AML Compliance Guide
Log in Create Free Account

Customer due diligence for Bookkeeperss — 2026 AUSTRAC Guide

Customer due diligence means checking and verifying who your client is before you provide a designated service. For bookkeepers, this matters when your work falls within the AML/CTF regime from 1 July 2026, because you may be handling services that can be misused to move, disguise or legitimise criminal money. If you provide a designated service without completing CDD, you expose your practice to AUSTRAC enforcement, civil penalties of up to $33.5 million per contravention, and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

For a bookkeeper, CDD is not a box-ticking ID check done after the work has started. You must verify every customer before providing the designated service. That means confirming the client’s identity from reliable information and understanding who is really behind the business you are dealing with. If your client is an individual, verify their full name, date of birth and residential address against government-issued ID. If your client is a company, verify its name, ABN or ACN and company type through ASIC. If your client is a trust, collect trustee details, the trust deed and identify the beneficial owners. A beneficial owner is the natural person who owns 25% or more, or who effectively controls the entity.

What a small bookkeeping practice should do in order

  • First, decide whether the service you are about to provide is actually a designated service. Bookkeeping work is not automatically captured just because you are a bookkeeper.
  • Before you start the designated service, collect the client’s core identity information and supporting documents.
  • For companies and trusts, go past the trading name and identify the people who ultimately own or control the client.
  • Check whether the client or any beneficial owner is a politically exposed person or presents a higher-risk profile that needs enhanced due diligence.
  • Keep a clear record of what you checked, what documents you relied on, when you verified them and who in your practice approved onboarding.

Do not rely on your existing client file

Many bookkeepers already hold ABNs, director names and contact details for BAS, payroll or accounts work. That does not automatically satisfy AML/CTF customer due diligence. The information must be verified, and it must be done before the designated service starts. AUSTRAC has said it does not want duplicate processes, so use information you already collect where you can — but make sure it is complete, current and actually verified.

The biggest mistake for bookkeepers is assuming ordinary back-office work never triggers CDD. Tax return preparation alone is generally not a designated service for accountants, and not every service a professional practice offers is designated. But once your work involves a designated service, CDD becomes mandatory before you proceed. Another common error is verifying only the office manager or finance contact you deal with day to day, while never identifying the directors, trustees or true owners. That leaves a gap criminals can use by hiding behind shelf companies, family trusts or nominee arrangements.

Practical ways to make CDD workable in a bookkeeping practice

  • Build a client intake form that asks for entity type, ABN or ACN, directors, trustees and beneficial owners from the start.
  • Set up a rule that no engagement letter for a designated service is issued until identity checks are complete.
  • Use separate checklists for sole traders, companies and trusts so staff do not miss different verification steps.
  • If a structure is unusual, layered or offshore, pause onboarding and apply enhanced due diligence before accepting instructions.
  • Train staff who open client files or collect documents so they know the difference between collecting information and verifying it.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I have to do CDD for every bookkeeping client I already act for?
You must do CDD before providing a designated service. If an existing client starts using you for a service that is designated from 1 July 2026, you need to complete the required checks before that service begins. If the work you do for them is not a designated service, CDD is not triggered just because they are on your books.
Can I rely on a driver licence and a utility bill for an individual client?
You need to verify the person’s name, date of birth and address against government-issued ID. A driver licence will often cover key identity details, but you still need enough reliable information to verify all required elements. Your process should be consistent and documented so you can show what you checked and why it was sufficient.
What if my client is a family trust and nobody seems to own 25%?
Trusts often require more work than companies because ownership and control are not always obvious. You need trustee details, the trust deed and the natural persons who ultimately own or control the trust, including anyone exercising effective control even if there is no fixed 25% ownership interest. If the structure is hard to untangle, treat it as higher risk and apply enhanced due diligence.
Do I need to pay for an electronic ID service or ASIC search every time?
The law requires verification, not a particular software product. Many small practices will still choose paid tools because they are faster and create a better audit trail, especially for companies and trusts. What matters is that your method is reliable, documented and suited to the client type you are onboarding.
What should I do if a client refuses to give beneficial owner information?
Do not start the designated service. If you cannot identify and verify the customer properly, your CDD is incomplete and you should not proceed. Depending on the circumstances, the refusal or evasiveness may also give you reasonable grounds to suspect something is wrong, which can raise suspicious matter reporting issues.

Related guides