Customer Due Diligence (CDD)—frequently referred to as Know Your Customer (KYC)—is a fundamental legal obligation under the Australian Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act 2006. Under the Tranche 2 reforms, this requirement now applies directly to designated non-financial businesses and professions (DNFBPs).

Whether your business operates in the legal, conveyancing, accounting, real estate, trust and company service, precious metals, or virtual asset sectors, you must establish the true identity of your clients before delivering any regulated services. This guide explains the core concepts of CDD, the different tiers of diligence required, and how to execute them efficiently.

What is Customer Due Diligence?

Customer Due Diligence is the process of collecting and verifying information about a client to ensure they are who they claim to be. The primary objective is to prevent criminal elements from using legitimate businesses as conduits for laundering illicit funds, hiding assets, or financing terrorism.

In addition to verifying identity, CDD requires you to understand the "nature and purpose" of the business relationship. This means establishing what kind of transactions are expected and where the client's funds originate, enabling you to detect anomalies later.

The Three Levels of CDD

Under the risk-based approach regulated by AUSTRAC, you must apply one of three levels of due diligence depending on the client's risk profile:

1. Standard Due Diligence

Applied to typical, medium-risk clients. It involves collecting and verifying standard identity information (e.g., driver's licence or passport for individuals; ASIC search and beneficial ownership tracing for companies).

2. Simplified Due Diligence

Applied to low-risk clients. This category includes publicly listed companies, government bodies, and other regulated financial institutions. Since these entities are already subject to high levels of public disclosure and regulation, you may only need to verify that they are indeed registered and active, without tracing beneficial ownership.

3. Enhanced Due Diligence (EDD)

Applied to high-risk clients or when a suspicious activity occurs. EDD requires you to collect additional information, such as the client's source of wealth and source of funds, and obtain senior management approval before proceeding with the transaction.

Example: If your client is a Politically Exposed Person (PEP), or is based in a country with high levels of corruption, you must automatically escalate the client to Enhanced Due Diligence.

When Must CDD Be Conducted?

The general rule under the AML/CTF Act is that CDD must be completed **before** you provide any designated service. For example, a real estate agent must verify the identity of the seller before listing the property, and a lawyer or conveyancer must verify the client before executing a property transfer or setting up a company trust.

Warning: Commencing a transaction or providing professional services before completing KYC is a major compliance violation that can result in severe AUSTRAC penalties.

CDD for Individual Customers

To verify an individual, you must collect and verify their full name, date of birth, and residential address. Acceptable documents are classified into:

CDD for Companies and Trusts

Verifying corporate and trust clients (known as Know Your Business or KYB) is more complex. You must:

  1. Verify the legal existence of the entity (e.g., via an ASIC company extract or a trust deed).
  2. Identify and verify the identity of the directors or trustees.
  3. Identify the **Ultimate Beneficial Owners (UBOs)**—any individual who ultimately owns or controls 25% or more of the company's shares or voting rights.

Simplify Your KYB and Beneficial Ownership Tracing

CompliDesk automatically pulls ASIC company data, maps out complex beneficial ownership structures, and runs instant KYC checks on directors and UBOs in one seamless workflow.

Get Started Free

Frequently Asked Questions

What is the difference between KYC and CDD in Australia?
The terms are often used interchangeably. However, KYC (Know Your Customer) refers specifically to the initial step of collecting and verifying identity. CDD (Customer Due Diligence) is broader—it includes KYC, but also involves understanding the client's business, assessing their risk profile, and conducting ongoing monitoring.
Who counts as a beneficial owner for CDD purposes under Australian AML law?
A beneficial owner is any individual who ultimately owns or controls 25% or more of a corporate client or trust, either directly (through share ownership) or indirectly (through voting power or influence over decision-making).
Can I use digital identity verification to satisfy CDD requirements?
Yes. AUSTRAC permits the use of electronic identity verification (eIDV) systems that match client details against independent data sources, such as credit bureaus, government registers (via the Document Verification Service), or biometric facial matching.

Related reading: KYC requirements in Australia · Enhanced due diligence guide · Ongoing customer due diligence · Frequently asked questions