KYC and AML for Trust and Company Service Providers

AUSTRAC’s professional designated-services guidance describes the services in Table 6 of the AML/CTF Act. Coverage is profession-neutral and focuses on what the provider actually does. From 1 July 2026, a business providing a covered service with the required Australian geographical link has AML/CTF obligations, subject to the legislation and any applicable exemption.

• Examples include sufficiently connected assistance with buying, selling or transferring a body corporate or legal arrangement, relevant equity or debt financing, and creating or restructuring a body corporate or legal arrangement.
• Other listed services include selling or transferring a shelf company; acting or arranging for a person to act in certain company or legal-arrangement positions; nominee-shareholder services; and certain registered-office or business-address services.
• Preliminary or preparatory work can be covered when it directly advances the regulated outcome. General advice, an ancillary task or a merely hypothetical future transaction may fall outside the service, depending on the facts.
• Classify each service line and engagement rather than applying the same workflow to every customer of the firm. The onboarding record should preserve the service classification used to set the due-diligence scope.

AUSTRAC says initial customer due diligence generally must be completed before a reporting entity begins providing a designated service. The objective is to establish required matters on reasonable grounds using information and verification appropriate to the customer’s money laundering, terrorism financing and proliferation financing risk.

• Establish the customer’s identity and, where relevant, any person acting for the customer, their authority, persons on whose behalf the service is received and the customer’s beneficial owners.
• Determine whether relevant people are politically exposed persons or designated for targeted financial sanctions, and understand the nature and purpose of the business relationship or occasional transaction.
• Collect KYC information, assign or inform the customer risk rating and verify appropriate information using reliable, independent data. Higher-risk or unusual circumstances commonly require more evidence.
• Keep enough evidence to explain how required matters were established. A workflow should surface missing information and conflicting results instead of converting uncertainty into an unsupported pass.

Company onboarding starts by connecting the customer’s declaration to the legal entity that will receive the service. A legal name and ABN or ACN can support that task, but the customer profile also needs to explain the business activity, representative, proposed service and ownership or control relevant to the firm’s risk-based process.

• Compare declared identifiers with available registration status, registered details, officeholders and other suitable independent information. Record discrepancies and the date of the source.
• Distinguish the operating company from a corporate trustee and identify the trust or other arrangement for which that company acts. Verifying only the corporate trustee can leave the underlying customer relationship unexplained.
• Collect evidence of the representative’s role and authority. A person submitting an online form is not necessarily authorised to instruct the firm or bind the customer.
• Request a current extract, constitution, shareholder information, ownership chart or other supporting material when the available registry information cannot establish the relevant ownership and control chain.

Trusts are not verified in exactly the same way as companies. The trust deed or a suitable extract may be needed to understand the trust, its purpose and the parties connected to it. The people in scope should be determined from the applicable service, customer type, legal requirements and the firm’s risk-based policies.

• Capture the trust name and type, date and jurisdiction of establishment, business or investment purpose, trustee details and the document relied upon to understand the arrangement.
• Identify and verify trustees, settlors, beneficiaries, appointors, protectors, controllers or persons receiving the service only where those roles are relevant under the applicable law and your procedure.
• For a corporate trustee, complete the necessary company KYB and then resolve the natural persons who own or control that trustee or otherwise fall within the due-diligence scope.
• Treat broad beneficiary classes, discretionary powers, foreign trust-like arrangements and documents that are incomplete or inconsistent as structured review cases rather than assuming they can be resolved automatically.

AUSTRAC notes that customers can have complex ownership structures and that beneficial owners may be difficult to identify. The investigation can combine customer declarations with ASIC information, company extracts, constitutions, trust deeds, partnership agreements and other reliable evidence.

• Follow ownership through intermediate entities until the relevant natural persons are identified, or document why the applicable rules support another outcome. Do not stop at the first corporate shareholder.
• Consider control through voting rights, appointment powers, trustee or appointor roles, contractual influence or other means—not only a direct share percentage.
• Link every person to the entity, arrangement and role that brought them into scope. This makes related-person KYC and screening outcomes intelligible to the reviewer.
• Where the chain cannot be resolved, state what evidence was reviewed, what remains unknown and which additional document or approval is required. Manual review is a control, not a platform failure.

Trust and company structures can be legitimate and commercially necessary, but their flexibility can also obscure ownership, control or the movement of value. AUSTRAC’s sector risk material highlights risk factors including unexplained structural changes, high-risk jurisdictions, remote delivery and instructions delivered through intermediaries.

• Screen the individuals required by your policy for PEP and targeted financial sanctions indicators, then investigate possible matches using additional identifiers and context.
• Consider jurisdiction, service type, customer type, delivery channel and unusual behaviour as separate inputs. A low-risk company record does not erase a higher-risk service or transaction pattern.
• Escalate unexplained nominees, rapid or frequent changes in ownership, reluctance to identify controlling people, opaque offshore layers or instructions with no clear commercial rationale.
• Apply enhanced due diligence and source-of-funds or source-of-wealth enquiries when required by the law and your policies. AuthNTick can collect agreed evidence, but your reporting entity sets the threshold and decides the outcome.

Effective onboarding produces more than a green status. It should let an authorised person reconstruct who the customer was, which people and structures were considered, what independent evidence was used and why the firm reached its decision.

• Retain the customer’s declarations, entity and trust documents, registry information, identity-verification outcomes, screening results, dates and versioned risk inputs according to your recordkeeping policy.
• Separate confirmed facts, customer-supplied information, possible matches and unresolved gaps so future reviewers can understand the strength of each conclusion.
• Record manual-review notes, additional evidence requests, approvals and the final onboarding decision. The decision remains with the reporting entity, not the screening tool.
• Use event-driven or periodic review when ownership, control, authorised people, countries, service use or risk changes. A point-in-time KYC or KYB check is not ongoing customer due diligence by itself.