AML/CTF Tranche 2 for accountants: a practical KYC and CDD workflow

# AML/CTF Tranche 2 for accountants: a practical KYC and CDD workflow **Short answer:** if your practice is brought into the AML/CTF regime, the day-to-day work comes down to a repeatable loop: assess the client's risk, verify who they are, screen them, record a decision, and review again when the risk or the calendar says so. This post walks through that loop and shows where software can carry the paperwork. It is general information, not legal advice. Check your own obligations against AUSTRAC's published guidance and your adviser. *Last reviewed: 2026-10-15.* ## What the regulator says about who is covered AUSTRAC's guidance for professional services is aimed at "lawyers, accountants, conveyancers, insolvency practitioners, financial advisers or professional services." On timing, it states: "AML/CTF obligations apply if you provide a designated service in table 6 from 1 July 2026." ([AUSTRAC, Professional designated services](https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/professional-designated-services)) The same page is clear that coverage is not automatic for every accounting engagement: "Whether your activities relate to providing a table 6 designated service depends on the facts of each case." And it adds that "A service is only a designated service under table 6 if it's provided 'in the course of carrying on a business'." The practical consequence is that the first job is a scoping exercise. List the services your practice actually provides, then work through them against table 6 and AUSTRAC's examples with your adviser. Only the services that fall inside the table bring the obligations. Everything below assumes you have done that scoping and concluded that some of your work is in. ## What the Act and AUSTRAC's guidance programme say about due diligence The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 organises customer due diligence into two parts. Its table of contents on legislation.gov.au lists "Division 2—Initial customer due diligence" (with the heading "28 Undertaking initial customer due diligence") and "Division 3—Ongoing customer due diligence" (with the heading "30 Undertaking ongoing customer due diligence"). ([legislation.gov.au, AML/CTF Act 2006](https://www.legislation.gov.au/C2006A00169/latest/text)) That split is the reason this article treats verification at onboarding and review later as two separate steps. Read the provisions themselves, in the current compilation, before relying on this summary. AUSTRAC has also said what help is coming for the sector: "We'll also be releasing sector-specific guidance for lawyers, accountants, real estate agents, conveyancers and jewellers. This includes starter program kits for small, low-complexity businesses in these sectors." ([AUSTRAC, AML/CTF Rules release and upcoming guidance](https://www.austrac.gov.au/amlctf-rules-release-and-upcoming-guidance)) Check that page for what has been published since. ## Why this lands on the practice, not the client Most accountants already know their clients well. The regime asks you to be able to show that knowledge: a documented program, a named compliance officer, a risk rating per client, evidence that you verified identity, and a record of what you decided and why. The difficulty is rarely the judgement. It is keeping the evidence consistent across a whole client book. So treat Tranche 2 as a workflow design problem. Below is a loop you can adapt, with the places where a tool can help. ## Step 1: Write the program and name the compliance officer Everything else hangs off your AML/CTF program. Draft it from your actual practice: the services you provide, the clients you take on, and how you will assess risk. Keep versions, so you can show which program was in force on a given date, and activate one at a time. Fedix Practice Manager can generate the program for your practice, keep versions, let you activate one and designate the compliance officer. [ev:feature:crm-aml-ctf-program] Treat the generated text as a starting draft that you read, edit and own. ## Step 2: Prepare your AUSTRAC enrolment Enrolment asks for details about your practice, its people and its services. Collect them once, in one place, rather than hunting through files on the day. Fedix Practice Manager can generate an information pack from your practice data to help you prepare your AUSTRAC enrolment. [ev:feature:crm-austrac-enrolment-pack] It prepares information for you. It does not enrol the practice for you. ## Step 3: Assess the risk of every client A risk assessment is the decision that shapes how much verification and monitoring a client gets. A useful record has three parts: the factors you considered, your rating, and who signed it off and when. In Fedix Practice Manager you can record a risk assessment for each client, with an AI-drafted analysis you can override, and sign-off options that include prohibit or needs more information. [ev:feature:crm-kyc-assessments] The AI draft is there to save you typing. The professional judgement stays with you, and an override is a normal part of the process. ## Step 4: Verify identity without chasing documents Identity verification is where practices lose the most time: emailing for documents, waiting, re-sending, and then filing the result somewhere nobody can find again. Two things help here: - **Let the client do their own ste

ps.** You can send clients a link so they can complete their identity verification steps themselves, including from a phone. [ev:feature:crm-kyc-step-links] - **Keep the result with the client record.** You can run identity verification sessions online, review the extracted details, and write the verified result and a PDF report to the client record. [ev:feature:crm-identity-verification] You review the extracted details before the result is recorded. ## Step 5: Screen clients and related people Screening means checking the client, and the people connected to them, against sanctions lists and looking for signals such as political exposure or adverse media. A hit is a prompt to look closer, not a verdict. Fedix Practice Manager can screen clients and related people against the DFAT Consolidated Sanctions List, with AI-assisted political-exposure and adverse-media indicators to prompt your review. [ev:feature:crm-kyc-screening] The indicators are prompts. You decide what they mean for the client. ## Step 6: Review again on a schedule and on a trigger Customer due diligence is not a one-off. A client's circumstances change, you take on a new type of work, or a review simply falls due. Decide in advance what triggers a review and how you will know a client is due. You can trigger customer due diligence reviews, see their history, and let a daily check bring clients due for review back into the queue. [ev:feature:crm-kyc-cdd-review] This is the step practices most often leave to memory, so it is worth automating the reminder. ## Step 7: Keep a view of where you stand At some point your compliance officer, a partner, or a reviewer will ask: how many assessments are incomplete, and which are about to expire? Answering from a spreadsheet is fragile. A KYC and AML dashboard shows customer assessments, what is expiring, what is incomplete and where the practice stands overall. [ev:feature:crm-kyc-dashboard] ## Common traps worth designing out These are workflow habits, not legal rules, but they are where practices tend to come unstuck once a program exists on paper. - **A program that nobody can find.** If the compliance officer leaves, can someone else see which version is active and who owns it? Versioned, activated programs with a named officer answer that question without a hunt through shared drives. [ev:feature:crm-aml-ctf-program] - **Assessments that quietly expire.** A risk rating made when a client was onboarded is only as good as its last review. A view of expiring and incomplete assessments turns this from a memory test into a queue. [ev:feature:crm-kyc-dashboard] - **Verification evidence scattered across email.** Keep the verified result and report on the client record, so the file is complete when someone asks for it. [ev:feature:crm-identity-verification] - **Screening hits with no note.** A hit that was reviewed and cleared is only useful later if the reasoning was recorded alongside it. Treat the indicators as prompts and write down what you concluded. [ev:feature:crm-kyc-screening] - **Overriding the draft without saying why.** If you change an AI-drafted assessment, record the reason. Professional judgement is the point; a visible reason makes it defensible. [ev:feature:crm-kyc-assessments] ## How the pieces fit in a normal week A new client enquires. You scope the engagement against what you have worked out about table 6, and record a risk assessment. If the risk calls for it, you send the client a verification link and they complete their steps on their phone while you get on with other work. When the verified result arrives, you review the extracted details, screen the client and any related people, note your conclusions, and sign off, or mark the client as needing more information, or prohibit. [ev:feature:crm-kyc-step-links] [ev:feature:crm-identity-verification] [ev:feature:crm-kyc-screening] [ev:feature:crm-kyc-assessments] Months later, the client appears in your review queue because a review has fallen due. You open the history, see what was decided before, and decide whether anything has changed. [ev:feature:crm-kyc-cdd-review] None of that requires a special project. It requires a routine, and a place to keep the evidence. ## A checklist you can copy - Program written, versioned and activated; compliance officer named. - Enrolment information collected in one place. - Every client has a recorded risk assessment with a sign-off. - Identity verified, with the evidence stored on the client record. - Clients and related people screened, with your review noted. - Review triggers defined, and a way to see who is due. - A view of what is incomplete or expiring. ## What software should and should not do Software should reduce re-keying, make the evidence consistent and surface what is due. It should not make the call for you. The tools above are built around that idea: AI drafts and indicators prompt your review, and the sign-off is yours. [ev:feature:crm-kyc-assessments] [ev:feature:crm-kyc-screening] If you want to see how these steps fit together in one place, the KYC and AML page walks through them: https://home.fedix.ai/features/kyc-aml **Recording:** a walkthrough recording was not available when this was drafted, so none is embedded yet. *This article is general information for accountants and is not legal or tax advice. Confirm your obligations with AUSTRAC and your professional adviser.*