How to onboard a new accounting client in Australia

Onboarding is the stretch between a prospective client saying yes and your team starting the work. It covers more than paperwork. In that window an Australian firm decides whether to accept the client, confirms who they are, agrees the terms in writing, gets authority from the ATO and ASIC, collects TFNs safely and, for some services, meets AML/CTF obligations that began on 1 July 2026.

This guide sets out each step in the order most firms run them, the rule behind it, and what to ask for. It finishes with a worked example for a family group of two individuals, a discretionary trust, a company and an SMSF.

The rules at a glance

Step 1. First enquiry and acceptance

Before anything is signed, decide whether you can and should take the client on. APES 110 paragraph 320.2 says that accepting a new client relationship "might create a threat to compliance with one or more of the fundamental principles."

The Code points to two kinds of threat at this stage.

• Integrity and professional behaviour. Paragraph 320.3 A1 gives examples of questionable issues associated with a client, its owners, management or activities, including "client involvement in illegal activities, dishonesty, questionable financial or non-financial... reporting practices or other unethical behaviour."
• Competence. Paragraph 320.3 A3 says a self-interest threat arises if the engagement team does not have, or cannot acquire, the competencies needed. Paragraph 320.3 A5 lists safeguards such as assigning people with the right skills, agreeing a realistic timeframe and using experts where needed.

In practice, the first call or meeting is where you gather what you need to make that call. Ask who the people and entities are, what they need done, which years are outstanding, who acts for them now, and whether there are any ATO debts, audits or disputes. Note the answers on the client file. They feed the acceptance decision, the engagement letter and, where relevant, the AML/CTF risk assessment.

Step 2. Professional clearance from the existing accountant

When a client is moving from another accountant, R320.4 requires you to "determine whether there are any reasons for not accepting an engagement" when you are asked to replace another accountant, are tendering for their work, or are doing work complementary to theirs. AUST 320.2.1 extends this to cases where the other accountant is not a member of a professional body.

The steps the Code sets out:

1. Get the client's permission. Paragraph 320.5 A1: you "will usually need the client's permission, preferably in writing, to initiate discussions with the Existing or Predecessor Accountant."
2. Ask for anything you should know. Paragraph 320.4 A4 gives as a safeguard asking the existing accountant for "any known information of which, in the Existing or Predecessor Accountant's opinion" you need to be aware before deciding.
3. If you cannot reach them, R320.6 says you "shall take other reasonable steps to obtain information about any possible threats."

When you are the outgoing accountant, R320.7 requires you to comply with relevant laws and provide information "honestly and unambiguously." Paragraph 320.7 A1 reminds you that you remain bound by confidentiality, so what you can say depends on the client's permission and the legal and ethics requirements.

For audits and reviews of financial statements, R320.8 goes further. You must request the information, and if the client refuses permission, the existing accountant must tell you so. For an SMSF audit appointment this is the paragraph to read in full.

A clearance letter usually also asks for the handover items you need to do the work: prior-year returns and workpapers, depreciation and asset registers, trust deeds and minutes, loan account balances, carried-forward losses and lodgement status. A professional clearance letter template covers the wording.

Step 3. Verify identity under the TPB guidance

For registered tax and BAS agents, proof of identity is set by TPB(GS) 42/2022 Proof of identity requirements for client verification. It ties the obligation to Code item 1 (honesty and integrity), item 7 (competence) and item 9 (reasonable care in ascertaining a client's state of affairs), and to the fit and proper person requirement.

Who to verify

• Every new client, before you provide tax agent or BAS services.
• Any individual representative who engages you for a client, together with evidence of their authority.
• Each client separately when you are engaged by several related clients (paragraph 12). A family group means several verifications, not one.

Referred clients still need your own checks, whatever the referrer did (paragraph 34). A buyer practice may rely on the seller's transferred proof of identity records but should consider ongoing checks (paragraph 31). For well-established clients you can use professional judgement about the standard steps, but keep a record of that assessment (paragraphs 18 to 21).

What to obtain and sight

Check that the photo matches the person and that names, addresses and dates of birth are consistent across documents (paragraph 11).

How to sight it

Face to face is the standard. Video calls carry the same requirements, and the record should note that the documents were sighted that way (paragraph 28). Sensitive documents should not travel by ordinary email. The guidance suggests secure portals or encrypted attachments (paragraphs 26 and 27). Certified copies sent to you should be destroyed once the checks are recorded (paragraph 28).

What to keep

Do not keep copies of the identity documents. Keep a contemporaneous record instead: date and time of the check, who did it, which documents were sighted, how they were sighted, and that they appeared legible and unquestionable (paragraph 24). Keep that record for at least five years after the engagement ends (paragraph 25).

If something does not add up, the guidance says to ask probing questions, seek more evidence, verify independently where you can, decline the engagement if you are not satisfied, and consider notifying the TPB, ATO, ASIC or other authorities (paragraph 36).

Step 4. AML/CTF customer due diligence, where it applies

From 1 July 2026, accountants who provide certain professional services are regulated under the AML/CTF Act. AUSTRAC says firms "must comply with the Act and Rules from this date" and need to enrol.

The obligations attach to designated services, not to every client. AUSTRAC lists the accountant services that may be designated services, where they are provided in the course of business and directly advance the transaction or outcome:

• helping plan or carry out the sale, purchase or transfer of real estate
• helping plan or carry out the sale, purchase or transfer of a body corporate or legal arrangement where a controlling interest changes hands
• receiving, holding or managing a client's money or property as part of such a transaction (money held as payment for your own services is excluded)
• helping organise equity or debt financing for a body corporate or legal arrangement
• selling or transferring a shelf company
• helping create or restructure a body corporate or legal arrangement, such as drafting a trust deed or company constitution, or registering with ASIC
• acting, or arranging for someone to act, as a director, secretary, trustee, partner, power of attorney or nominee shareholder
• providing a registered office or principal place of business address

AUSTRAC notes that advice which only influences a transaction, rather than directly advancing it, is not regulated. Its example is tax advice on selling a body corporate. Work through your own service list against the designated services and record which ones apply. The Tranche 2 AML guide goes further.

Initial CDD for individuals

AUSTRAC's guide for individual customers says to collect enough to distinguish the person from others with similar names, such as full name, other names, date of birth, residential address and any unique identifier. Verification could use a government-issued primary photographic ID, or a primary non-photographic document plus a secondary document showing name and address. You also check the person is who they claim to be, for example by comparing them with their photo.

On timing, AUSTRAC says: "Ordinarily, you would need to verify this information before you start providing a designated service." Delayed verification is possible only in limited circumstances.

For companies, trusts and other customer types, AUSTRAC publishes separate guides because the process differs for each. Use those for beneficial owners and the people acting for the entity.

The TPB guidance says its approach aligns with ATO and AUSTRAC methods. One identity check, done to the stricter standard and recorded properly, can serve both, provided your AML/CTF program says so.

Step 5. Agree terms in writing

APES 305 paragraph 3.1: "A Member in Public Practice shall document and communicate to the Client the Terms of Engagement." Paragraph 3.3 says this should be done "preferably before the Engagement commences." The current version applies to engagements commencing on or after 1 January 2025.

Section 4 of APES 305 is a guide to matters to consider including. They cover:

• the purpose of the engagement document
• objectives and scope of the engagement
• the outputs you will deliver
• each party's responsibilities
• involvement of other practitioners
• fees and billing arrangements
• ownership of documents
• the client's written confirmation of the terms

For recurring work such as annual returns and quarterly BAS, paragraph 5.1 describes a recurring engagement: unchanged terms, the same or similar service each period, defined start and end dates and a regular schedule. Paragraph 5.2 lists reasons to reissue or amend, including client misunderstanding, changes in management or ownership, changes in law or standards, and significant changes in the services or terms.

APES 305 has no specific rule for family groups. Many firms issue one engagement document that names every entity and sets out the services and fees for each. If you do, make sure the person signing has authority for each entity, and that each entity's scope and responsibilities are clear. See the engagement letters guide and the family group engagement letter template.

Step 6. Collect personal information and TFNs properly

The Privacy Act

The OAIC says a small business is one with annual turnover of $3 million or less, and most small businesses are not covered by the Privacy Act. Some are, and an AML/CTF reporting entity is covered regardless of turnover. If your firm now provides designated services, plan on the Australian Privacy Principles applying.

The principles that bite during onboarding:

• APP 3 covers when you can collect solicited personal information. Ask for what the engagement needs, not everything you might one day want.
• APP 5 covers when you must tell a person about the collection. A short collection notice in your onboarding form or engagement letter handles this.
• APP 11 requires reasonable steps to protect personal information from misuse, interference and loss.

Tax file numbers

The Privacy (Tax File Number) Rule 2015 applies to individuals' TFN information. OAIC guidance on the Rule says a TFN recipient:

• must not record, collect, use or disclose TFN information unless a taxation, personal assistance or superannuation law permits it
• must tell the individual the name of the law that authorises collection, the purpose, and that it is not an offence to decline to quote a TFN
• must take reasonable steps to protect TFN information and limit access to staff who need it
• must securely destroy or permanently de-identify TFN information once it is no longer required

The OAIC also notes there is no law requiring an individual to give their TFN when asked, although declining can have financial consequences. Write your request so it explains, rather than demands.

For business TFNs, the ATO's client-to-agent linking checklist says to ask for it by phone, because "email is not a secure channel."

Step 7. Link to the client with the ATO

Companies, trusts, SMSFs and other ABN entities

Entities with an ABN, other than sole traders, must nominate you before you can add them. The ATO's agent checklist sets out the sequence:

1. Complete onboarding, including proof of identity checks under TPB(GS) 42/2022.
2. Tell the client they must nominate you in Online services for business. You cannot do it for them.
3. Give them your registered agent number and the ATO's nomination instructions.
4. Ask them to send you the PDF nomination confirmation. You will not be notified automatically.
5. Check the Client nominations on-demand report in Online services for agents.
6. Add the client to your client list within 28 days of the nomination.

Add income tax clients using the business TFN and do not select the activity statement account. If you only act for activity statements, add only that account. For STP, link at the activity statement STP reporting level using "add payroll only." Do not remove another agent unless the client has authorised it.

Individuals and sole traders

As at October 2026, the ATO says "No action is required at this stage" and existing arrangements continue. A new process is planned in which the agent starts a nomination request and the client confirms it in the ATO app or Online services for individuals through myGov. The ATO plans a pilot in March 2027 and full deployment in November 2027, when it becomes the only way to add new individual and sole trader clients. Check the ATO page before relying on these dates.

Step 8. Authority with ASIC for companies

To act for a company with ASIC, you need to be an ASIC registered agent. ASIC describes two routes:

• Appointment. The company confirms it has appointed you through Form 362, signed by an officeholder and lodged through the registered agent portal. Once processed, the company is linked to your account.
• Corporate key. You can lodge a change of company details, or apply for voluntary deregistration, without an appointment by using the company's corporate key and your own login. The key is on the registration cover letter or the most recent annual statement.

Ask for the corporate key in your onboarding request for any company client, and treat it as sensitive. If you will receive annual statements and manage the company register, ask for the signed Form 362 at the same time as the engagement letter.

Step 9. Confirm entity details on the ABR

ABN Lookup is a free check that the entity details you have been given are right. It shows ABN status, entity and business names, ACN or equivalent, GST registration, DGR status, state and postcode of the main business location, and ACNC registration. It does not show contact details or a full street address.

Run it for every entity in the group before you draft the engagement letter. Check the exact legal name of each trustee and trust, whether the ABN is active and whether GST registration matches what the client told you. Mismatches are worth a question before signing, not after.

Step 10. Set up the work

Once terms are signed, identity is recorded and authority is in place, create the jobs, budgets and recurring tasks for each entity and period in scope. Record what you are still waiting on and from whom. Clearance handover documents often arrive after signing, so the first job for a transferring client is usually a reconciliation of prior lodgements and balances.

Timing: a realistic sequence

The days are illustrative. The only fixed timeframe here comes from the ATO: 28 days from nomination to add an entity client. Most delay sits in the middle rows, which wait on the client and the outgoing accountant.

Worked example: the Nguyen family group

Minh and Lan Nguyen run a café through a company and hold investments through a discretionary trust and an SMSF. They are moving from another firm and want returns for all five entities and quarterly BAS for the company. The details are fictional.

Day 0. A 30-minute call covers the group, outstanding years, the outgoing accountant and any ATO matters. ABN Lookup on the three entities shows the company is registered for GST and the trust is not, which matches what Minh said. The firm confirms it has the skills to act for an SMSF and notes that the fund's audit will stay with an independent auditor.

Day 1. One engagement letter goes out naming all five entities, the services and fee for each, the responsibilities of each party and a collection notice. It includes written permission to contact the outgoing accountant. Minh signs for himself, the company and the trustee company. Lan signs for herself. Both sign as trustees of the SMSF if they are individual trustees, or as directors if there is a corporate trustee.

Day 2. Minh and Lan each verify identity on a video call, showing their passports. The record notes the date and time, who checked, which documents, and that they were sighted by video. No copies are kept. The ASIC extracts for both companies are run and saved, confirming Minh as a director.

AML/CTF. The work is tax returns and BAS, with no change of control, financing, restructure or registered office. On the AUSTRAC list, none of these engagements is a designated service. The firm records that assessment. If the family later asks the firm to set up a new company or act as their registered office, that piece of work would need CDD first.

Day 3. The clearance request goes to the outgoing firm with the client's permission attached, asking for anything the firm should know, prior returns and workpapers, the trust's distribution minutes, Division 7A loan balances and the SMSF's member balances.

Day 3 to 10. The company, trust and SMSF each nominate the firm in Online services for business. Minh sends the confirmation PDFs. The firm checks the nominations report and adds each entity within 28 days. TFNs for Minh and Lan are given by phone and entered straight into the tax software, not written in email or notes. The corporate key for the café company arrives the same way.

Day 10. Jobs are created for five income tax returns, four quarterly BAS for the company and the SMSF annual return. The first task on the trust is to reconcile last year's distributions with the minutes the outgoing firm sent.

Five entities, two people to verify in person, three entity existence checks, one engagement letter, three ATO nominations and one ASIC authority. Laid out this way, it is a list of known steps rather than weeks of follow-up emails.

What to ask the client for

Keep the first request short and in one place. Our new client checklist lists everything, and the client request message templates give friendly wording for email and SMS.

• Full legal names, dates of birth and residential addresses for each individual
• A time for a short video or in-person identity check, with the ID they will show
• Trust deeds, company constitutions and SMSF deeds, with any amendments
• Written permission to contact the outgoing accountant
• Signed engagement letter
• ATO nomination for each ABN entity, and the confirmation PDF
• TFNs, by phone or a secure channel
• Corporate keys or a signed Form 362 for companies
• Access to accounting software and bank feeds, where in scope

How Nagaris handles these steps

Nagaris is a practice platform for Australian accounting firms. Here is what it does for onboarding, and what stays with you.

• One engagement for the family group. Trusts, companies, SMSFs and individuals go on one proposal, priced together or entity by entity, and clients sign once for the group.
• ABR prefill. Type the ABN and the entity details fill in from the ABR.
• Client self-service. You fill in what you know and clients complete the rest through a guided portal: adding their TFN, uploading documents, connecting their accounting software and linking their ATO portal, with step-by-step wizards.
• Identity and AML. Clients verify identity through their bank with ConnectID or with photo ID and a selfie. PEP and sanctions screening is included. Company checks include ASIC extracts, directors and beneficial owners. You review and confirm the risk rating, and the next review date is set.
• Ethical clearance letters are included in every plan.
• E-signing with a texted code option and an audit certificate.
• When the client accepts, jobs, budgets and tasks are created from the proposal, in XPM or straight from the engagement.
• Audit trail. Every action is timestamped, and client data is stored in Australia on AWS Sydney.

Nagaris does not replace your judgement on client acceptance, your AML/CTF program or your own reading of the standards. It is a compliance technology platform and does not provide legal advice. See client onboarding software for more.