1. Identify the client
Collect full name, date of birth and address for an individual; name, ABN or ACN and registered address for a company; name, trustees and beneficiaries for a trust.
2. Verify with reliable, independent documents
For an individual: a driver licence, passport or similar photo ID, sighted in person or through certified copies or an electronic verification service. For a company: an ASIC extract. For a trust: the trust deed. Record which document you saw, its number, who verified it and the date.
3. Identify beneficial owners
For companies, trusts and partnerships, identify and verify the individuals who ultimately own or control the entity, typically anyone with 25% or more, and those who control it in practice.
4. Understand the purpose
Write one or two sentences about why the client needs the service and where the money comes from. This is what you compare later transactions against.
5. Rate the risk
Low, medium or high, based on client type, jurisdiction, value, delivery channel and red flags such as politically exposed persons, cash, third parties instructing, or an unclear source of funds. High-risk clients get enhanced due diligence: source of funds and wealth, senior approval and more frequent review.
6. Record and schedule
Keep everything for 7 years. Set the next review date by risk: high 6 months, medium 12, low 24 is a common schedule.
Questions people ask
- Do I need to re-verify existing clients from before 1 July 2026?
- Pre-commencement clients do not need to be verified from scratch immediately, but you must apply due diligence when you next provide a designated service or when a risk trigger arises. Many firms verify them on the next matter.
- Can I start work while waiting for ID?
- Not the designated service. You must not provide it until identification is complete.
This guide is general information for accountants, bookkeepers, BAS agents, not legal advice. Check AUSTRAC's current guidance for your situation.