CDD Doesn't Mean You're a Cop — What AUSTRAC Actually Expects
AUSTRAC's CEO said it plainly: "We don't expect you to be police officers." Here's what Customer Due Diligence really looks like for most practices.
Customer Due Diligence (CDD) is probably the obligation that worries practitioners most. It sounds like you're being asked to investigate your own clients. You're not. AUSTRAC's CEO said it directly: "We don't expect you to be police officers or investigators."
AUSTRAC has been regulating banks for 20 years. "We don't require them to stop transactions to comply with their obligations." The same applies to you. CDD is about knowing who you're dealing with — not stopping the work.
What CDD actually involves
At its core, CDD means establishing three things about your client:
It's risk-based — not one-size-fits-all
The level of CDD you do depends on the risk the client poses. AUSTRAC's CEO made a key point: most of your clients will be low risk. For these clients, you apply what's called "simplified due diligence" — lighter checks that are proportionate to the risk.
| Risk Level | What You Do | Example |
|---|---|---|
| Low | Simplified CDD — basic identity checks | Gather basic info, check driver's licence, quick sanctions search |
| Medium | Standard CDD — verify and understand the relationship | Full identity verification, understand the purpose of the transaction |
| High | Enhanced CDD — deeper investigation | Source of wealth, source of funds, senior management approval |
What you DON'T need to do
Red flags — when to pay closer attention
You're not expected to be a detective. But AUSTRAC wants you to recognise when something doesn't feel right. These are the common red flags:
The overseas money question
A practitioner at the panel event asked: "How do I check that money from Thailand to buy real estate is clean?" Juliana Warner from the Law Council responded with a practical example: a conveyancer who received funds said to come from a UK estate settlement felt uncomfortable, so she contacted the UK solicitors to verify. That's a reasonable step.
The approach: Make reasonable inquiries about the source of funds. Ask the client where the money comes from. Verify where you can. You're entitled to take explanations at face value — you don't have to assume they're crooks just because the money comes from overseas. But if you've made inquiries and still can't satisfy yourself, that's when you file a suspicious matter report.
Remember: The vast majority of your clients are legitimate. CDD is a proportionate, risk-based process — not an interrogation. For most clients, it will be a simple, quick process that formalises checks you may already be doing informally.
This article draws on public statements by AUSTRAC's CEO Brendan Thomas and industry experts across multiple events. Key sources:
Disclaimer: This article is published by GetPost Labs Pty Ltd, a technology company building compliance software. All content is for educational purposes only and does not constitute legal, financial, or compliance advice. While we make every effort to ensure accuracy, this article may contain errors or omissions. Always refer to the authoritative text on legislation.gov.au and seek professional advice for your specific circumstances. If you spot an error or have a suggestion, please reach out to sumit@getpostlabs.io.