What's the difference between CDD and KYC?

KYC (verifying identity documents) is really one part of the broader CDD process, which also covers understanding the purpose of the relationship, risk-rating the client, and ongoing monitoring over time.

What triggers Enhanced Due Diligence instead of standard CDD?

Being rated high-risk, being a politically exposed person, or showing other red flags — these trigger additional scrutiny, more documentation, and closer ongoing monitoring.

Is CDD something I only do once, when a client signs up?

No — it's ongoing. You're expected to keep monitoring the relationship and refresh your understanding if something material changes, not just check once at the start.

What Is Customer Due Diligence (CDD)? A Simple Explanation

Customer Due Diligence — CDD — is really the core concept underneath everything else in Tranche 2.

CDD is just "understanding who you're dealing with, and why"

It's broader than KYC (which is really about verifying identity documents). CDD also covers understanding the purpose of the relationship, assessing how risky the client actually is, and keeping an eye on things over time — not just a one-time ID check.

Standard CDD vs Enhanced Due Diligence

Most clients only need standard CDD — the baseline identity verification and risk assessment every client goes through. Some clients need more — called Enhanced Due Diligence (EDD) — triggered by things like being a politically exposed person, being rated high-risk, or showing other red flags. EDD means more documentation, closer monitoring, and often senior sign-off before proceeding.

Is this just a one-time thing at onboarding?

No — this is probably the most misunderstood part. CDD is ongoing. You're expected to keep an eye on the relationship over time, and refresh your understanding of the client if something changes materially (they move overseas, their business changes, a transaction looks unusual for them).

How often should I actually refresh this?

There's no universal rule — it should match risk level. High-risk clients might warrant a fresh look every 6-12 months; lower-risk clients can go longer. Regardless of schedule, any material change in circumstances should trigger a fresh look immediately.

Making ongoing CDD manageable

CompliDesk automatically schedules review dates based on each client's risk level, so ongoing monitoring doesn't rely on you remembering to check back in — it prompts you when a review is actually due.

Ready to simplify your AML compliance?

CompliDesk guides lawyers, accountants, real estate agents, conveyancers, TCSPs, precious metals dealers and VASPs through every AUSTRAC obligation. Sign up free today.

Get Started Free

Frequently Asked Questions

What is the difference between Tranche 1 and Tranche 2 under Australia's AML/CTF Act?

Tranche 1 (passed in 2006) applied only to the financial services, gambling, and bullion sectors. Tranche 2 extends these anti-money laundering and counter-terrorism financing (AML/CTF) obligations to designated non-financial businesses and professions (DNFBPs), including lawyers, accountants, real estate agents, conveyancers, trust and company service providers, and precious metals/stones dealers.

Do all lawyers, accountants and real estate agents need to register with AUSTRAC?

No, only those who provide 'designated services' as defined in Schedule 1 of the AML/CTF Act. For example, a litigator who only represents clients in court is generally not captured, whereas a lawyer who assists with property transactions, company formations, or managing client trust accounts is. Similarly, accountants providing tax advice or basic bookkeeping are not captured unless they manage client funds, set up companies, or act as trustees.

What is the AUSTRAC enrolment deadline for Tranche 2 entities?

Under the transitional arrangements, Tranche 2 entities were required to enrol with AUSTRAC by 29 July 2026, following the official commencement of the reforms on 31 March 2026.