Initial Customer Due Diligence requirements

The key requirements of Chapter four of the current AML/CTF Rules are: 

• Customer identification: Reporting entities must collect and verify customer identification information. This includes obtaining full name, date of birth, and residential address for individuals, as well as relevant details for non-individual entities such as companies or trusts.
• Beneficial ownership: Reporting entities must identify and verify the beneficial owners of customers. A beneficial owner is any individual who owns or controls 25 per cent or more of the customer.
• Politically Exposed Persons (PEPs): Reporting entities must determine if a customer or beneficial owner is a PEP, which includes individuals with prominent public functions, their family members, and close associates.
• Purpose and nature of business relationship: Reporting entities must gather information on the purpose and intended nature of the business relationship with the customer. 

To achieve compliance with ACIP and effectively mitigate the risks associated with money laundering and terrorism financing, reporting entities are required to undertake the following steps: 

• Document procedures: The AML/CTF program's Part B should include detailed customer identification and verification procedures.
• Risk-based approach: Implement risk-based systems and controls to effectively manage ML/TF risks.
• Timely verification: Ensure customer identification is completed before providing any designated services, with some exceptions allowing for post-commencement verification under specific conditions.
• Record keeping: Maintain accurate records of all identification and verification processes for at least seven years. 

Australia's AML reforms are transitioning the initial Customer Due Diligence (CDD) requirements from the AML/CTF Rules to the AML/CTF Act. This shift aims to establish an outcomes-based framework, enhancing clarity and effectiveness in compliance. The changes result in an approach that is focused on the following: 

• Outcomes-based framework: The reforms emphasise an outcomes-based approach, focusing on the effectiveness of CDD measures rather than mere compliance.
• Clarification of initial CDD: The core requirements for initial CDD are now clearly defined and codified, ensuring that reporting entities understand their obligations to identify and verify customer identities before providing designated services.
• Revised/new terminology: There have been repeals, amendments and additions to the terminology used in relation to customer due diligence. The most significant is the replacement of “applicable customer identification procedures” or “ACIP” with “collection and verification of KYC information”. 
• Identification of ML/TF risk: Before providing designated services, ML and TF risks, including PEPs and sanctions exposure identities.
• Risk rating customers: All customers must be ML/TF risk-rated before a designated service is provided. This involves assessing the ML/TF risks based on available information and using the risk rating to determine the appropriate level of due diligence for the customer.
• Streamlined simplified CDD: For low-risk situations, the circumstances under which simplified CDD can be applied are streamlined, giving more discretion and making it easier for entities to comply without compromising security.
• Enhanced CDD for higher-risk situations: The reforms specify when enhanced CDD must be applied, particularly in higher-risk scenarios, to manage better and mitigate risks associated with ML and TF. 
• Allowance for delayed initial CDD: In certain circumstances a reporting entity may be able to delay verification (not collection) of the identity on someone acting on behalf of the customer and provide the designated service(s). There are different conditions depending on whether the designated service is being provided through a permanent establishment in Australia or in a foreign country.  

To prepare for the changes to CDD under the AML reforms, reporting entities should follow these steps: 

• Understand new requirements and terminology: Familiarise yourself with the new initial CDD obligations, new/revised terminology, and the outcomes-based framework introduced by the AML/CTF Act, together with additional requirements provided by the amended AML/CTF Rules once they are published. 
• Review current procedures: Assess existing CDD processes and identify areas that need updating to align with the new AML/CTF Act and Rule requirements, noting that these procedures will now form part of your AML/CTF program. This should include incorporation of any new or revised terminology into the procedures.
• Update AML/CTF program: Revise your AML/CTF program to incorporate the new initial CDD requirements, ensuring it incorporates risk identification and assessment, reflects the risk-based approach, and applies simplified due diligence for low-risk customers and enhances due diligence for higher-risk customers.
• Implement risk-based systems: Develop and implement risk-based systems and controls to effectively identify, assess, and mitigate ML/TF risks.
• Train staff: Provide comprehensive training on the new CDD requirements, the updated AML/CTF program and relevant procedures.
• Automate screening processes: Due to the time-sensitivity of undertaking screening, consider how you can automate the screening of customers against PEP and sanctions lists to ensure compliance with the new AML/CTF Act.
• Stay informed: monitor for additional AML/CTF Rule requirements, feedback and guidance AUSTRAC provides. 

Following these steps, reporting entities can effectively prepare for the changes and ensure compliance with the new CDD requirements.