high risk domestic or international organisation PEPs
- [ ] Senior manager approval obtained before providing or continuing the service where AUSTRAC guidance requires it: generally where the customer, a beneficial owner or a person on whose behalf the service is received is a foreign PEP, or a domestic or international organisation PEP and the customer is high risk (check the qualifications, including for foreign permanent establishments, in the AUSTRAC PEP guidance)
- [ ] Any additional approvals your own policies require

## Outcome

- [ ] CDD complete, or reason recorded if delayed or not completed
- [ ] Suspicion considered. If suspicious, escalate per your SMR procedure and do not tip off.
- [ ] Records stored. CDD records are generally kept for 7 years after the business relationship ends or after the last occasional transaction.

Completed by: `[ ]`  Date: `[ ]`  Reviewed by: `[ ]`

Note: an identity check alone is not AML/CTF compliance. It is one part of CDD.

## Sources

- AUSTRAC, Politically exposed persons: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/politically-exposed-persons-pep
- AUSTRAC, Enhanced customer due diligence: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/enhanced-customer-due-diligence
- AUSTRAC, Overview of initial customer due diligence: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/initial-customer-due-diligence/overview-initial-customer-due-diligence
- AUSTRAC, Program starter kits: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/program-starter-kits

General information, not legal advice.