Ongoing Customer Due Diligence: What AUSTRAC Requires After Onboarding

Completing initial KYC is just the beginning. AUSTRAC requires ongoing customer due diligence (CDD) throughout the entire client relationship — monitoring transactions, updating records, re-screening periodically, and re-verifying when circumstances change.

What is ongoing CDD?

Ongoing CDD means monitoring your client relationship on a continuing basis to ensure that:

• Transactions are consistent with your knowledge of the client and their risk profile
• Customer information remains accurate and up to date
• Any new red flags or suspicious activity are detected and acted upon
• The risk rating assigned to the client remains appropriate

When must you re-verify a client?

AUSTRAC requires you to update customer information and re-verify when:

• There is a material change in the nature of the client relationship
• You become aware that information you hold may be inaccurate or outdated
• A client's ownership structure changes (new directors, new beneficial owners)
• A suspicion arises about the client
• The client requests a new or significantly different service

For high-risk clients, you should also set periodic re-verification intervals — at least every 12 months for PEPs, at least every 2 years for medium-high risk clients.

Transaction monitoring

Ongoing CDD includes monitoring transactions for unusual or suspicious patterns. You don't need to review every transaction manually, but you must have procedures to identify transactions that are inconsistent with the client's risk profile — unusually large amounts, unexpected frequency, unexpected jurisdictions.

Ongoing screening obligations

You must rescreen clients against sanctions lists and PEP databases at appropriate intervals and whenever the lists are updated. DFAT updates its Consolidated Sanctions List regularly. A client who was not sanctioned at onboarding may be added to the list at any time.

The KYC review cycle

CompliDesk flags clients when their KYC is approaching the 2-year mark — AUSTRAC's minimum recommendation for periodic re-verification. The dashboard shows which clients are due for review, making it easy to manage your ongoing CDD obligations across your entire client base.

Related reading: Customer due diligence explained · Ongoing customer monitoring best practices · AML risk assessment guide · Frequently asked questions