By InvestPass editorial team. Reviewed 7 November 2026 (Australia/Sydney). General information, not legal advice. Not endorsed by AUSTRAC.
Summary
- Customer due diligence (CDD) is how a regulated business works out who it is dealing with and what risk the relationship carries.
- It covers more people than the customer: beneficial owners, anyone acting for the customer, and anyone on whose behalf the service is received.
- Initial CDD is generally completed before you provide a designated service, with limited exceptions.
- CDD continues after onboarding through ongoing reviews and record keeping.
What customer due diligence is
Customer due diligence is the set of steps a business providing designated services takes to understand its customers. Under Australia's AML/CTF regime, it is one of the core parts of your AML/CTF program, alongside your risk assessment, staff training, reporting and record keeping [1][2].
The idea is simple. Before you help someone with a service that criminals could misuse, you should know who they are, who is really behind them, why they want the service, and how risky the relationship is. AUSTRAC's guidance on initial CDD sets out what that involves in practice [3].
Who you need to check
A common mistake is to check only the person in front of you. AUSTRAC's guidance describes initial CDD as establishing several matters about several people [3].
- The customer: the individual or entity you are providing the service to.
- Beneficial owners: each individual who ultimately owns 25% or more of the customer, or who otherwise controls it [4]. Control is not limited to the 25% test.
- People acting on behalf of the customer, such as an employee, agent or attorney, and their authority to act [3].
- Any person on whose behalf the service is being received [3].
What you need to establish
Beyond identity, initial CDD asks you to understand the nature and purpose of the business relationship or transaction, so you know what normal activity looks like [3]. You also check whether the customer or relevant persons are politically exposed persons (PEPs) and whether any are subject to targeted financial sanctions, and you assess the customer's money laundering and terrorism financing risk [3][5].
AUSTRAC's PEP guidance says the check covers the customer, any person acting on their behalf, beneficial owners and any person on whose behalf the service is received [5]. The statutory definitions include specified family members and close business associates of a PEP, not every person who knows one [5]. Being a PEP is not evidence of wrongdoing. It means the relationship may carry higher risk and may need extra steps.
When CDD happens
Initial CDD is generally completed before you provide a designated service [3]. There are limited exceptions, including rules that allow some CDD steps to be delayed in specified circumstances, and separate rules for customers you already had before the obligations applied to you [3]. If you rely on one of these, check the conditions carefully and record your reasoning.
If you cannot complete the required CDD, the safe default is not to provide the designated service until you can, unless a legal exception actually applies. An unexplained gap in identity or ownership is a reason to pause, not a box to tick later.
How to verify information
Collecting details is not the same as verifying them. Verification means checking key information against reliable and independent sources, such as government issued documents checked with the issuer or reliable electronic data [3]. The level of verification should suit the risk. A higher risk customer needs stronger verification than a lower risk one [3].
Discrepancies need attention. A recent name change can usually be explained and recorded. A document that looks altered, details that do not match, or a reluctance to explain are signals to escalate to your AML/CTF compliance officer.
Enhanced CDD
Some situations require enhanced customer due diligence. AUSTRAC's guidance says enhanced CDD is required for customers assessed as high risk, for foreign PEPs, and in other specified circumstances [6]. Enhanced CDD means doing more: stronger verification, closer understanding of the customer's activity, and more frequent review [6].
For PEPs, AUSTRAC guidance requires senior manager approval before providing or continuing the service, and steps to establish source of funds and source of wealth, where the customer, a beneficial owner or a person on whose behalf the service is received is a foreign PEP, or is a domestic or international organisation PEP and the customer is high risk [5]. There are qualifications, including for foreign permanent establishments, so read the guidance rather than assuming one rule applies everywhere [5]. Source of funds and source of wealth are required where the law requires them. They are not a universal step for every customer.
Ongoing CDD and records
CDD does not end at onboarding. You keep information up to date, monitor for unusual activity against what you expected, and review customers more closely when their risk changes [2][3].
Keep records of what you checked, how and when. CDD records are generally kept for 7 years after the business relationship ends or after the last occasional transaction [4]. Other record types can have different triggers, so do not assume one retention rule covers everything.
Where tools fit
Digital identity verification, such as InvestPass Verify, can help with the verification step. It does not, on its own, identify every beneficial owner, decide your customer's risk, or make your business compliant. Use tools as inputs to a process your program defines.
This article is general information, not legal advice, and InvestPass is not endorsed by AUSTRAC. For advice on your circumstances, speak to a lawyer or adviser with AML/CTF experience.