Know Your Customer (KYC) is the cornerstone of any effective anti-money laundering and counter-terrorism financing framework. Under Australia's AML/CTF Act 2006, KYC is not merely a box-ticking administrative task—it is a binding legal obligation. Following the commencement of the Tranche 2 reforms, these obligations now apply directly to professional service firms and other non-financial businesses.

If your business provides designated services—whether you are a lawyer, accountant, conveyancer, real estate agent, trust and company service provider, precious metals dealer, or virtual asset service provider—you must verify your customers' identities before establishing a business relationship. This guide provides a detailed breakdown of the 2026 KYC requirements, acceptable identity documents, and digital verification standards.

What is KYC?

KYC is the process of collecting and verifying a client's identifying information. Under the Act, the objective is to establish with reasonable certainty that a client is who they say they are. This prevents individuals from operating anonymously or under false names to hide the proceeds of crime.

The KYC process involves two main parts:

Acceptable Identity Documents

AUSTRAC rules specify which documents are acceptable for verifying an individual's identity. These are divided into primary and secondary documents:

Primary Photographic Identification

These documents contain both a photograph and a signature, making them the most reliable form of ID. You can verify a client using a single primary photographic ID:

Secondary Non-Photographic Identification

If a client does not have a primary photographic ID, you must verify their identity using a combination of **one** primary non-photographic ID and **one** secondary document:

Warning: Photocopies of documents are not considered 'original' or 'reliable' unless they have been certified by an authorised person (such as a Justice of the Peace). Alternatively, digital verification tools must be used to scan the original document directly.

Digital and Biometric Verification

Manual verification—such as asking clients to bring physical documents into your office to photocopy—is increasingly obsolete, highly insecure, and inconvenient for remote clients. In 2026, the industry standard is digital identity verification.

Digital KYC platforms (like CompliDesk) integrate with the Australian Government's **Document Verification Service (DVS)** to check the validity of passports, driver's licences, and Medicare cards against government databases in real time. Combined with **biometric facial matching** (where the client takes a selfie to match against their ID photo), digital verification meets AUSTRAC's 'reliable and independent' source requirement and can be completed in under two minutes.

KYC for Corporate and Trust Clients

Verifying a business entity (often called Know Your Business or KYB) requires a multi-layered approach:

  1. Verify the Entity: Collect and verify the company name, registration number (ABN/ACN), registered address, and principal place of business using an ASIC search. For trusts, obtain and review the trust deed.
  2. Verify the Individuals: Identify and verify the identity of the directors (for companies) or trustees (for trusts).
  3. Trace Beneficial Ownership: Identify any individual who ultimately owns or controls 25% or more of the entity (the Ultimate Beneficial Owners) and perform standard KYC checks on them.

Important: If a company is owned by another company, you must trace the ownership chain upwards until you identify the actual living individuals who hold the ultimate control.

Timing and Risk-Based Approach

Under the Act, you must complete the KYC process **before** you provide the designated service. If you are unable to verify the client's identity, you must not proceed with the transaction, and you should consider whether the client's reluctance to provide ID warrants submitting a Suspicious Matter Report (SMR) to AUSTRAC.

Automate Your KYC Checks with CompliDesk

CompliDesk provides instant biometric KYC, DVS verification, PEP and sanctions screening, and company KYB tracing in a single, simple subscription. No per-check fees.

Start free today

Frequently Asked Questions

What does KYC stand for and what does it mean for Australian businesses?
KYC stands for 'Know Your Customer'. It is the legal process under the AML/CTF Act where a business collects and verifies the identity of its clients to ensure they are who they claim to be, preventing the business from being used to facilitate financial crime.
Is a Medicare card sufficient for KYC verification in Australia?
On its own, no. A Medicare card is classified as a primary non-photographic ID. To complete verification, it must be accompanied by another document, such as an Australian birth certificate (another primary non-photographic ID) or a recent utility bill/tax notice showing the client's name and address.
What happens if I cannot verify a client's identity?
If you cannot verify a client's identity to your satisfaction, you must not provide the designated service to them. Continuing to act for an unverified client is a serious breach of the AML/CTF Act. You should also evaluate whether the client's behaviour is suspicious and requires lodging an SMR with AUSTRAC.

Related reading: Customer due diligence explained · KYC/KYB for companies & trusts · 15 common AML compliance mistakes · Frequently asked questions