Customer due diligence (CDD) is the AML/CTF work used to establish and understand the customer, verify required information, assess relevant risk and apply the measures required by the Act, Rules and the reporting entity’s own AML/CTF program. People often search for this work as “AML/KYC checks”; the Australian legislation uses customer due diligence. It is owed to the customer of a designated service — whether a service is one is a section 6 question, answered elsewhere.
The four types
Initial CDD happens before the service; ongoing CDD runs for as long as the relationship does. Simplified and enhanced CDD are not separate stages — they are the amount of work the other two involve, set by the customer’s risk. Three are required; one is permitted.
Before the service
While the relationship runs
Before you provide the service
Read s 28, verbatim ↓
For as long as the relationship lasts
Read s 30, verbatim ↓
Only where risk is low
Read s 31, verbatim ↓
Whenever a trigger applies
Read s 32, verbatim ↓
Top row: the default. Bottom row: what the risk rating changes — simplified where your program allows it for assessed lower risk; enhanced whenever a s 32 trigger is present.
Which form
AUSTRAC publishes one initial-CDD guide per customer type, and each sector starter kit carries a matching form. Pick the row for your customer; the Rules set a different minimum for each.
| Customer | AUSTRAC guide | Starter-kit form | Minimum KYC |
|---|---|---|---|
| Individual | Initial CDD for individuals | Initial customer due diligence form — Individual or sole trader | AML/CTF Rules 2025, Part 6, Division 1 (individuals) |
| Sole trader | Initial CDD for sole traders | Initial customer due diligence form — Individual or sole trader | r 6-1(2) — quoted below |
| Body corporate, partnership or unincorporated association | Initial CDD for a body corporate, partnership or unincorporated association | Initial customer due diligence form — Body corporate, partnership or association | r 6-2(2) — quoted below |
| Trust | Initial CDD for a trust | Initial customer due diligence form — Trust | AML/CTF Rules 2025, Part 6, Division 1 (trusts) |
| Government body | Initial CDD for a government body | Initial customer due diligence form — Government body | AML/CTF Rules 2025, Part 6, Division 1 (government bodies) |
Guides: AUSTRAC, Initial customer due diligence guides by customer type. Forms: the AUSTRAC program starter kits. Which form you use is set by your own AML/CTF policies.
Where the form sits in the day-to-day — the service gate, onboarding, verification, the risk decision, the record — is on the starter-kit page; this page is what the form has to establish.
What the Act says
Customer due diligence is Part 2 of the AML/CTF Act. The Part opens with a summary written by the drafter, which is plainer than any paraphrase and is the authority. It is set out here word for word.
The following is a simplified outline of this Part:
- A reporting entity must undertake initial customer due diligence before providing a designated service to a customer. However, in special cases, initial customer due diligence may be carried out after the provision of the designated service.
- A reporting entity must undertake ongoing customer due diligence in relation to the provision by the reporting entity of designated services.
- Simplified customer due diligence may be undertaken in certain low risk circumstances as part of initial and ongoing customer due diligence.
- Enhanced customer due diligence must be undertaken in certain circumstances as part of initial and ongoing customer due diligence.
- Certain pre-commencement customers are subject to modified customer due diligence.
- Exemptions from initial customer due diligence, and ongoing customer due diligence, apply in certain circumstances.
The four obligations
Each is a separate section of the Act, quoted here from its operative subsection. The distinction a summary usually loses is the one that decides how a business behaves: simplified CDD is permitted, the other three are required.
A reporting entity must not commence to provide a designated service to a customer if the reporting entity has not established on reasonable grounds each of the matters in subsection (2) in relation to the customer.
s 28(1), verbatim
A reporting entity must monitor its customers in relation to the provision of its designated services to appropriately identify, assess, manage and mitigate the risks of money laundering, financing of terrorism and proliferation financing that the reporting entity may reasonably face in providing designated services.
s 30(1), verbatim
In complying with the obligation imposed on a reporting entity under subsection 28(1) or 30(1) in relation to a customer, the reporting entity may apply simplified customer due diligence measures if: (a) the ML/TF risk of the customer is low; and (b) section 32 does not apply to the customer; and (c) the reporting entity complies with the requirements specified in the AML/CTF Rules.
s 31, verbatim
In complying with the obligation imposed on a reporting entity under subsection 28(1) or 30(1) in relation to a customer, the reporting entity must apply enhanced customer due diligence measures appropriate to the ML/TF risk of the customer if one or more of the following apply to the customer
s 32, verbatim
Before you provide the service
The matters are as follows:
s 28(2), verbatim
Without limiting subsection (1), a reporting entity must do the following for the purposes of establishing on reasonable grounds the matters in subsection (2):
s 28(3), verbatim
When enhanced CDD is compulsory
Not a risk judgement you make — a list the Act sets. One trigger is enough.
s 32, verbatim · Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Part 2 — Compilation No. 62 (C2026C00274)
What the Rules add
The AML/CTF Rules 2025 are made by the AUSTRAC CEO under the Act and bind exactly as the Act does. For CDD they do two things: they say what your policies must set out, and they set a minimum of KYC information to collect for each kind of customer.
The AML/CTF policies of the reporting entity must set out the circumstances in which the reporting entity will, for the purposes of undertaking initial customer due diligence in accordance with section 28 of the Act: (a) collect kinds of KYC information relating to a customer; or (b) both collect and verify kinds of KYC information relating to a customer; including but not limited to the circumstances in which the reporting entity will collect, or collect and verify, information on the customer’s source of wealth and source of funds.
| Customer is sole traderr 6-1(2), verbatim | Customer is body corporate, partnership or unincorporated associationr 6-2(2), verbatim |
|---|---|
the reporting entity must collect at least the following KYC information:
| the reporting entity must collect at least the following KYC information:
|
Part 6 of the Rules also deals with trusts, government bodies, transferred customers and real estate transactions. These two cover most professional-services clients.
Sources
This content is general information only. It is not legal, financial or compliance advice. Organisations should check AUSTRAC guidance, legislation, their own AML/CTF Program and professional advice where needed. Published by GetPost Labs Pty Ltd, a technology company building compliance software. Last checked against AUSTRAC’s published guidance on 12 September 2026. If you spot an error, tell us at australia@getpostlabs.io.
Lex-AML helps organise customer due diligence and supports the audit trail behind it — so the information you collected, the rating you gave and the reason for it are captured as you go. Your organisation makes the decisions.