Customer due diligence checklist for accounting firms

Before starting a designated service, the AML/CTF Act requires you to establish the customer's identity, beneficial owners, anyone acting for them, PEP and sanctions status, and the nature and purpose of the relationship. The Rules 2025 set the minimum KYC information for each customer type.

Reviewed 18 October 2026

General information only, not legal or tax advice. Check the current rules against the source before relying on this. Current as at 18 October 2026. Rule numbers refer to the AML/CTF Rules 2025 as compiled at 31 March 2026 (Compilation No. 1, which includes the 2026 Amendment Rules); check legislation.gov.au for any later compilation.

These checklists set out the minimum KYC information the AML/CTF Rules 2025 require you to collect for each customer type, and what AUSTRAC suggests you verify. Use them before you start any designated service. Collection and verification scale with risk, so for higher risk customers you will collect and verify more. Adapt them to your firm's AML/CTF policies, which take priority.

How to use these checklists

Confirm the engagement includes a designated service under table 6 of the Act. If it does not, these CDD obligations do not arise from that work.
Identify the customer and every associated person: anyone acting on the customer's behalf, anyone on whose behalf the customer receives the service, and beneficial owners.
Complete the checklist for each customer type involved. A family trust with a corporate trustee needs the trust list, the company list, and the individual list for each director, beneficial owner and appointor.
Rate the customer's ML/TF risk and record it.
Apply enhanced CDD if any section 32 trigger applies.

Matters to establish for every customer

Section 28(2) of the Act. Before starting a designated service, establish on reasonable grounds:

The identity of the customer
The identity of any person on whose behalf the customer is receiving the service
The identity of any person acting on behalf of the customer, and their authority to act
If the customer is not an individual, the identity of any beneficial owners (25% or more ownership, or control, directly or indirectly: Act s 5)
Whether any of those persons is a politically exposed person or designated for targeted financial sanctions
The nature and purpose of the business relationship or occasional transaction
The customer's ML/TF risk, based on KYC information reasonably available (Act s 28(3)(b))

Individuals

Source: AUSTRAC, Initial CDD for individuals; Act ss 28(2), 28(3).

Collect

Full name
Any other names commonly known by
Date of birth
Residential address
A unique identifier, such as passport or driver's licence number
Reason for seeking the service and the nature of the service (nature and purpose)
Occupation (optional, per AUSTRAC)
Whether the person is a PEP (foreign, domestic or international organisation) and, if so, their role

Verify

Full name and date of birth from government-issued photo ID (driver's licence, passport, proof of age card or foreign national identity card), or primary non-photo ID plus a secondary document showing name and address
Take reasonable steps to confirm the person is who they claim to be, such as matching their appearance to photo ID in person, by video or with biometric technology (Act s 28(3)(a))
PEP status through reliable sources or screening
Targeted financial sanctions against the DFAT Consolidated List
Nature and purpose, only if enhanced CDD applies or you doubt the information

Sole traders

Source: Rules 6-1. Complete the individual checklist, plus collect:

Any business name used
A unique identifier for the business (such as an ABN) or, if none, for the customer
Address of the principal place of business
The nature of the customer's business

Companies

Source: Rules 6-2, 6-7, 6-8.

Collect

Verify

Identity details using reliable and independent data appropriate to the risk (Act s 28(3)(d)), such as an ASIC company extract
Each beneficial owner as you would an individual
PEP and sanctions status of each beneficial owner and person acting for the company
Listed public company subject to disclosure requirements: beneficial owners and their PEP and sanctions status are taken as established (Rules 6-7). Since the 2026 amendments, Rule 6-7 also covers customers that are government bodies or are controlled by a listed public company or government body
No beneficial owner identifiable after all reasonable steps: record the steps and difficulties, then collect and verify the chief executive officer's (or equivalent) identity (Rules 6-8)

Partnerships

Source: Rules 6-2, 6-8. Partnerships use the same minimum KYC information as companies.

Trusts

Source: Rules 6-3; AUSTRAC, Initial CDD for trust.

Collect

Verify

The trust deed and amendments, such as deeds of variation
Unique identifiers against the relevant database
Trustee authority, typically from the trust deed and instrument of appointment
Beneficial owners as individuals; cross-check against documents such as trustee resolutions
Beneficiary class descriptions against the deed or evidence of distributions
PEP and sanctions status of beneficial owners, trustees and persons acting for the trust

SMSFs

An SMSF is a trust, so the trust checklist (Rules 6-3) applies. AUSTRAC's guidance gives drafting and facilitating execution of an SMSF trust deed as an example of an item 6 designated service. Neither the Rules nor AUSTRAC's trust guide set separate SMSF-specific KYC items, so the points below apply the trust rules to a typical fund.

Fund name, kind of trust (superannuation fund) and ABN, if issued
Trust deed and any amendments
Trustee: individual trustees (individual checklist) or corporate trustee (company checklist, including directors and director identification numbers)
Members, as the beneficiaries of the fund
Control structure: who controls the trustee
Purpose of the fund
PEP and sanctions screening on members, directors and anyone acting for the fund
For a new fund you are establishing, the customer for the company formation is the proposed beneficial owners and directors (AUSTRAC, Professional designated services)

People acting for the customer

Source: Act s 28(2)(c); Rules 6-5, 6-19.

Identity of each person acting on the customer's behalf (if not an individual, the same information as for that type of customer)
Evidence of their authority to act
Simplified route for non-individual customers: authority established, additional risk low, KYC appropriate to risk, no reason to doubt it (Rules 6-19)

Enhanced CDD triggers

Source: Act s 32; Rules 6-20, 6-21, 6-23. Apply enhanced measures if any of these is ticked:

Customer's ML/TF risk is high
A suspicious matter reporting obligation has arisen and you propose to keep acting
Customer, beneficial owner, person on whose behalf they act, or person acting for them is a foreign PEP
Any of those persons is in, or the entity was formed in, a FATF high risk jurisdiction subject to a call for enhanced due diligence
The service is part of a nested services relationship
The customer asks for services with no apparent economic or legal purpose, or that involve unusually complex or large transactions or an unusual pattern of transactions (Rules 6-20)
Source of wealth and source of funds collected where relevant to the risk
Source of wealth and funds of the PEP collected for foreign PEPs, and domestic or international organisation PEPs where risk is high
Senior manager approval obtained for PEPs where required (AUSTRAC senior managers quick guide)

Ongoing CDD

Source: Act s 30; Rules 6-24; AUSTRAC ongoing CDD guidance.

Review date set at a frequency appropriate to the customer's risk
Re-review if you doubt the adequacy or truth of KYC information
Re-review if a customer or beneficial owner becomes a foreign PEP, or a domestic or international organisation PEP where risk is high
Re-review on significant change to customer type, services, delivery channel or countries
Monitor for unusual transactions and behaviour that may require an SMR

Where Nagaris fits

In Nagaris the client completes their details, AML questions and declaration on one form on their phone, and verifies ID through their bank (ConnectID) or photo ID and a selfie. Your team reviews the ID result, PEP, sanctions and adverse media screening and company checks on one screen, and confirms the risk rating. Company checks include ASIC extracts, directors and beneficial owners. The firm stays responsible for its CDD decisions and its AML/CTF program. See AML/CTF software.

Questions

What KYC information must I collect for a trust?

Rule 6-3 of the AML/CTF Rules 2025 requires the trust's name, kind of trust, identifiers, place of business, evidence of existence, governing powers, trustees, beneficiaries or classes, control structure, and any settlor, appointor, guardian or protector.

What if I cannot identify a company's beneficial owners?

Under Rule 6-8, if you take all reasonable steps and cannot identify any, record the steps and difficulties and identify and verify the chief executive officer or equivalent.

When is enhanced CDD required?

Under section 32 of the Act, including where the customer's risk is high, a foreign PEP is involved, an SMR obligation has arisen and you keep acting, or a FATF high risk jurisdiction is involved.

Sources

Run this inside Nagaris

Proposals, AML checks, e-signing, client queries and jobs on one client file.

Schedule a demo

Customer due diligence checklist for accounting firms

How to use these checklists

Matters to establish for every customer

Individuals

Collect

Verify

Sole traders

Companies

Collect

Verify

Partnerships

Trusts

Collect

Verify

SMSFs

People acting for the customer

Enhanced CDD triggers

Ongoing CDD

Where Nagaris fits

Questions

What KYC information must I collect for a trust?

What if I cannot identify a company's beneficial owners?

When is enhanced CDD required?

Sources

Related

Run this inside Nagaris