AML Compliance Guide
Log in Create Free Account

Customer due diligence for Lawyers — 2026 AUSTRAC Guide

From 1 July 2026, a law practice that provides a designated service must identify and verify the customer before acting. For lawyers, this is most likely to matter when the firm handles client money, property or other assets in connection with transactions, rather than when giving pure legal advice only. If you skip customer due diligence, you risk breaching the AML/CTF Act, exposing the practice to AUSTRAC action, civil penalties of up to $33.5 million per contravention, and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Customer due diligence means more than getting a copy of a driver licence for the file. Before your practice provides a designated service, you must verify who the client is and, where relevant, who ultimately owns or controls them. For an individual, verify name, date of birth and address against government-issued identification. For a company, verify the company name, ABN or ACN, company type and existence through ASIC. For a trust, obtain trustee details, review the trust deed and identify the beneficial owners. A beneficial owner is the natural person who holds 25% or more, or who exercises effective control.

How a law practice should handle CDD in practice

  • First, decide whether the matter involves a designated service. Do not assume every legal matter is covered. Pure legal advice is generally not a designated service for lawyers.
  • Before receiving trust money, moving funds, or dealing with assets in connection with the transaction, collect the client’s identifying information.
  • Verify the information using reliable documents and sources: government-issued ID for individuals, ASIC records for companies, and trust documents for trusts.
  • Identify any beneficial owners and anyone exercising effective control, especially where there are family companies, discretionary trusts or layered holding structures.
  • Check whether the client or beneficial owner is a politically exposed person or presents a higher-risk profile, then apply enhanced due diligence where needed.
  • Keep a clear record of what you checked, when you checked it and who in the firm approved onboarding.

Do CDD before you act

You must verify the customer before providing the designated service. In a legal practice, that means your file opening process, trust account process and transaction checklist need to stop the matter progressing until identity and ownership checks are complete.

The most common mistake for lawyers is treating CDD as a general client intake form rather than a legal gate before transaction work starts. Another is assuming the instructing person is the customer without checking whether they are acting for a company, trustee or nominee. Firms also get caught by not looking through structures used in property deals, corporate acquisitions, managed investment arrangements or trust account transactions. If the source of funds, transaction purpose or ownership structure does not make sense, that can trigger enhanced due diligence and may also raise grounds to suspect that an SMR is needed.

Practical tips for lawyers

  • Build CDD questions into your costs agreement and matter opening forms so the client knows early why you need the information.
  • Create separate checklists for individuals, companies, trustees and attorneys acting under a power of attorney.
  • For conveyancing, trust account work and corporate transaction matters, require CDD completion before money is received or contracts are exchanged.
  • Where a long-standing client asks you to act for a new entity, do fresh CDD on the new customer instead of relying on the old file.
  • Train reception, accounts and legal staff to spot when a matter changes from advice-only to a designated service.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need to do customer due diligence for every legal matter?
No. The trigger is whether your practice is providing a designated service under the AML/CTF Act, not whether you are a lawyer generally. Pure legal advice is generally not a designated service, but handling money or assets in connection with a transaction is where CDD will usually be required.
What if the client is an existing client I have known for years?
If you are now providing a designated service, you still need to make sure the customer has been properly identified and verified for that service. Do not rely on familiarity or old file notes alone. Check whether the client details, ownership, control or risk profile have changed since you last acted.
How far do I need to go when the client is a trust with a complicated structure?
You need trustee details, the trust deed and the beneficial owners, including anyone with 25% or more ownership or effective control. For discretionary or layered structures, that usually means looking beyond the immediate trustee company and understanding who actually controls the arrangement. If the structure is unusually complex, apply enhanced due diligence.
Can I pass the cost of identity checks on to the client?
Yes, many firms recover verification costs as a disbursement or as part of their matter pricing, provided that is properly disclosed in the engagement terms. The AML/CTF Act does not make AUSTRAC CDD free for the business. What matters legally is that the verification is completed before you provide the designated service.
What if a client refuses to provide beneficial owner information?
You should not proceed with the designated service until you have completed the required CDD. A refusal to provide ownership or control information is itself a serious risk indicator in legal transaction work. Depending on the circumstances, it may also give you reasonable grounds to suspect and require consideration of an SMR, without tipping off the client.

Related guides