Customer due diligence under AML/CTF Tranche 2: simplified, standard, enhanced

Customer due diligence is the operational engine of AML compliance. The firm identifies the customer, verifies the identity, identifies and verifies beneficial owners, and understands the nature and purpose of the business relationship. The depth depends on the level of risk: simplified, standard, or enhanced.

Standard customer due diligence is the default. For an individual, the firm collects full name, date of birth, and residential address, then verifies these from independent reliable sources (passport, drivers licence, electronic verification). For a body corporate, the firm collects the legal name, ACN or ABN, registered office, and verifies via the ASIC database. For a trust, the firm collects the trust name, the trustee identity, and the deed; for a partnership, the firm collects the partnership name and partner identities.

Beneficial ownership is the most common failure point. For a body corporate or trust customer, the firm must identify each individual who owns or controls 25 per cent or more of the entity (directly or indirectly), or who exercises effective control regardless of ownership. The chain of ownership must be documented; foreign holding entities mean documenting up the chain to the ultimate individuals.

Simplified customer due diligence is permitted for low-risk customers. Examples include listed Australian public companies and their subsidiaries, Australian government entities, and customers subject to oversight by a prudential, insurance or investor protection regulator (such as banks, insurers and AFSL holders). Simplified CDD is only available where the customer is assessed as low risk and no enhanced due diligence trigger applies, and the firm’s policies must deal with it. The main relief is that the firm need not separately identify the beneficial owners of these customers.

Enhanced customer due diligence is required for higher-risk customers. Foreign politically exposed persons (and their family members and close associates); domestic and international organisation PEPs where the customer’s risk is assessed as high; customers present in, or entities formed in, a jurisdiction for which the FATF has called for enhanced due diligence (the FATF black list), with links to FATF grey list countries a risk factor that may lead to a high risk rating and therefore EDD; customers using complex or unusual ownership structures; and any customer where standard CDD raises concerns. Enhanced CDD means measures appropriate to the higher risk, typically including source of wealth and source of funds information and closer ongoing monitoring. Senior manager approval before onboarding is mandatory for foreign PEPs and high-risk domestic or international organisation PEPs, and firms commonly require it for other high-risk customers.

Ongoing customer due diligence is the continuous obligation that catches firms by surprise. Customer information must be updated periodically (typically every two to three years for standard customers, more often for higher-risk). Sanctions and PEP screening should be repeated whenever material new information emerges. Transactions inconsistent with the customer profile should be reviewed.

Practical advice for accountants and legal firms: build customer due diligence into your client onboarding flow rather than treating it as a separate process; train staff to spot the triggers for enhanced CDD (PEP indicators, complex ownership, unusual transactions); document beneficial ownership in a structured way that survives staff turnover; and review your customer list annually for jurisdictional and PEP status changes.