KYC and AML checks for Australian accounting firms

From 1 July 2026, AML/CTF obligations apply when an accounting or professional-services business provides one or more covered Table 6 designated services with a geographical link to Australia. The rules are profession neutral and service based. A client being a company, investor or property owner does not by itself establish that your engagement is regulated.

• Map each service line against the current Table 6 descriptions and document how you reached the scope decision.
• Covered activities can include actively advancing certain real-estate or entity transactions, creating or restructuring entities or arrangements, handling property for a transaction, arranging specified roles, and providing certain addresses.
• General advice or an ancillary service may fall outside Table 6 where it merely influences an outcome rather than directly advancing the covered transaction, creation or restructure.
• Revisit scope when the engagement changes. A matter that begins as general advice may later include instructions that trigger a designated service.

Initial CDD is not a single universal identity check. The information needed depends on whether the customer is an individual, body corporate, partnership, unincorporated association, trust, government body or another structure, as well as the customer’s ML/TF risk. Build separate paths so staff collect the right evidence without forcing every client through the same form.

• For an individual, collect and verify the KYC information required by your policies using reliable and independent data appropriate to risk.
• For a company or other organisation, verify the entity and identify the natural people who own or control it where required.
• For a trust, identify the trust and the relevant parties specified by your policies; complex ownership or foreign arrangements may need deeds, extracts or further evidence.
• Collect the nature and purpose of the relationship and enough service, delivery-channel and jurisdiction information to inform the practice’s risk assessment.

The person communicating with the practice may not be the customer. A director, employee, trustee, attorney, agent or adviser may act for another individual or entity. Your workflow should distinguish who the customer is, who is acting for them, whether that representative must be identified and verified, and what demonstrates their authority.

• Record the capacity in which the representative acts and the customer they represent.
• Verify the representative when required by your policies rather than relying only on an email address or introduction.
• Check authority using appropriate evidence, such as current entity records, an appointment, resolution, trust documentation or another source accepted by your practice.
• Escalate conflicting instructions, unexpected account details or authority that cannot be established instead of working around the exception.

Beneficial ownership work often requires more than confirming an ABN or ACN. Accountants may need to trace ownership or control through intermediate entities and verify relevant natural persons. AUSTRAC’s accountant starter-kit update released on 10 June 2026 changed ownership terminology and clarified when checks can stop for certain customer types under the new CDD measures.

• Use current customer-type forms and processes rather than copying an older ownership threshold or stopping rule into a new workflow.
• Keep the sources used to understand the structure and record why the practice concluded that the required beneficial owners were identified.
• Route nominee arrangements, layered ownership, foreign entities, trusts and inconsistencies for further evidence or manual review.
• Apply individual KYC and relevant screening to the people identified by your policies; an entity registry result alone does not verify those people.

Screening can help identify possible politically exposed person connections and similarities to sanctions or other agreed watchlist data. It is one input to due diligence. A similar name is not a confirmed match, and a PEP connection is a risk factor rather than evidence of criminal conduct.

• Use full and accurate identifying information where available so reviewers can distinguish people with similar names.
• Check relevant customers, beneficial owners and other associated people in accordance with your policies and the circumstances of the engagement.
• Document whether a possible match was cleared, confirmed or remains unresolved, including the identifiers and source context considered.
• Escalate the outcome under your own sanctions and enhanced CDD procedures; AuthNTick does not make the legal or engagement decision for the practice.

Accounting clients do not always fit a straight-through digital process. Historic entities, name changes, overseas documents, layered groups, executors and older trusts can create incomplete or conflicting evidence. A defensible workflow explains what staff do when an automated check cannot establish the required information.

• Classify outcomes consistently—for example, verified, further evidence required, possible match, escalated or unable to verify.
• Define who can clear each exception and when senior, compliance or legal review is required.
• Keep supplemental documents and reviewer reasoning with the original result so the decision can be reconstructed later.
• Do not weaken controls simply to meet an engagement deadline; use the delayed initial CDD rules only where they genuinely apply and your policies manage the risk.

A clear onboarding result helps, but compliance continues after identity verification. Reporting entities need an approved and maintained AML/CTF program, initial and ongoing CDD, record keeping, reporting, governance, personnel due diligence and training, and independent evaluation controls that match their designated services and ML/TF risks.

• Combine check results with the practice’s documented customer risk assessment rather than treating a clear KYC result as a low-risk classification.
• Define events that trigger updated KYC, ownership review, rescreening or enhanced CDD during the relationship.
• Keep transaction and behavioural monitoring separate from identity and name screening, and ensure reporting decisions reach authorised personnel.
• Review AUSTRAC starter-kit changes and retire superseded forms so teams do not apply outdated onboarding, beneficial ownership or reporting processes.

A practice may use a technology or outsourced provider to help perform verification and screening. AUSTRAC distinguishes outsourcing from permitted reliance on CDD performed by another regulated entity. A KYC provider does not become responsible for the accounting practice’s obligations merely because it supplies a check.

• Define the data, customer types, jurisdictions, result fields and exception-handling service your practice expects.
• Conduct appropriate provider due diligence and document responsibilities, performance expectations, privacy and information-sharing controls.
• Monitor the service and sample outcomes in proportion to your compliance and ML/TF risks.
• Maintain senior-management oversight and a practical route to remediate problems; your practice generally remains legally liable for its obligations.