What is know your customer (KYC)?

Customer due diligence is KYC in practice. You identify the customer: full legal name, date of birth, address, ABN or ACN and contact details. You verify that identity with documents or reliable electronic checks. You identify and verify beneficial owners according to the thresholds. You record the purpose of the relationship and the expected pattern of transactions, assign a risk rating (low, standard or high) based on customer type, services, geography and product, and then monitor the relationship for unusual behaviour. Where suspicion arises you escalate, file a suspicious matter report, and consider freezing or ending the relationship.

A risk-based approach means a sole trader buying a ute gets a lighter touch than a layered trust structure with cross-border flows, which needs enhanced due diligence and more frequent review.

For individuals, accept at least one primary photo ID such as a passport or driver licence, plus a secondary document (a utility bill or rates notice) where the risk is higher. For a company, obtain an official registry extract showing the name, ACN or ABN, registered office and officeholders, and verify the beneficial owners. For a trust, verify the trustee and take reasonable steps to identify beneficiaries and settlors. Where documents are not available, record the reasonable steps you took.

Electronic KYC uses document scanning, facial biometrics with liveness checks, and real-time registry matches to speed up onboarding. It suits standard-risk customers, produces a verifiable audit trail (time, IP, device, document images and results), and needs vendor due diligence on the identity provider. High-risk relationships still require enhanced, often manual, checks.

KYC feeds three reporting duties: suspicious matter reports when you know or suspect a link to money laundering, terrorism financing or related offences; threshold transaction reports for cash transactions above the legislated threshold; and international funds transfer instruction reports for cross-border instructions. Identity and verification records, transaction histories, risk assessments and reporting evidence must be kept for the statutory retention period, with access controls and a clear audit trail.

Common enforcement themes are failing to verify identity or beneficial owners, weak transaction monitoring, unreported suspicious matters and poor record-keeping. Outcomes range from enforceable undertakings and remediation programs to civil penalties and, in serious cases, criminal investigation.