Is KYC a legal requirement in Australia?

KYC obligations attach to reporting entities, businesses that provide a "designated service" under the Act. AML/CTF reforms commenced on 31 March 2026 for existing reporting entities. The second tranche brought in the legal and accounting professions, real estate and jewellers from 1 July 2026, and AUSTRAC opened enrolment for them on 31 March 2026. If you're in one of those professions and unsure whether a service you provide is designated, check AUSTRAC's guidance or get advice.

Initial customer due diligence must be complete before the service starts. It covers establishing who the customer is, their beneficial owners, whether they are a politically exposed person or sanctioned, and the purpose of the relationship. After that, ongoing due diligence keeps monitoring the risk. Enhanced due diligence applies where risk is high, and simplified due diligence is allowed where it is demonstrably low.

What a customer file should be able to show:

• Identity collected and verified against reliable, independent data.
• Beneficial owners identified, for a company or trust.
• PEP and sanctions screening done, with the result recorded.
• The purpose and intended nature of the relationship understood.
• A risk rating, and the reason for it.
• Ongoing monitoring in place, with triggers for enhanced due diligence.
• A record of who did each step and when.

The last item on that list is usually the weakest. AgentConnect prepares the case and a reviewer approves anything consequential, with an execution trace behind each step. More on how that works for banks and fintechs, and on KYC done by an outsourcing provider. This page is a summary, not legal advice.

• Banking & Fintech: approval gates and execution traces for regulated customer operations.

Sources

• AUSTRAC: Overview of initial customer due diligence
• AUSTRAC: Regulatory expectations and priorities 2025-26 (reform dates)
• AUSTRAC: Enrolment opens for new professions
• AUSTRAC: Customer due diligence reform guidance