KYC and customer due diligence under Australian AML/CTF law

Initial customer due diligence

1. Collect identification information: name, date of birth and address for an individual; name, registration number and address for a company; the deed and parties for a trust.
2. Verify it against reliable and independent sources: a driver licence or passport, an ASIC extract, a trust deed, or an electronic verification service.
3. Identify and verify beneficial owners: the individuals who ultimately own 25 per cent or more of an entity, or control it by other means.
4. Check whether the customer or a beneficial owner is a politically exposed person.
5. Understand and record the purpose and intended nature of the relationship.
6. Rate the customer's risk and decide whether enhanced due diligence applies.

Enhanced and simplified due diligence

Higher-risk customers, including politically exposed persons, cash-intensive matters, complex structures and clients you never meet, get enhanced due diligence: source of funds and wealth, senior management approval and closer monitoring. Lower-risk customers can get simplified measures where your program justifies it. The decision and the reasons must be recorded.

Ongoing due diligence

Due diligence continues after onboarding: files are reviewed at intervals set by risk, transactions are compared against the stated purpose, and identification is refreshed when something changes. The law sets no fixed interval: your policies must set a frequency appropriate to each customer's risk, and six months for high risk, twelve for medium and twenty-four for low is a common small-firm schedule. You must also review a customer's risk when something changes: their type (for example becoming a politically exposed person), the services, the delivery channel or the countries involved, or when a suspicious matter report obligation arises.

Records

Keep the identification records, the verification evidence, the beneficial ownership findings, the risk rating and the reasons for seven years after the relationship ends. Never delete a client file; archive it.