Insight

Know Your Customer: From simplicity comes complexity

insight featured image
QUICK SUMMARY
  • The more prescriptive approach required by ACIP is changing to an outcomes-based Initial Customer Due Diligence regime with broader requirements.  
  • There are new requirements around customer identification and verification, the identification of associated persons, understanding the nature and purpose of customer relationships, performing customer risk assessments, the records you need to keep, and the data and technology you use to manage customer due diligence processes. 
  • The use of reliable data and technology is more crucial than ever to conducting effective customer due diligence. 
  • The circumstances in which simplified customer due diligence can be applied are expanding, however, the standards for collection and verification are also changing.  
Australia’s AML/CTF reforms represent a fundamental shift from a prescriptive, compliance-based regime to a flexible, outcomes-focused framework – prioritising the effective prevention of money laundering, terrorism financing and proliferation financing, rather than merely following prescriptive rules.

Customer due diligence is the bedrock of an effective AML/CTF compliance program and the AML reforms in Australia are substantially changing the requirements for current reporting entities from 31 March 2025.  

The AML Reforms include significant changes to the customer due diligence requirements, fundamentally moving from a more prescriptive ‘check box’ style approach to a risk-based outcomes approach that requires the collection of a wider range of information which must be tailored to the specific ML/TF risks faced.  

  • The new regime moves away from a checklist approach (prescriptive rules) to an outcomes-based framework. This means reporting entities must exercise judgement and tailor their customer due diligence (CDD) to the specific risks of each customer, rather than simply ticking boxes. 
  • There is still a “floor” of minimum requirements, but the expectation is for entities to go beyond this baseline, especially for higher-risk customers. 
  • The reforms eliminate the ability to apply a “assume low risk unless proven otherwise” mindset. Every customer must be proactively risk-rated at onboarding, and this rating must be documented.  
  • Ongoing monitoring is essential: risk profiles and risk ratings must be updated as new information or behaviours emerge, and due diligence must be enhanced accordingly.  
  • The obligation to identify and verify is extended beyond the customer, beneficial owners, and authorised representatives, to other person involved in the control and governance of the customer.  
  • The nature and purpose of the business relationship must be established and documented upfront, not just inferred from transactions over time.  
  • Effective compliance under the new regime is not feasible without leveraging digital identity providers and robust data sources. Manual processes are unlikely to scale or provide the required audit trail.  
  • Technology solutions must be chosen carefully: while outsourcing data collection is allowed, ultimate compliance responsibility remains with the reporting entity.  
  • The introduction of “deemed compliant” provisions replicate the current simplified due diligence and extend it to certain types of “regulated” businesses. 
  • For most low risk customers, the minimum standard is similar to the old “standard due diligence”.  
  • The “safe harbour” approach (e.g., 2+2 data points for verification) now applies only to low-risk customers. 
  • Detailed records must be kept not only of identification and verification steps, but also of risk assessments and the rationale for applying simplified or enhanced due diligence. This is critical for both internal governance and regulatory scrutiny.  
  • The move of CDD obligations into the Act (rather than just the Rules) means breaches can now trigger direct civil penalties and enforcement action. This raises the stakes for getting compliance right from the outset.  
  • Transitioning to an outcomes-based approach requires significant investment in staff training, process redesign, and technology. There is a risk of inconsistency and uncertainty in how risk assessments are applied across the business.  
  • Early and structured planning is essential, especially given the short implementation timeline. Both technical (systems/processes) and business adoption (change management) must be addressed.  
  • Start early: Don’t wait until the last minute—begin reviewing and updating your KYC frameworks now.  
  • Invest in technology: Choose scalable, auditable solutions that support both onboarding and ongoing monitoring.  
  • Document everything: Maintain clear records of decisions, risk ratings, and the rationale for due diligence choices.  
  • Train staff: Ensure all relevant personnel understand the shift to outcomes-based compliance and the importance of judgement in risk assessment.  
  • Engage with peers and advisors: Leverage industry forums and expert advice to benchmark approaches and avoid common pitfalls.  

We are here to help  

Whilst the new AML/CTF requirements won't be a requirement until 31 March 2026 for existing reporting entities and 1 July 2026 for new reporting entities, it is vital to start planning and preparing for compliance now. 

With a short lead time to compliance and limited AML/CTF experts across Australia, demand will only continue to increase as the compliance date approaches.   

Contact one of our AML/CTF experts if you would like to discuss any of the above. 

Learn more about how our Anti-Money Laundering reforms services can help you
Visit our Anti-Money Laundering reforms page
Learn more about how our Anti-Money Laundering reforms services can help you