KYC and AML Checks for Financial Services and Virtual Asset Providers

Australia’s updated AML/CTF obligations for existing reporting entities took effect on 31 March 2026. Expanded virtual asset designated services commenced from 1 July 2026, subject to transitional arrangements. The practical first step is to identify exactly which services your organisation provides, which customers and counterparties are involved, and which commencement or transition provisions apply.

• Map every product and transaction flow to the applicable designated service rather than assuming one onboarding standard fits the whole business.
• Document how customer, product, delivery-channel and geographic risks influence the information and verification steps required at onboarding.
• For a new or expanded virtual asset activity, confirm the current AUSTRAC enrolment and registration position before relying on a general compliance checklist.
• Keep your legal and compliance interpretation separate from the technical configuration of an identity or screening vendor.

Financial and virtual asset customers do not all arrive as simple individuals. A business relationship may involve an entity, directors, beneficial owners, controllers, trustees and people authorised to act. A strong workflow establishes the entity first, then connects the right individual checks without losing the evidence trail between them.

• Use a KYC Check for the identity-verification stage of an individual customer or related-person workflow.
• Use a KYB Check to confirm business information and organise checks on relevant owners, controllers, officeholders and representatives.
• Use a combined KYC and AML Check when identity verification and PEP, sanctions or watchlist screening form part of the same individual onboarding decision.
• Define how trusts, foreign entities, complex ownership and information inconsistencies move to document collection or manual review.

Name screening is most useful when the workflow preserves context. Similar names can produce false positives, and a PEP connection is a risk consideration rather than evidence of wrongdoing. Reviewers need enough identifying information to understand the record, compare it with the customer and record a defensible outcome.

• Use full names, date of birth, nationality, address or location and other permitted identifiers when they are available and relevant.
• Distinguish PEP status from sanctions restrictions and other watchlist records because the consequences and required controls are not identical.
• Route unresolved similarities to an authorised person rather than allowing an automated name match to make the final decision.
• Retain the screening time, data source context, identifiers considered, reviewer conclusion and any escalation or enhanced due diligence step.

An onboarding result is a point-in-time view of identity and the screening data then available. AUSTRAC’s customer due diligence framework also addresses understanding the customer relationship and keeping information current. Financial and virtual asset businesses should therefore connect onboarding evidence to separate ongoing controls rather than describing one check as continuous compliance.

• Define periodic and event-driven review triggers based on customer risk, material information changes and the services being provided.
• Reassess entity ownership, control and authorised-person information when relevant changes become known.
• Operate transaction monitoring, behavioural review and suspicious matter escalation through the systems and procedures established for those purposes.
• Confirm separately whether recurring screening or adverse media services are available before including them in your control design.

AUSTRAC explains that financial institutions, remitters and virtual asset service providers may need to collect, verify and share customer information when transferring or receiving funds or virtual assets. This is operationally different from completing KYC at account opening: the relevant transaction information must travel through the payment or virtual asset transfer chain.

• Identify whether your business acts as an ordering, intermediary or beneficiary institution for each relevant transfer flow.
• Map which originator and beneficiary information must be collected, verified, transmitted, received, checked and retained.
• Design exception handling for missing, incomplete or inconsistent transfer information and determine when a transaction should be paused or escalated.
• Do not represent an identity-verification API as a complete Travel Rule solution unless the required transaction messaging, counterparty exchange and controls are demonstrably in scope.

Good integration is not only about returning a pass or fail. The downstream case should retain enough information to show what happened, when it happened and who resolved an exception. Before implementation, agree on the result fields, identifiers, status vocabulary, webhook or API behaviour, retention approach and manual-review hand-off.

• Keep the customer or entity reference consistent across KYC, KYB, screening and internal case records.
• Record completed, incomplete, clear, potential-match and review states precisely instead of collapsing them into one generic status.
• Limit access to identity evidence and sensitive screening information according to role and business need.
• Test retry, duplicate, timeout, unavailable-source and manual-review paths before relying on the workflow in production.

AUSTRAC states that a remittance or virtual asset service provider must both enrol and register. Generally, a provider cannot begin the registrable service until registration has been approved, although transitional arrangements may apply to newly regulated virtual asset services where an application was made within the specified period. This is a regulatory process, not an outcome produced by KYC software.

• Confirm whether the particular virtual asset activity is a designated and registrable service, including its geographical connection to Australia.
• Use current AUSTRAC guidance for application timing, transitional treatment and information that must be supplied.
• Maintain evidence that the business is ready to manage ML/TF and proliferation-financing risk independently of vendor selection.
• Seek appropriately qualified advice for legal classification or transition questions that cannot be resolved from official guidance.