KYC for Accounting Firms: A Complete Guide to Customer Due Diligence

# KYC for Accounting Firms: A Complete Guide to Customer Due Diligence With [AUSTRAC Tranche 2 reforms](/resources/blog/austrac-tranche-2-aml-ctf-reforms-accountants) bringing accountants under the AML/CTF Act from 1 July 2026, every Australian accounting practice must implement robust Know Your Customer (KYC) and Customer Due Diligence (CDD) procedures. This guide covers exactly what you need to verify for each client type. ## What is KYC/CDD? **Know Your Customer (KYC)** is the process of verifying the identity of your clients and understanding the nature of their business. **Customer Due Diligence (CDD)** is the broader framework that includes KYC plus ongoing monitoring, risk assessment, and record-keeping. Under the AML/CTF Act, CDD has three levels: 1. **Simplified CDD** -- for low-risk clients where reduced verification is permitted 2. **Standard CDD** -- the baseline for all clients 3. **Enhanced Due Diligence (EDD)** -- additional measures for high-risk clients, PEPs, and complex structures Every client relationship must begin with at least standard CDD before you provide any designated services. ## CDD for Individuals Individual clients are the most straightforward to verify. You need to collect and verify: ### Information to Collect - Full legal name (as it appears on identity documents) - Date of birth - Residential address (not a PO Box) - Occupation and source of income/wealth - Tax File Number (for ATO-related services) - Purpose of the business relationship ### Verification Methods **Primary Photographic ID (at least one):** - Australian driver's licence - Australian passport (current or expired within 2 years) - Foreign passport with Australian visa - Proof of age card issued by a state or territory **Secondary Non-Photographic ID (at least one if needed):** - Medicare card - Birth certificate or extract - Citizenship certificate - Centrelink or Veterans Affairs card **Electronic Verification:** The AML/CTF Act permits electronic identity verification (eKYC) using government data sources. This matches the individual's name, date of birth, and address against records held by: - Document Verification Service (DVS) -- verifies Australian IDs - Credit bureaus -- confirms address history - Electoral roll -- confirms address registration Electronic verification is faster, more reliable, and creates an automatic audit trail -- making it the preferred method for practices handling volume. ### When to Request Additional Information If any of the following apply, perform enhanced due diligence: - Client is from a high-risk jurisdiction (FATF grey/black list) - Source of funds is unclear or inconsistent with occupation - Client is a Politically Exposed Person (PEP) or associate of a PEP - Client requests unusual transaction structures ## CDD for Companies Company verification is more complex because you must look through the corporate structure to identify the real people behind it. ### Information to Collect - Full company name and any trading names - Australian Company Number (ACN) and ABN - Registered office address and principal place of business - Jurisdiction of incorporation - Nature of business activities ### Identifying Beneficial Owners This is the critical step. You must identify every individual who: - **Owns 25% or more** of the company's issued capital (directly or indirectly) - **Exercises significant control** over the company (even without ownership) - **Holds senior management positions** if no individual meets the ownership threshold For each beneficial owner, perform the same individual CDD as described above. ### Verification Methods - ASIC company extract (confirms registration, directors, shareholders) - Annual return or current share register - Trust deeds (if shares are held by trusts) - Direct confirmation from directors regarding beneficial ownership ### Complex Ownership Structures Many accounting clients have layered structures -- a family trust holds shares in a company, which holds units in a unit trust. For each layer: 1. Identify all entities in the ownership chain 2. Trace through to the ultimate beneficial owners (individuals) 3. Verify each individual who holds 25% or more at any level 4. Document the entire structure with a diagram ## CDD for Trusts Trusts are one of the highest-risk structures for money laundering because ownership and control can be opaque. Your CDD must be thorough. ### Information to Collect - Full name of the trust - Type of trust (discretionary, unit, hybrid, testamentary) - Country of establishment - ABN/TFN of the trust - Name and address of all trustees (individual and corporate) ### People to Verify | Role | Verification Required | |------|----------------------| | **Settlor** | Identify and verify (unless nominal -- e.g. $10 settlement) | | **Trustees** | Full individual CDD for each individual trustee; full company CDD for corpo

rate trustees | | **Beneficiaries** | Identify named beneficiaries; for discretionary trusts, identify classes of beneficiaries | | **Appointor / Guardian** | Identify and verify -- this person has the power to remove and appoint trustees | | **Beneficial owners** | Anyone who holds 25%+ beneficial interest or exercises effective control | ### Key Documents - Trust deed (including any variations or amendments) - Minutes of trustee meetings (to confirm current trustees and appointor) - Financial statements showing distributions (to identify active beneficiaries) ### Discretionary Trusts: Special Considerations Discretionary trusts (family trusts) are common in Australian accounting practices. Because the trustee has discretion over distributions, there are no fixed beneficial owners. In this case: - Identify the **appointor** (who controls the trustee) -- this person is effectively the beneficial owner - Identify all **classes of beneficiaries** described in the trust deed - Monitor annual distributions to see which beneficiaries are actually receiving benefits - Apply enhanced due diligence if the trust structure appears designed to obscure ownership ## CDD for SMSFs Self-Managed Super Funds are a unique Australian structure requiring specific CDD steps. ### Information to Collect - Fund name and ABN - Whether individual or corporate trustee structure - All member names and details - SMSF auditor details - ATO compliance status ### Verification Requirements - Verify all individual trustees (or the corporate trustee entity) - Verify all members of the fund - Confirm the fund is registered with the ATO and not in a compliance breach - For corporate trustee SMSFs, apply the company CDD process to the trustee company ### Red Flags for SMSFs - Related party transactions at non-arm's length terms - Loans to members or related parties (prohibited under SIS Act) - Unusual investment patterns (speculative assets, cryptocurrency without clear strategy) - Late or missing auditor reports ## Risk-Based Approach Not every client presents the same level of risk. The AML/CTF Act requires a risk-based approach to CDD. ### Risk Factors to Assess **Client Risk:** - Type of entity (individual vs complex trust structure) - Country of residence or incorporation - PEP status - Source of funds/wealth clarity - History of compliance issues **Service Risk:** - Managing client money or assets (higher risk) - Creating or managing legal entities (higher risk) - Tax compliance only (lower risk) - Advisory services only (lower risk) **Geographic Risk:** - Client or beneficial owners in FATF grey/black list countries - Cross-border transactions - Connections to high-risk jurisdictions ### Risk Categories and Review Frequency | Risk Level | CDD Level | Review Frequency | Examples | |-----------|-----------|-----------------|---------| | **Low** | Simplified CDD | Every 5 years | Long-standing individual client, stable employment, domestic only | | **Medium** | Standard CDD | Every 3 years | Company with straightforward ownership, unit trust with known unitholders | | **High** | Enhanced CDD | Annually | PEP client, complex multi-layered structures, clients from high-risk jurisdictions | ## Record Retention All CDD documentation must be retained for **7 years** after: - The end of the business relationship, OR - The completion of an occasional transaction Records to retain include: - Copies of identity documents collected - Electronic verification results and reports - Risk assessments and rationale - Ongoing monitoring records - Suspicious matter reports (if any) - Correspondence related to CDD Store records securely with appropriate access controls. Electronic storage is permitted and preferred for searchability and audit purposes. ## Automate Your CDD with Fedix Manual CDD is time-consuming, error-prone, and difficult to maintain consistently across a practice. The Fedix KYC/AML module automates the entire process: - **One-click identity verification** for individuals against DVS and credit bureau databases - **Company and trust lookups** via ASIC and ABN registries with automatic beneficial owner identification - **Sanctions screening** against the DFAT Consolidated Sanctions List, with PEP and adverse-media checks. Additional international list coverage via licensed data partners is on the roadmap. - **Risk scoring engine** that automatically categorises clients and triggers appropriate CDD levels - **Automated review reminders** based on risk-level review frequency - **Secure document storage** with 7-year retention and full audit trail - **$2.90+gst per verification** -- first 10 free, volume tiers down to $1.50, no monthly subscriptions, no minimum commitments Stop building spreadsheets to track CDD status. [See how Fedix automates KYC for accounting firms](/features/kyc-aml) or [talk to us about onboarding your practice](/contact).