AML Compliance Guide
Log in Create Free Account

Customer due diligence for Virtual asset service providerss — 2026 AUSTRAC Guide

Customer due diligence means knowing who your customer is before you let them use your virtual asset service. It applies to virtual asset service providers because you are accepting instructions, exchanging virtual assets, providing safekeeping, or participating in offers or sales of virtual assets that are designated services under the AML/CTF Act. If you provide a designated service without completing customer due diligence when required, you risk AUSTRAC enforcement, civil penalties of up to $33.5 million per contravention, and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

From 1 July 2026, customer due diligence applies to virtual asset service providers that provide designated services with an Australian geographical link. In practice, that means you must collect and verify the customer's identity before you start providing the designated service. For an individual, verify their full name, date of birth and residential address against government-issued ID. For a company, verify its ABN or ACN, legal name and company type through ASIC. For a trust, identify the trustee, review the trust deed and identify the beneficial owners. A beneficial owner is the natural person who owns 25% or more, or who exercises effective control.

CDD starts before the service starts

You must complete necessary steps to know your customer before you start to provide them with a designated service. For most virtual asset service providers, this means before you activate trading, execute a transfer, open a hosted wallet or custody account, or let the customer participate in a token offer or sale you are involved in.

What a virtual asset service provider should do

  • Map exactly which of your services are designated services, such as exchange between virtual assets and money, exchange between virtual assets, safekeeping, transfers on behalf of customers, or financial services connected with a virtual asset offer or sale.
  • Build onboarding rules so no customer can trade, deposit into a hosted service, withdraw, transfer, or access custody until identity checks are completed.
  • Collect the right information for the customer type: individuals, companies, trusts and beneficial owners.
  • Screen every customer against the DFAT autonomous sanctions list and the UN Security Council consolidated list before onboarding and during the relationship.
  • Apply enhanced due diligence to higher-risk customers, including politically exposed persons, high-risk jurisdictions, complex ownership structures, mixers, or unusual source-of-funds patterns.
  • Keep the CDD records and verification evidence for 7 years after the relationship ends.

The biggest mistake for this sector is treating wallet addresses as if they are the customer. They are not. A blockchain address, device fingerprint or email address does not replace identity verification of the person or entity behind the service use. Another common error is onboarding first and planning to verify later. That does not meet the requirement. If you use app-based onboarding, outsourced KYC vendors or offshore operations, you still remain responsible for making sure the checks are done properly and that your records can be produced to AUSTRAC.

Set your process up around risk. Low-friction onboarding may be appropriate for lower-risk retail customers, but you need stronger checks where the risk is higher. For example, if a customer wants rapid movement of value in and out of Australia, uses privacy-enhancing tools, is linked to high-risk geographies, or is using a company or trust with layered ownership, step up your scrutiny. Ask for source-of-funds information, confirm control of the entity, and review whether the activity fits the customer's profile. Your CDD process should connect to your suspicious matter reporting workflow so staff know when identity issues, sanctions matches or unusual transfer patterns need escalation.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need to complete customer due diligence for every customer, even if they only want a small crypto transaction?
Yes, if you are providing a designated service, you must verify the identity of every customer before providing that service. The rule is not limited to large transactions. Transaction size may affect your risk rating, but it does not remove the need to complete initial customer due diligence.
Can I rely on a third-party KYC provider or onboarding platform?
You can use a service provider to help collect and verify customer information, but responsibility stays with your business. You need to make sure the provider's process actually verifies the required information and that you can access the underlying records. If the checks are weak or incomplete, AUSTRAC will look to you, not your vendor.
What if my customer is a company or trust set up overseas?
You still need to identify and verify the entity and its beneficial owners before providing the designated service. That usually means obtaining reliable corporate or trust documents, identifying who ultimately owns 25% or more or exercises effective control, and applying enhanced due diligence where the structure or jurisdiction increases risk. If you cannot get comfortable that you know who you are dealing with, do not provide the service.
Do I have to verify the owner of a self-hosted wallet as part of customer due diligence?
Customer due diligence is about identifying your customer, not simply the wallet address. If your customer is using a self-hosted wallet, you still need to verify the person or entity who is your customer before you provide the designated service. Separate transfer-of-value and virtual asset travel rule obligations may also apply to the transaction, depending on the service and timing.
Is there a government fee for customer due diligence checks?
There is no AUSTRAC fee just for conducting customer due diligence. Your costs will usually come from your own systems, identity verification tools, staff time, sanctions screening and any external KYC provider you use. Small virtual asset businesses should budget for onboarding controls early rather than trying to bolt them on after launch.

Related guides