KYC for Accountants: Customer Due Diligence Steps

KYC for accountants starts by identifying the client and the people behind them, checking their risk and recording why you can provide the designated service. Complete initial customer due diligence before that service starts, then keep the information and risk assessment current.

What Customer Due Diligence Means for an Accountant

Customer due diligence (CDD) is how you establish who receives your services and assess their money laundering, terrorism financing and proliferation financing risk. It includes initial checks, monitoring and further checks when risk changes. The Australian Transaction Reports and Analysis Centre (AUSTRAC) uses the term customer due diligence.

Know your customer (KYC) is the information you collect and verify about the client and relevant people. KYC information supports CDD, but a completed form alone does not establish identity or explain the client’s risk.

AML/CTF obligations apply when your practice provides a designated service with the required Australian geographical link. The professional-services obligations apply once the relevant commencement boundary is reached. AUSTRAC’s professional designated services guidance covers these activities:

• Helping plan or execute a sale, purchase or transfer of real estate, a company or a legal arrangement.
• Receiving, holding, controlling or managing property to assist a transaction.
• Helping organise, plan or execute equity or debt financing for a company or legal arrangement.
• Selling or transferring a shelf company.
• Helping create or restructure a company or legal arrangement.
• Acting, or arranging someone to act, in specified company or legal-arrangement roles.
• Providing a registered office or principal place of business address.

Apply the service’s actual definition and any exemption to the work you accept. Preparing an ordinary tax return does not make every tax engagement a designated service.

The reformed AML/CTF Act requires outcomes established on reasonable grounds. Your evidence must justify the conclusion for this client. A fixed document pack can help staff collect information, but it cannot replace that judgement.

Tax-agent identity checks are a separate obligation. The Tax Practitioners Board’s client-verification guidance applies before tax or BAS services, with further checks as appropriate. Passing those checks does not automatically complete AML customer due diligence.

Initial Customer Due Diligence Before the Service Starts

Initial CDD establishes the client’s identity and the relevant people, then explains the service and its risk. AUSTRAC’s initial CDD overview sets out the required outcomes:

1. Establish the customer’s identity.
2. Identify any person on whose behalf the customer receives the service.
3. Establish the identity and authority of anyone acting for the customer.
4. Establish beneficial owners’ identities when the customer is not an individual.
5. Determine whether relevant people are politically exposed persons (PEPs) or designated for targeted financial sanctions.
6. Establish the nature and purpose of the relationship or occasional transaction.
7. Establish source of funds and source of wealth where the applicable PEP or enhanced CDD requirements require it.

Identify the client’s risk using the information available. Collect and verify enough information to manage that risk and reach each outcome on reasonable grounds. Resolve conflicting names or unexplained ownership before sign-off.

The default is completion before providing the designated service. Put that checkpoint before staff act on instructions that start the service.

Delayed initial CDD is a limited exception. For an Australian permanent establishment, only specified verification matters can be delayed. The delay must be essential to avoid interrupting ordinary business and add low ML/TF risk. Your policies must manage that risk and require prompt completion. Inconvenience alone is insufficient.

Under that general Australian rule, finish as soon as reasonably practicable and within 20 business days. Complete CDD before facilitating a transfer or making money or property available. The exception does not permit skipping all identification until later.

Pre-commencement customers have separate transition rules. An old tax client is not automatically a pre-commencement customer for a designated service. Relevant triggers include an SMR obligation or a changed relationship that raises risk to medium or high.

Checks by Client Type

Collect the client’s entity details, then verify the relevant facts against reliable and independent data. The following documents are common starting points. Your AML/CTF policies and client risk decide what else you need.

Client type	Information to collect	Usual onboarding evidence
Individual	Full name, other names, date of birth and residential address	Passport or driver’s licence, with address evidence when needed
Sole trader	Individual details, business names, ABN and principal business address	Individual ID plus ABR or business-name register result
Company	Full name, ACN, business names, registered office, principal business address and relevant people	Current company extract, ownership records and representative authority
Trust	Name, kind, ABN if issued, business address, governing powers and relevant people	Executed deed, variations and trustee-change documents
Partnership	Name, business names, ABN, business address and partners’ details	Partnership agreement and register records
SMSF	Fund details, trustees, members and instructing person’s authority	Fund deed, trustee appointments and corporate-trustee records where applicable

For an individual, verify information that distinguishes them from someone with a similar name. Also establish that the person presenting is the person identified. A face-to-photo comparison in person or by video is one route. Reliable electronic verification can be used where it meets your risk-based requirements. Resolve a changed address or other discrepancy.

A sole trader needs checks of both the individual and the business. A business name or ABN result alone does not verify the individual. AUSTRAC’s sole-trader guide explains the two parts.

For a company, check directors and shareholders as needed to understand who owns or controls it. Trace relevant ownership beyond a shareholder company. Establish the identity and authority of the person giving instructions. A company extract alone may not reveal the final beneficial owners.

Partnership checks establish the partnership and the relevant partners. Confirm which partner or representative instructs you and what authorises them. Use AUSTRAC’s company and partnership guide for those entity checks.

For a trust, read the deed with its variations and trustee appointments. Record trustees, appointors and beneficiaries named individually or by class. Record the settlor where relevant, including any retained power or control. Identify which people require verification under the applicable CDD rules. A beneficiary class does not make every possible member a person you must individually verify.

An SMSF uses the trust checks, plus its trustee and member arrangements. With a corporate trustee, check the company and the individuals who control it. Confirm authority separately for the person giving instructions. AUSTRAC’s trust guide explains the governing-document approach.

Use the beneficial-owner checks to work through ownership and control in detail.

Client Risk Assessment at Onboarding

Rate the client using their circumstances, the service and how they deal with your practice. AUSTRAC’s risk-rating guidance supports a case-by-case assessment. Record why the overall rating is low, medium or high under your policies.

Consider the entity’s purpose and transparency, countries involved, the service sought and the delivery method. A remote engagement needs attention to impersonation risk. An overseas connection needs assessment of the actual jurisdiction and the person’s role.

Higher-risk features can include multiple entities with no clear commercial purpose, cash-intensive activity, overseas beneficial owners and requests to move client money. Investigate the combination of features. One overseas person does not automatically make every client high risk.

Consider this fictional example. A family trust with a corporate trustee asks your practice to restructure its investments. One adult beneficiary lives in Singapore. Start by reading the deed and identifying the trustee company’s owners and decision makers. Establish whether the overseas beneficiary controls the trust or receives the designated service through it.

Suppose the trustee provides a clear ownership chain and the restructure has a documented commercial purpose. The overseas connection still needs screening and assessment. A medium rating could be appropriate under the practice’s policies, with additional evidence about the proposed transaction. This is an illustrative decision, not a mandatory rating for Singapore or family trusts.

If funds come from an unexplained overseas source or the client refuses to identify a controller, reassess the risk. Resolve the missing evidence before accepting the service. A high rating requires enhanced CDD. A low rating permits simplified measures only when the legal conditions and your policies allow them.

Simplified and Enhanced Customer Due Diligence

Simplified CDD reduces specified checks for eligible low-risk clients. Standard CDD is the practice’s ordinary set of risk-based checks. Enhanced CDD adds measures targeted to higher risk or a compulsory trigger.

Under the AML/CTF Rules, simplified measures require low risk, no enhanced CDD requirement and policies that address their use. A long relationship or a familiar referral alone does not establish eligibility. Record which measure you reduced and why you still meet the required outcome.

Enhanced CDD is compulsory for high-risk customers. Other triggers include foreign PEPs, relevant people present or formed in a jurisdiction where the Financial Action Task Force (FATF) calls for enhanced CDD, and nested service relationships. It also applies to unusual transaction patterns, unusually large or complex transactions or services with no apparent economic or legal purpose. An SMR obligation triggers enhanced CDD where you intend to continue providing designated services.

Apply measures that address the reason for concern:

• Collect and verify additional identity or transaction evidence.
• Establish source of funds and source of wealth where relevant or specifically required.
• Obtain the required senior manager approval before providing or continuing the service.
• Review the relationship more frequently and monitor activity more closely.
• Limit services or decline work where the risk falls outside your practice’s risk appetite.

Source of funds explains where money for the transaction comes from. Source of wealth explains how the person accumulated their overall wealth. Bank statements can show movement of funds, while sale or inheritance records can explain their origin.

PEP requirements require source-of-funds and source-of-wealth checks for foreign PEPs and relevant high-risk domestic or international organisation PEPs. Senior manager approval also applies in the specified PEP circumstances. Your policies must identify other approval and escalation requirements. Use the PEP and sanctions guide for screening and match resolution.

Ongoing Customer Due Diligence After Onboarding

Ongoing CDD monitors the client’s activity and keeps their information and risk assessment current. AUSTRAC’s ongoing CDD guidance requires monitoring for unusual transactions and behaviour. During a business relationship, review and update risk and KYC information as appropriate, including reverification where needed.

Triggers for a fresh review include a new director, changed trustee, changed ownership or an unexplained large transaction. A new overseas connection can also change the information you need. Record the trigger and reassess whether the activity matches the relationship’s purpose.

Tie a scheduled review to preparing the client’s tax return or financial statements. Ask whether ownership, authority, activities and countries involved have changed. An annual checkpoint is a practical scheduling choice, not a universal statutory review interval. Higher risk or a new event can require action sooner.

Give the review an owner and due date. Record changes and the next review date in the client file. Your AML/CTF program sets the monitoring method and escalation steps.

Customer Due Diligence Checklist

Record each check and decision from first contact to sign-off in the table below. Add a status and responsible staff member to each row in your working copy.

Order	Check or decision	Evidence held
1	Identify the proposed service and whether AML/CTF applies	Service description, relevant designated-service item and exemption assessment
2	Identify the customer and entity type	Names, identifiers, addresses and entity documents
3	Identify the instructing person and authority	Identity-check record and authorisation evidence
4	Identify persons on whose behalf the customer receives the service	Relationship explanation and relevant person records
5	Record beneficial owners and relevant controllers	Ownership chain, governing documents and verification record
6	Record PEP and sanctions results for relevant people	Search date, matching identifiers, results and match-resolution notes
7	Explain the service’s purpose and expected activity	Client explanation and supporting transaction documents
8	Assign low, medium or high risk	Rating, reasons and identified risk factors
9	Select simplified, standard or enhanced CDD	Policy basis, additional evidence and measures applied
10	Resolve gaps and approve the service	Approver’s name, decision, date and any conditions
11	Set monitoring and review arrangements	Review owner, triggers, next date and retention instructions

Your new-client form can collect details, entity documents, ownership explanations and the reason for seeking your service. Staff must separately verify identity and authority, resolve screening results and approve the risk determination. Keep the client’s answers separate from your conclusions.

Tax Genie runs identity verification, PEP and sanctions screening and the client risk assessment inside the onboarding request. Its risk register shows each client’s standing and next review date. Staff record the determination and use those results in the practice’s CDD decision.

Records, Reliance and When CDD Cannot Be Finished

Keep records that show the information collected, verification steps and reasons for each CDD decision. Include risk assessments, screening results, relevant approvals and changes made during ongoing CDD. Restrict access to sensitive records.

AUSTRAC’s record-keeping guidance requires CDD records for seven years after the business relationship ends or the occasional transaction is complete. It does not require copies of identity documents themselves. Keep sufficient details of the evidence and checks to demonstrate what you did. Other obligations can require different records or retention periods.

An ongoing CDD reliance arrangement can use verified KYC information from another reporting entity or eligible regulated foreign equivalent. Assess the third party before relying on it. The arrangement must be written and approved by a senior manager.

The arrangement must allocate responsibilities and give you access to KYC information before the service, subject to a lawful delay. It must allow prompt access to the reliable independent verification data. Keep your own risk decision, arrangement and assessment records. A forwarded ID image from the former accountant is not, by itself, a reliance arrangement.

If you cannot establish the required initial CDD matters, do not start the designated service unless a lawful exception applies. Escalate the reason under your policies and consider whether the facts create an SMR obligation. Missing paperwork alone does not automatically mean a report is required. Keep any suspicion and reporting decision secure, and avoid alerting the client to it.

Release the job to staff only when the required CDD is complete or an authorised exception is documented with its conditions and deadline.