Who must comply with Customer due diligence (KYC) on every customer?

Identify and verify every customer (and beneficial owner) before providing a designated service.

Reporting entities must collect and verify customer identification information before providing a designated service. For non-individuals, beneficial owners (≥25% control or ownership) must be identified. Enhanced due diligence applies to high-risk customers including PEPs, complex structures, and high-risk jurisdictions. Simplified due diligence is available for limited low-risk categories.

Applies when the business has an AML/CTF designated service. Where the business has aml adjacent, check whether you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).

How the regulator frames it: All AUSTRAC reporting entities.

What triggers it: Onboarding a customer for a designated service.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (8 of 35: yes; 27 of 35: no).

Structure does not change the answer in the 8 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 8 industries it can reach: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. Tranche 2 industry (Real estate agents) — AML/CTF reporting entity from 1 July 2026.
• Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: does not apply. Requires an AML/CTF designated service.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business holds an Australian financial services licence (AFSL): it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business issues financial products or gives financial product advice: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business holds an Australian credit licence (ACL): it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business provides credit to customers: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business deals in crypto-assets or runs a digital currency exchange: it then applies (digital currency exchange / virtual asset services — AML/CTF reporting entity).
• The business receives large physical cash payments: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business makes or receives international funds transfers: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).

The engine shows this obligation as "check whether this applies" when a business has aml adjacent. It then applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3). That fact is not something Rules Mate can infer from industry, structure or size.

When due

Before providing the designated service. Ongoing for customer relationships.

Frequency

Ongoing

Evidence to keep

KYC records (identity documents, beneficial ownership), PEP/sanctions screening evidence, EDD documentation.

Status

Current

Priority

Critical

Maximum penalty: Each unverified customer can be a separate contravention — up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention.

Independent review. Authority: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ss26F(2), 26F(4)(f), 26H, 116 (compilation C62, in force 1 Jul 2026); AML/CTF Rules 2025 (F2025L01026) r5-10; AML/CTF Transitional Rules 2026 (F2026L00393) Part 7; AUSTRAC "Step 5: Conduct an independent evaluation" (last updated 31 Mar 2026).

Frequency: At least once every 3 years, at the frequency set in your AML/CTF policies (documented rationale). Transitional first-evaluation deadlines (30 Jun 2029 to 31 Dec 2030) depend on the last two digits of your AUSTRAC account number and on when you first provided the designated service.

Who can perform it: An evaluator who is independent: internal (for example internal audit) or external, but not your AML/CTF compliance officer or compliance team, and not anyone who developed the program or assessed your ML/TF risk. No mandatory qualifications. The evaluator reports in writing to your governing body and the senior manager who approves the program. Separately, AUSTRAC can require an external audit by an AUSTRAC-authorised auditor by written notice (ss161-162).

• AUSTRAC v Bell Financial Group (2024): Smaller AFSL holders are not exempt from EDD obligations; PEP/adverse-media flags require investigation and decision-record by senior management.
• AUSTRAC v SkyCity Adelaide (2024): Mid-tier casinos under same AUSTRAC scrutiny as majors; remediation expectations high.
• AUSTRAC v Crown Melbourne and Crown Perth (2023): Risk-based AML programs cannot remain unchanged for years. Junket and high-roller relationships demand sustained enhanced due diligence and credible source-of-funds verification.

If this obligation applies to you, so do these 7: the engine uses the same rule for each.

• Enrol with AUSTRAC as a reporting entity
• Maintain a written AML/CTF program
• Suspicious matter, threshold, and IFTI reporting to AUSTRAC
• Independent review of AML/CTF program
• Designate an AML/CTF Compliance Officer
• Detect + enhance due diligence on Domestic + Foreign PEPs
• Lodge the AUSTRAC annual compliance report (AML/CTF Act s 47)

• Beneficial ownership transparency (Tranche 3 — under consultation): Proposed beneficial ownership register for unlisted companies and trusts — consultation through 2024-2025; commencement TBD.

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

• Comply with Australian sanctions law + screening (DFAT): applies to 100% of the same businesses (4.4× the overall rate)

Rules Mate tracks 8 published obligations tagged "aml ctf", 6 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority, and is an ongoing duty.

Regulated by Australian Transaction Reports and Analysis Centre.

AUSTRAC: Anti-money laundering and counter-terrorism financing regulator and financial intelligence unit. Administers the AML/CTF Act, including Tranche 2 expansion from 1 July 2026.

• Australian Transaction Reports and Analysis Centre

AML/CTF Act: Federal AML/CTF regulation.

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006

Free tools that help with this obligation:

• AML Tranche 2 scope checker
• Beneficial owner identifier
• Compliance calendar builder