AML Compliance Guide
Log in Create Free Account

Customer due diligence for Trust and company service providerss — 2026 AUSTRAC Guide

Customer due diligence means identifying your client and checking who really owns or controls the person, company or trust before you provide a designated trust or company service. This matters for trust and company service providers because your work can be used to hide ownership, set up opaque structures or move control of assets through companies and trusts. If you get this wrong, you can breach the AML/CTF Act, face AUSTRAC enforcement, civil penalties of up to $33.5 million per contravention, and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

For a trust and company service provider, customer due diligence is more than collecting a driver licence and filing it away. You must verify the identity of every customer before providing a designated service, and for entity clients you must work through the structure until you find the natural people behind it. That usually means checking the individual instructing you, the company or trust receiving the service, and any beneficial owners or controllers. A beneficial owner is a person who holds 25% or more, or who exercises effective control even without a formal ownership percentage.

What you need to do before starting the service

  • Identify what the client is asking you to do and confirm it is a designated service, such as forming a company, acting as a director or nominee, providing a registered office or business address, or arranging a trust or company structure.
  • Collect and verify the customer's identity before you provide the service. For an individual, verify name, date of birth and residential address against government-issued ID.
  • If the client is a company, verify the company name, ACN or ABN and company type through ASIC, then identify and verify the beneficial owners and the person giving instructions to you.
  • If the client is a trust, obtain trustee details, review the trust deed, identify the settlor where relevant, and verify the beneficial owners and controllers connected with the trust.
  • Check whether the client or any beneficial owner is a politically exposed person or otherwise high risk, and apply enhanced due diligence where needed.
  • Screen the customer against the DFAT autonomous sanctions list and the UN Security Council consolidated list before and during the relationship.

Do not rely on the structure alone

A company search or trust deed by itself is not enough. If a shelf company is being bought, nominee shareholders are involved, a family trust sits behind a corporate trustee, or a foreign person is funding the setup, you must keep tracing ownership and control until you reach the real individuals. If you cannot verify who ultimately owns or controls the structure, do not provide the designated service.

Common mistakes for this sector are predictable. Many small providers assume the instructing accountant or lawyer is the customer, when the real customer is the company, trust or individual using your service. Others stop at the director search and do not test who controls the shares, voting rights or appointor powers. Another common error is treating low-touch services like registered office addresses or company secretarial arrangements as administrative only. If the service is designated, customer due diligence still applies before you start.

Build your onboarding around the way trust and company work actually happens. Use separate checklists for company formations, trustee company appointments, changes in officeholders, registered office services and trust establishment matters. Ask early for ASIC extracts, trust deeds, shareholder registers, partnership agreements and details of source of funds where the structure or instructions look unusual. If a client is using multiple entities, overseas controllers, bearer-style arrangements, nominee relationships or urgent last-minute instructions without a clear commercial reason, treat that as higher risk and escalate for enhanced due diligence.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I have to verify identity every time I form a new company for an existing client?
Not always from scratch, but you must have current and reliable customer due diligence for that client before providing the new designated service. If the ownership, controllers, trustees, directors or risk profile have changed, you need updated information and may need to re-verify it. New entities in an existing group often mean new beneficial owner checks.
What if my client is a family trust with a corporate trustee and several adult beneficiaries?
You need to verify the trustee details, review the trust deed, identify the people who ultimately own or control the corporate trustee, and identify who exercises effective control over the trust. Depending on the structure, that can include directors, major shareholders and anyone with appointor or removal powers. Do not assume the named beneficiaries are the only relevant people.
Can I rely on identification already collected by the client's accountant or lawyer?
You may be able to use information already collected in the matter, but you remain responsible for meeting your own customer due diligence obligation before providing the designated service. If the material is incomplete, out of date or does not clearly verify the individual or beneficial owner, you need more. A referral does not shift responsibility away from your business.
What if the beneficial owner is overseas and does not have standard Australian ID?
You still need to verify that person's identity using reliable and independent information. In practice, that may mean passport documents, foreign company registry records, certified documents and additional checks to confirm control and legitimacy. Overseas ownership generally increases risk, so enhanced due diligence is often appropriate.
How expensive does this process need to be for a small trust and company service provider?
The law does not require an expensive enterprise platform, but it does require an effective process. Many small providers can start with documented checklists, ASIC searches, sanctions screening, ID verification tools and a clear escalation path for complex structures. Your process must match the risk of the services you provide, especially where you create or administer entities that can conceal ownership.

Related guides