KYC, CDD and EDD in Australia

Written by Garry El-Hassan, Principal Consultant

Reviewed: 19 September 2026

Australian Regulatory Guidance

Educational notice: This information is educational and general in nature. It is not legal advice and does not determine whether your business is a reporting entity. Your obligations depend on your services, circumstances, ML/TF risk and the law in force. Check the current AUSTRAC guidance and legislation linked below, and obtain qualified advice where needed.

Knowing your customer (KYC) is the frontline defence against financial crime. In the Australian regime, KYC is formalised through Customer Due Diligence (CDD). CDD is not a one-time onboarding hurdle; it is an ongoing process of understanding your customer's profile, their financial behaviour, and the risk they present to your business.

Primary guidance: AUSTRAC customer due diligence, including its current ongoing CDD and enhanced CDD guidance.

What is customer due diligence?

Before providing a designated service, you must identify your customer and verify their identity using reliable and independent documentation or electronic data. This establishes a baseline understanding of who you are dealing with.

Collection: Gathering minimum KYC information (e.g., full name, date of birth, residential address for individuals).
Verification: Confirming the collected information is true and correct (e.g., sighting a driver's licence or utilising a document verification service).
Beneficial ownership: For non-individual customers, identify and verify the people who ultimately own or control the customer in accordance with the current Act, Rules and AUSTRAC guidance.

When is enhanced customer due diligence required?

When a customer or transaction presents a high risk of ML/TF, standard CDD is insufficient. You must apply Enhanced Customer Due Diligence (EDD) measures to obtain a deeper understanding of the relationship.

EDD is mandatory in specific scenarios, including:

When you determine the ML/TF risk is high.
When a customer or beneficial owner is identified as a foreign Politically Exposed Person (PEP).
When a suspicion of ML/TF arises.

Operationalising EDD typically involves gathering additional information, such as the source of funds or source of wealth, verifying that additional information, and requiring senior management approval to proceed with the relationship.

What does ongoing customer due diligence involve?

A customer's risk profile can change over time. Ongoing Customer Due Diligence (OCDD) ensures your understanding of the customer remains accurate and current throughout the lifecycle of the relationship.

Transaction Monitoring: Implementing systems to monitor transactions and identify behaviour that is unusual, complex, or lacking an apparent economic purpose.
KYC Refresh: Periodically updating and verifying customer identification information, particularly for higher-risk customers.
Risk Re-assessment: Adjusting the customer's risk rating based on their activity, prompting a transition from standard CDD to EDD where necessary.

How can a business make CDD work in practice?

Effective CDD requires clear workflows. Your staff must understand exactly what documents are acceptable, how to escalate a complex corporate structure, and when to trigger an EDD review. Vague procedures lead to inconsistent onboarding and regulatory exposure.