Privacy Collection Notice for KYC Clients: What to Tell Them Under APP 5

When you verify a client for AML/CTF, the Privacy Act expects you to tell them what you are collecting and why. That message is a collection notice, and it comes from APP 5, the rule about telling people when you collect their personal information. Here is what a privacy collection notice for KYC clients must say, when to give it, an example you can adapt, and the one thing it must never say.

It draws on the August 2026 AML/CTF privacy guidance from the Office of the Australian Information Commissioner (OAIC). It is general information, not legal advice.

What is an APP 5 collection notice?

A collection notice is a short statement you give a person when you collect their personal information. Your privacy policy (APP 1) describes how your firm manages personal information in general; the collection notice is the specific message a client sees when you ask for their details.

The OAIC says reporting entities need both: "a privacy policy and collection notices with clear and transparent information about how you handle personal information for your AML/CTF obligations." The Privacy Act applies to this work even if your firm turns over less than $3 million; our post on AUSTRAC enrolment and the Privacy Act explains why.

When to give the notice

Before you collect the information or, if that is not practicable, as soon as practicable after. In practice, put it wherever a client first hands over details:

• the onboarding form or engagement letter;
• the email or text that carries an identity-check link;
• the page where a client uploads documents or answers your questionnaire; and
• a short script for staff who take details over the phone.

What a collection notice must cover

Section E of the OAIC guidance lists the matters you must take reasonable steps to tell customers about. In plain terms:

1. Who you are. Your firm's name and contact details.
2. What you collect, how and why. What information you need, why you need it, and how you collect it (a form, an online identity check, a document upload).
3. The law behind it. Whether the collection is required or authorised by law. The OAIC says you should name the law, for example the AML/CTF Act or the AML/CTF Rules, and you could also name the specific provisions.
4. What happens if they do not provide it. For example, that you may not be able to provide the service.
5. Who you usually share it with. Your usual disclosures, including third-party providers such as an identity verification service, and high-level information about when you may disclose information to AUSTRAC or another entity.
6. Whether it goes overseas. How likely it is that information will be disclosed outside Australia, and the countries where those recipients are likely to be.
7. How to see or correct it. The access and correction processes in your APP privacy policy.

The guidance calls these "a range of matters, including" and points to Chapter 5 of its APP Guidelines for the full detail, so treat the seven as the core, not the whole.

Extra points for identity checks: selfies and credit checks

Selfies. Matching a selfie to an ID photo uses biometric information, which is sensitive information under the Privacy Act. The OAIC's view is that consent should generally be sought before biometric verification for customer due diligence, and that the person must be given sufficient information in your collection notice.

Credit-reporting checks. If you verify identity against a credit reporting body's records, you must first tell the person about the process, the reasons for it and the information that may be disclosed, get their express consent, and offer another way to verify their identity.

An APP 5 collection notice example you can adapt

Here is a plain collection notice template for a firm that verifies individual clients. Replace the square brackets, remove anything your firm does not do, and keep it consistent with your privacy policy.

The AUSTRAC sentence is general and the same for every client: the high-level information the OAIC describes.

The OAIC has also developed a privacy collection notice template for AML/CTF reporting entities. It is listed in the resources section of the OAIC's guidance, and the OAIC's AML/CTF information is at oaic.gov.au/amlctf. Check your notice against it.

The tipping-off limit: what a notice must never say

Tipping off is the AML/CTF Act's prohibition (section 123) on disclosing information that would or could reasonably be expected to prejudice an investigation. In practice: never reveal that a suspicious matter report (SMR) exists, or that there is a suspicion. The OAIC builds this into APP 5 in two ways.

• No notice where it would tip someone off. You are not required to give a collection notice where that would be inconsistent with the tipping-off prohibition. The OAIC's checklist puts it more firmly: you should not notify the person in that case.
• Take care asking for more. You must not collect personal information directly from a person where that would or could reasonably be expected to prejudice an investigation.

So if there is a concern about a client, do not send them a tailored notice, request or explanation that hints at it. Speak to your compliance officer first. Our suspicious matter reports guide covers when an SMR is due, and the same limit applies when a client asks to see their file: see access requests and tipping off.

How to put a collection notice in place: five steps

1. List every point where you collect client information, from forms to phone calls.
2. Write one notice that covers the seven matters, using the example above or the OAIC's template, describing what your firm actually does.
3. Put it in front of the client before they give their details, and ask for consent where a selfie is matched.
4. Check it against your privacy policy. Providers, overseas countries and the access process should match. Our Privacy Act compliance guide for AML/CTF firms covers the policy.
5. Brief your staff on the notice and the tipping-off limit, and review it when you change providers or services.

How CompliDesk helps

Not using CompliDesk? Our free privacy policy generator writes a privacy policy and a collection notice for an AML/CTF firm from a short set of questions. No sign-up, and nothing you type into it leaves your browser.

In the CompliDesk Privacy Hub, step 1 asks a short set of questions about your firm and produces both a privacy policy and a collection notice from your answers. Four more steps follow: download the policy, check the list of client information CompliDesk builds from your records, write your plan for lost or stolen information, and work through the OAIC's 14-question checklist, five of which CompliDesk ticks itself. CompliDesk's identity-check email and page show clients a short notice before the check starts.

The Privacy Hub is included in every CompliDesk monthly plan at no extra cost. See pricing, book a demo, or read the Privacy Act guide.

Frequently Asked Questions

This article is general information, not legal advice. Related reading: Privacy Act compliance for AML reporting entities · Customer due diligence explained · Suspicious matter reports guide · How long to keep a copy of ID · Automated decisions in your privacy policy