The AML/CTF reforms extend anti-money laundering and counter-terrorism financing obligations to certain services provided by professions such as lawyers, accountants and conveyancers/real estate. Check with AUSTRAC whether and how they apply to your practice. For many practices that means treating ongoing customer due diligence as a routine part of the work, not a one-off step at onboarding. This guide explains the idea in general terms and how changes on a client entity's public record fit into it.
This is general information, not legal advice. Check your own obligations and read the guidance published by AUSTRAC at austrac.gov.au.
What ongoing customer due diligence means
In general terms, ongoing customer due diligence is the practice of keeping what you know about a customer current and noticing when their risk profile changes. Onboarding gives you a snapshot. Ongoing due diligence asks whether that snapshot is still true.
For a client that is a company, trust or business, the snapshot usually includes who controls it, where it is registered, what it is called and whether it is in good standing. Each of those details can change without anyone telling you.
The gap between onboarding and ongoing checks
Most practices are reasonably good at the first check. You collect identification, confirm the entity exists and record who is behind it. The weak point is the months and years afterwards.
Typical gaps look like this:
- The file shows directors from the day of onboarding, but the register now shows different officeholders.
- The engagement letter names a business name that has since lapsed or been replaced.
- The ABN was valid at onboarding, but its status has since changed.
- The registered office has moved, so formal notices may be going somewhere you do not expect.
None of these is proof of wrongdoing. They are changes, and a change in the facts you relied on is a reasonable prompt to look again.
Public record changes that work as review triggers
Several kinds of change on a client entity's public record are natural points to pause and review the file:
- Status changes. A company moving to a deregistration or external administration status, or an ABN being cancelled.
- Officeholder changes. Directors or secretaries appointed or removed, particularly where you were not told.
- Address changes. A change to the registered office or principal place of business.
- Business name changes. A new name, a lapse, or a change of holder. See business name monitoring.
- Insolvency notices. Notices lodged against a company, which can change how you assess the relationship.
Whether a given change should alter your risk assessment is a judgement for you and your compliance function. The point is that you find out about it, and quickly.
Building a repeatable routine
An ad hoc search when something feels off is not a routine. A routine has a defined frequency, a defined set of checks and a defined owner.
A workable structure:
- Decide which clients are in scope and group them by the level of risk you assign.
- Set a check frequency for each group. Higher-risk clients are reviewed more often.
- Define what you check each time: entity status, officeholders, address, business name and ABN status.
- Assign a named person who reviews results and decides what happens next.
- Record the outcome of every review, including when nothing changed.
Practices with many clients quickly find that manual lookups do not scale. Our guide on how to monitor company changes covers the options in more detail, and the ABN status guide explains what the different ABN statuses mean.
Keeping an evidence trail
If you ever need to show what you did and when, a dated, attributable record is far more useful than a recollection. Good records answer four questions: what was checked, when, by whom, and what was decided.
- Keep a dated record of each check, including the source and what it showed.
- Record who reviewed it and any action taken or deliberately not taken.
- Keep the history of changes, not only the current state, so you can see when something shifted.
- Store records with the client file so they are found when needed.
What a monitoring tool can and cannot do
A monitoring tool can watch the registers on a schedule, detect that something has changed, tell you quickly and keep a dated history of what it saw. That removes the manual effort and the risk of forgetting to look.
It cannot decide what a change means for your risk assessment, verify a person's identity, replace your own procedures or judgement, or make you compliant. Those remain your responsibility. A tool supports the routine; it is not the routine.
Quick checklist
- Client entities listed and grouped by risk level
- Check frequency set for each group
- Status, officeholders, address, business name and ABN covered
- Named reviewer for each alert
- Every review recorded with date and outcome
- Routine itself reviewed against current AUSTRAC guidance
How MonitorHQ helps
MonitorHQ watches ASIC, ABR and PPSR records for the entities you add and alerts you quickly when something changes, keeping a dated history of each change. One profile per entity brings ABN, ACN and business name monitoring together, and PPSR monitoring applies to ACN, ARBN and ARSN-registered entities. See how MonitorHQ works for accountants, or read about company monitoring.