AML Compliance Guide
Log in Create Free Account

Customer due diligence for Accountants — 2026 AUSTRAC Guide

Customer due diligence means checking who your client really is before you provide a designated service. For accountants, this only applies when the work you are doing is a designated service under the AML/CTF Act, not every accounting job. If you provide a designated service without completing CDD first, you risk AUSTRAC enforcement, civil penalties of up to $33.5 million per contravention, and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

For an accounting practice, CDD starts with one practical question: is this engagement a designated service? Tax return preparation alone is generally not a designated service. The obligation is more likely to arise where your firm is involved in higher-risk transactional or structuring work captured by the Act. If the engagement is a designated service, you must verify the identity of every client before you start providing that service. That includes identifying any beneficial owner and understanding who is really controlling the client entity.

What you need to do before starting the work

  • Confirm whether the engagement is a designated service under Schedule 1 of the AML/CTF Act.
  • Collect the client’s core identity information before work starts.
  • For an individual, verify name, date of birth and residential address against government-issued ID.
  • For a company, verify ABN or ACN, company name and company type using ASIC records.
  • For a trust, obtain trustee details, the trust deed and identify the beneficial owners.
  • Identify any person who owns 25% or more or who exercises effective control, even if ownership is layered through other entities.
  • Check whether the client or beneficial owner is a politically exposed person and apply enhanced due diligence if they are high risk.

In a small accounting practice, the most common CDD failure is treating the person giving instructions as the client and stopping there. If you are acting for a company, unit trust, family trust or SMSF-related structure, you need to look through the entity and identify the natural persons behind it. Another common mistake is relying on old onboarding material collected for tax, BAS or payroll work and assuming it is enough for AML/CTF. If that earlier engagement was not a designated service, you still need to make sure the identification you hold meets AML/CTF verification standards before you begin the designated service.

Accountant-specific trap

A long-standing client is not exempt from CDD. If you move from ordinary compliance work into a designated service, you must complete AML/CTF identity checks before starting that new work. Existing client knowledge helps, but it does not replace proper verification.

Build CDD into your engagement workflow so it happens early, not halfway through the file. Add a front-end screening step when a client asks for entity structuring, transaction support or other potentially captured work. Use a standard checklist for individuals, companies and trusts, and make one person responsible for reviewing incomplete ownership chains. Where the client is low risk, such as a government body or listed company, simplified due diligence may be available. Where the client is higher risk, such as a PEP, a client linked to a high-risk country, or someone presenting unusual source-of-funds explanations, enhanced due diligence is required and you should slow the matter down until you are satisfied.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need to do CDD for every tax return, BAS or bookkeeping client?
No. Tax return preparation alone is generally not a designated service for accountants, so CDD is not triggered just because you prepare returns, BASs or routine accounts. The trigger is whether you are providing a designated service under the AML/CTF Act.
Can I rely on the ID documents I collected years ago when the client first came to my firm?
Only if what you hold meets the AML/CTF verification standard for the designated service you are now providing and the information is still reliable. If the earlier file only contains partial client data gathered for normal accounting purposes, update it before you start. This is especially important where ownership, control or trustee arrangements may have changed.
What if my client is a family trust with a corporate trustee and several family members involved?
You need to identify the trustee details, obtain the trust deed and work out the natural persons who ultimately own or control the structure. That can include directors of the corporate trustee and any person holding 25% or more or exercising effective control. Do not stop at the company search if the real control sits with individuals behind the trustee.
Do I have to pay AUSTRAC to complete customer due diligence?
No AUSTRAC fee applies to carrying out CDD itself. Your cost is internal time and any third-party verification, ASIC search or screening tools you choose to use. For a small firm, the main cost usually comes from chasing ownership information on company and trust structures.
What should I do if the client refuses to provide beneficial ownership information?
Do not provide the designated service until you have completed CDD. If the client will not give you enough information to verify who owns or controls the entity, you should treat that as a serious risk issue and consider whether there are reasonable grounds to suspect something unusual. If suspicion forms, an SMR may be required, and you must not tip the client off.

Related guides