Legal and Conveyancing KYC and AML Checks

Australia’s expanded AML/CTF regime brings legal practitioners into scope when they provide specified professional designated services from 1 July 2026. The practical starting point is therefore the service being supplied, not merely the fact that the client has engaged a lawyer or conveyancer. A practice should map its matter types against the legislation and AUSTRAC guidance and retain a reasoned scope decision.

• Covered activities can include assisting a client with a transaction involving real property, a body corporate or a legal arrangement, subject to the precise statutory service description and exclusions.
• Creating or restructuring a body corporate or legal arrangement, and other services listed for professional service providers, may also be designated services.
• Advice, litigation and other legal work should not be labelled in scope simply because it occurs near a transaction; assess the actual service the practice provides.
• A mixed matter may contain both covered and non-covered work. Define when the regulated service starts and what client due diligence must be completed before it is provided.
• When the scope is uncertain, obtain appropriate legal or compliance advice and consult current AUSTRAC material rather than relying on a software workflow.

Customer due diligence should fit the practice’s AML/CTF program and the risks presented by its services and clients. A repeatable digital workflow can reduce inconsistent collection, but the practice still needs documented rules for ordinary, simplified where permitted, and enhanced treatment. The result should help a reviewer understand who the client is, why the matter exists and who ultimately benefits from or controls the transaction.

• Collect the client’s identity, contact details and relationship purpose using fields that match the customer type and the practice’s approved procedure.
• Include risk inputs relevant to legal work, such as matter type, asset or transaction context, delivery channel, source and destination jurisdictions and the use of intermediaries.
• Define who may approve higher-risk clients, what additional information they need and when work must pause while questions remain unresolved.
• Do not let a successful document or database check automatically assign a low risk rating; verification and risk classification answer different questions.
• Keep the onboarding output with the matter-level assessment, reviewer notes and final decision so the file explains the practice’s reasoning.

Legal and conveyancing clients are not always a single natural person. Instructions may come from a director for a company, a trustee for a trust, a partner, an executor, an attorney or an agent. The practice needs to identify the customer correctly, understand the structure and verify the people required by its procedure. More complex arrangements may require documents and manual analysis beyond an automated result.

• For an individual, collect and verify the identifying information required by the practice and resolve material discrepancies before relying on the result.
• For a company, verify the entity, review registration information and identify the people who direct, control or ultimately own it under the applicable procedure.
• For a trust, record the trust type and relevant parties, obtain appropriate trust evidence and identify trustees, beneficial owners or other connected people as required.
• For partnerships and associations, adapt collection to their legal form instead of forcing the customer into a company workflow.
• Escalate foreign, layered, nominee or opaque ownership structures when reliable ownership and control information cannot be established through the standard workflow.

Knowing the client is not enough when another person gives instructions. The practice should identify the representative, understand their role and take reasonable steps under its procedure to verify authority. This can also help address impersonation, fraudulent property transactions and instructions that do not align with an established client relationship.

• Record whether the person acts as a director, trustee, partner, attorney, executor, employee, agent or in another capacity.
• Verify the representative’s identity where required, rather than relying only on an email signature or information supplied by a referrer.
• Collect authority evidence appropriate to the relationship, such as registry information, a resolution, power of attorney, trust document or direct confirmation.
• Use a separate communication channel or known contact details for high-risk changes to payment instructions, ownership details or authorised representatives.
• Document unresolved inconsistencies and require an authorised reviewer to decide whether further evidence or escalation is necessary.

Beneficial ownership is a core part of understanding an entity client. Registry information can be useful, but it may not provide a complete view of the natural people who ultimately own or control a layered structure. A KYB workflow should organise entity information and connected-person checks while leaving room for documentary evidence, questions and reasoned human review.

• Trace ownership and control to natural persons using the thresholds and control tests set by the practice’s current legal and regulatory procedure.
• Consider control exercised through voting rights, appointments, trusts, agreements or other means, not ownership percentage alone.
• Compare information from the client with reliable independent records and investigate material conflicts or unexplained gaps.
• Apply individual KYC and relevant screening to beneficial owners and controllers identified as part of the entity workflow.
• Record the steps taken when no beneficial owner can be identified under the applicable test and follow the practice’s escalation procedure.

Name screening can generate false positives, especially for common names or incomplete identity data. A useful process compares dates of birth, locations, aliases, nationality and other available identifiers before a result is cleared or escalated. It also distinguishes different forms of financial-crime risk rather than presenting every record as an automatic failure.

• Treat a PEP connection as a factor requiring the assessment and controls specified by the practice, not as evidence that the person has acted improperly.
• Identify the sanctions list or other source involved and follow the practice’s legal escalation steps where a match may be genuine.
• Use enough identifiers to reduce false positives, while collecting and handling personal information consistently with privacy and security requirements.
• Classify the outcome as cleared, confirmed or unresolved under a documented review standard and retain the reasons and supporting evidence.
• Decide separately whether recurring screening or an event-driven rescreen is needed; a point-in-time result does not remain current indefinitely.

A third-party check can make collection and evidence more consistent, but the reporting entity remains responsible for its AML/CTF obligations. Before relying on a workflow, the practice should understand what was checked, which sources and matching methods were in scope, when the result was generated, how exceptions are handled and how records can be retrieved.

• Retain the submitted identifiers, verification result, entity and ownership information, screening status, match-review notes and timestamps relevant to the decision.
• Document any information obtained outside AuthNTick, including trust instruments, corporate records, source-of-funds material or direct authority confirmation.
• Keep the practice’s risk rating, enhanced due diligence, approval and matter-acceptance decision as its own record rather than outsourcing the judgement.
• Define access, retention, privacy and security controls for personal and sensitive information across the practice and its service providers.
• Test the end-to-end procedure—including exceptions and manual referrals—rather than assuming a successful API or portal response proves the control is effective.

Initial KYC and AML screening establishes a point-in-time foundation. During a long-running matter or continuing client relationship, information can change: directors are appointed, trustees are replaced, ownership is transferred, new jurisdictions are introduced or activity no longer matches the stated purpose. The practice must separately define the monitoring and review controls that apply to its services and risk profile.

• Set periodic review frequencies that reflect customer risk and define events that trigger an earlier identity, ownership or screening refresh.
• Reassess when the client requests a materially different service, the purpose changes or the practice becomes aware of inconsistent information.
• Maintain transaction monitoring and regulatory reporting processes outside the identity verification workflow where those obligations apply.
• Ensure staff know how to escalate unusual behaviour or information without tipping off a client or disrupting an appropriate internal review process.
• Check current AUSTRAC guidance as the reformed framework is implemented and update policies, system configuration, training and records when requirements change.