A practical KYC and customer due diligence workflow for accountants preparing for AML/CTF Tranche 2

Last reviewed: 16 October 2026. General information only, not legal or tax advice. Check the current AUSTRAC guidance and your own obligations before relying on any step below.

If your practice is preparing for the AML/CTF Tranche 2 reforms, the hard part is rarely understanding the idea. It is turning "know your customer" into something your team does the same way for every client, with a record you can show later. This article walks through one workable order of operations: program, enrolment, risk assessment, identity verification, screening, sign-off and ongoing review.

It is a workflow, not a legal interpretation. Where the law sets the rule, go to AUSTRAC and the legislation itself; where this article describes software, it describes Fedix Practice Manager and what its public feature page says.

Start with the program, not the client

Before you onboard or re-assess a single client, the practice needs a written AML/CTF program and a named person responsible for it. Treat that as the foundation the client-level steps hang from.

Fedix Practice Manager can generate your practice's AML/CTF program, keep versions, let you activate one and designate the compliance officer. [ev:feature:crm-aml-ctf-program] Version history matters more than it sounds: when the program changes, you want to show which version applied when a client was assessed.

Prepare your AUSTRAC enrolment

Enrolment is a practice-level task that is easy to leave until the last minute because it needs facts from several places: entity details, people, service lines.

The practice manager can generate an information pack from your practice data to help you prepare your AUSTRAC enrolment. [ev:feature:crm-austrac-enrolment-pack] It is a preparation aid. You still review it and complete the enrolment yourself.

Assess risk for each client

Customer due diligence starts with a judgement about risk, and that judgement is yours. A useful record has three parts: what you knew, what you concluded and who signed it off.

In Fedix you record a risk assessment for each client, with an AI-drafted analysis you can override. [ev:feature:crm-kyc-assessments] Sign-off options include prohibit or needs more information, so "we cannot proceed yet" is a first-class outcome rather than a note in the margin. [ev:feature:crm-kyc-assessments]

Practical tips for the assessment itself:

• Write the reason for the rating in a sentence a reviewer could follow without opening the file.
• Record what is missing, not just what is present.
• Where the AI draft and your view differ, keep your view and say why.

Verify identity without chasing documents by email

Identity verification is where practices lose the most time, because it depends on the client doing something.

Two parts of the product address this. Identity verification sessions can be run online, with the extracted details reviewed by you, and the verified result and a PDF report written to the client record. [ev:feature:crm-identity-verification] And you can send clients a link so they complete their verification steps themselves, including from a phone. [ev:feature:crm-kyc-step-links]

The review step is the important one. Extraction is a convenience; the accountant confirms the details before the result is recorded.

Screen clients and related people

Screening asks whether a client, or someone connected to them such as a director or beneficial owner, appears on a sanctions list or carries elevated risk indicators.

The practice manager screens clients and related people against the DFAT Consolidated Sanctions List, with AI-assisted political-exposure and adverse-media indicators to prompt your review. [ev:feature:crm-kyc-screening] The word to hold on to is "prompt". An indicator is a reason to look closer, not a finding. A person decides what it means, and writes that down.

Make due diligence ongoing

A risk assessment is a snapshot. Clients change structure, move overseas, take on new activities. Ongoing customer due diligence means revisiting assessments on a cycle and when something changes.

You can trigger customer due diligence reviews, see their history, and let a daily check bring clients due for review back into the queue. [ev:feature:crm-kyc-cdd-review] The daily check is the part that removes reliance on memory.

Keep one view of where you stand

Partners will ask the same questions repeatedly: who is overdue, what is incomplete, what is about to expire.

The KYC and AML dashboard gives one dashboard of customer assessments, showing what is expiring, what is incomplete and where the practice stands overall. [ev:feature:crm-kyc-dashboard] Review it on a fixed rhythm, for example at the start of each week, and treat anything incomplete as work to assign, not as background noise.

Getting the existing client book in

If your client list lives in a spreadsheet or a legacy system, the first obstacle is getting it into one place. You can bring a legacy client book in from CSV, and export the list of returns awaiting lodgement in a format LodgeiT can take in. [ev:feature:crm-client-csv-import-export]

Where return preparation fits

Compliance work competes with tax-season work for the same people. That is the practical reason to keep the two connected.

For return preparation, an AI assistant works through the client's documents and produces a first draft of the return preparation for an accountant to review. [ev:feature:crm-tax-return-agent-prepare] The accountant reviews it; the draft is the starting point, not the final position. If your practice uses FediPilot for desktop work, desktop AI actions are tied to an enrolled device, and sensitive actions need approval. [ev:feature:crm-mcp-fedix-desktop] You can also learn FediPilot on realistic work through free training cases you can enrol in, with case details and materials to download. [ev:feature:crm-fedipilot-training]

Common ways practices get stuck

Most breakdowns are about habits, not software. Watch for these patterns early.

Treating onboarding as the end. The assessment gets done once and never revisited. Build the review cycle at the same time as the first assessment, so the second one is already scheduled.

Leaving the reasoning out. A rating with no explanation is hard to defend later. A short, plain-English rationale beats a long template, because the next person to open the file can follow it.

Letting indicators pile up. Screening and adverse-media prompts need an owner. If nobody is named, they sit unread. Give each prompt a person and a place to record the outcome.

Mixing up preparation and decision. Software can draft, extract and flag. The accountant decides. Keep that line visible in your procedures so that anyone reading them understands who made which call.

Running it as a side project. Compliance work competes with busy-season work. Put recurring review time in the calendar, and assign it the same way you assign client deadlines.

A checklist you can adopt this week

• Name the compliance officer and activate a program version.
• Generate the enrolment information pack and review it.
• Pick a risk-assessment template and agree what "needs more information" means in your practice.
• Decide who reviews identity-verification results.
• Decide who owns each screening indicator and where the outcome is recorded.
• Put the dashboard on a weekly agenda.
• Agree how often assessments are revisited and what events trigger an earlier review.

None of this replaces reading the legislation or AUSTRAC's guidance. It makes sure that when you have done the reading, the practice can actually apply it consistently.

See it in the product

The feature page for KYC and AML on the Fedix site shows each of these steps: https://home.fedix.ai/features/kyc-aml

Last reviewed: 16 October 2026.