Under Australia's AML/CTF rules, verifying identity sits inside initial customer due diligence (CDD). AUSTRAC's guidance describes CDD as establishing the customer's identity, the relevant beneficial owners, anyone acting on the customer's behalf and their authority, any person on whose behalf the service is received, the nature and purpose of the relationship, PEP and targeted financial sanctions status, and the customer's ML/TF risk. The steps below follow that structure.
1. Confirm a designated service is involved and when CDD is due
Initial CDD is generally completed before you provide a designated service. Check whether an exception, limited delayed CDD, or a transitional rule for existing customers applies, and record your reasoning. If you are unsure whether you provide designated services, start with the readiness checker.
2. Collect the customer's identifying details
For an individual, collect at least their full name and date of birth, plus other details your policies require. For an entity, collect its full name, identifiers such as ABN or ACN, and its structure. Collect only what you need.
3. Verify using reliable and independent sources appropriate to the risk
Verification means checking the details against reliable, independent data or documents, such as government issued ID checked with the issuer, or reliable electronic data. Higher risk customers need stronger verification. A lower risk customer may need less, but your policies must set out what is acceptable.
4. Resolve discrepancies before you rely on the result
If names, dates or documents do not match, find out why. A married name or a typo can be explained and recorded. An unexplained mismatch, a document that looks altered, or a refusal to explain should be escalated to your compliance officer and may be a red flag.
5. Identify people acting on behalf of the customer
Verify anyone acting for the customer, such as an attorney, employee or agent, and confirm their authority to act. Also identify any person on whose behalf the service is being received.
6. Identify and verify beneficial owners
For companies, trusts and other entities, identify each individual who ultimately owns 25% or more, and each individual who otherwise controls the customer. Control is not limited to the 25% test: an appointor of a trust or a person directing a nominee can be a beneficial owner. Verify them appropriately to the risk.
7. Understand the nature and purpose
Record what the relationship or transaction is for and the activity you expect, so unusual activity stands out later.
8. Check PEP status and targeted financial sanctions
Check whether the customer, beneficial owners or relevant persons are politically exposed persons, and whether any are subject to targeted financial sanctions. Escalate any potential sanctions match immediately and do not proceed without specialist review. For foreign PEPs, and high risk domestic or international organisation PEPs, take reasonable steps to establish source of funds and source of wealth and apply enhanced CDD.
9. Rate the customer's risk
Combine what you learned into a risk rating under your policies. Unknown information should not lead to a low rating. Our free client risk rating tool shows one transparent approach.
10. Keep records
Keep the CDD records, including what you verified, how and when. CDD records are generally kept for 7 years after the business relationship ends or after the last occasional transaction. Other record types may have different triggers.
Conveyancers: AML checks and VOI are separate
Verification of identity requirements for conveyancing and land registry purposes are separate rules with their own standards. An AML/CTF identity check does not automatically meet them, and a VOI does not automatically meet AML/CTF CDD. See our conveyancers page.
Where InvestPass fits
InvestPass sends your client a secure link to complete an identity check through our provider Personr, and helps you collect entity and owner details. It does not make you compliant on its own, and it does not replace your policies, your judgement on discrepancies, or specialist sanctions review. Personr delivery is in sandbox testing and live checks are not yet switched on. Prices are indicative and to be confirmed.