Customer Due Diligence (CDD) in Australia: An AUSTRAC Compliance Guide for Professional Services
CDD is the foundation of Australia's AML/CTF framework. From 1 July 2026, accountants, lawyers and real estate agents must conduct and document CDD for every client. This guide explains exactly what is required.
What is Customer Due Diligence (CDD)?
CDD — also called Know Your Customer (KYC) — is the process by which AUSTRAC reporting entities verify client identities and assess ML/TF risk. From 1 July 2026, accountants, lawyers, conveyancers and real estate agents must conduct CDD before any designated service. CDD is ongoing — it must be repeated when risk levels change or when new designated services are provided.
Three levels of CDD
**Standard CDD (most clients)**: Verify identity, beneficial ownership, and purpose of business relationship. **Simplified Due Diligence (SDD)**: Only when ML/TF risk is demonstrably low (e.g., listed companies, government entities). Must be documented — you cannot simply skip identity verification. **Enhanced Due Diligence (EDD)**: Mandatory for PEPs, high-risk jurisdictions, complex/anonymous ownership structures, and cases where Standard CDD cannot be completed. Requires more information, senior management approval, and closer ongoing monitoring.
Identity verification requirements
**Individual clients**: Full legal name, DOB, residential address — verified from a government-issued document (passport, driver's licence). **Companies**: Company name, ACN, registered office, director names, and all beneficial owners with 25%+ ownership. Verify the "controlling principal". **Trusts**: Trust name, trustee(s), settlor, beneficiaries, trust deed. Look through complex structures to all ultimate beneficial owners.
Politically Exposed Persons (PEPs)
PEPs are current or former holders of prominent public positions (ministers, senior judges, military officers, state-owned enterprise executives, senior political party officials) and their immediate family and known close associates. **EDD required for PEPs**: Obtain senior management approval; identify source of wealth and source of funds; conduct ongoing enhanced monitoring; document risk assessment. Being a PEP does not mean a person is engaged in financial crime — but higher-risk checks are mandatory.
When must CDD be repeated?
Repeat CDD when: - Beginning a new designated service for an existing client - There is a material change in the business relationship - You have doubts about previously collected information - A client's risk level changes (e.g., becomes a PEP) - You resume contact after a long gap For ongoing designated services, schedule reviews at least every 3 years for standard-risk clients, more frequently for higher risk.
Documenting and retaining CDD records
Retain for **7 years** from completion of designated service (or end of relationship, whichever is later): copies of identity documents, verification records, beneficial ownership assessments, source of funds documentation, PEP screening records, risk level decisions. AUSTRAC inspectors can request these records at any time. Incomplete CDD records are one of the most common findings in AUSTRAC audits. Complylty maintains timestamped, audit-ready records for every CDD check with automatic 7-year retention and expiry alerts.