Under Australia’s AML/CTF Act, you can rely on know your customer (KYC) information that another regulated business has collected and verified, instead of repeating the same checks. CDD reliance can save time and spare clients from handing over the same documents twice, but it comes with conditions, and it does not move your obligations onto the other firm.

This guide explains the two ways reliance works, what you must obtain and document, what stays your responsibility, and how it differs from using an agent or a screening provider. It is general information for Australian reporting entities, not legal advice.

Who you can rely on

AUSTRAC’s guidance allows reliance on KYC information collected and verified by another Australian reporting entity, or by a foreign business that is subject to anti-money laundering and counter-terrorism financing (AML/CTF) regulation. For small firms after Tranche 2, that often means another professional in the same transaction who is now a reporting entity in their own right.

Two ways to rely

Table comparing three approaches to customer due diligence. Reliance: another regulated business collects and verifies KYC information for its own purposes, and you remain responsible for your own CDD obligations. Agent: someone collects and verifies KYC information on your behalf under section 37 of the Act, and you remain responsible. Screening provider: a service such as NameScan returns PEP, sanctions and adverse media results, and you are responsible for reviewing results and making decisions.

Case-by-case reliance

AUSTRAC says that for case-by-case reliance you must be able to obtain all the KYC information the other business collected before you start to provide the designated service (or within the delayed initial CDD timeframe, if that applies), and copies of the data it used to verify that information, immediately or as soon as practicable after you ask. You must also document why you believe reliance is appropriate, taking into account factors such as:

  • the nature, size and complexity of the other business
  • the services it provides and the kinds of customers it serves
  • the delivery channels it uses
  • the level of money laundering and terrorism financing risk in the countries where it operates

A CDD arrangement

A CDD arrangement is ongoing. AUSTRAC’s guidance says it must set out the responsibilities of each party, including for record keeping, and must enable you to obtain all the KYC information before you begin to provide a designated service and copies of the verification data on request. You must also assess the arrangement regularly. AUSTRAC lists developments such as a significant change in the ML/TF environment in the other party’s country, or a change in its ownership or control, as reasons to look at the arrangement again.

Where several businesses share one arrangement, AUSTRAC notes that each reporting entity remains individually responsible for its own obligations.

What stays your job

Reliance covers the KYC information that the other business collected and verified. It does not hand over the rest of your AML/CTF program. In practice you still need to:

  • assess the customer’s risk under your own program, because your service and your risk appetite may differ from theirs
  • apply enhanced CDD where your program requires it, even if the other firm did not
  • carry out ongoing CDD for as long as your relationship lasts
  • report suspicious matters to AUSTRAC yourself, and avoid tipping off
  • keep the records the Act requires, including records of your reliance decisions and assessments

Reliance, agents and screening providers are different things

Table comparing case-by-case reliance with a CDD arrangement. Legal basis: section 38 of the AML/CTF Act and Rules for reliance; section 37A for an arrangement. When it suits: occasional, one-off situations for reliance; regular, ongoing referrals between the same businesses for an arrangement. What you need: documented reasonable grounds that reliance is appropriate in the case, or an agreement that meets AUSTRAC’s content requirements. Ongoing duty: assess each time for reliance; regular assessments of the arrangement under section 37B.

Using a screening service is not reliance. You run the check, review the result and make the decision, so the screening record forms part of your own CDD.

DECIDING WHETHER TO RELY ON ANOTHER FIRM

Reliance is available only on AUSTRAC’s conditions.

Five-step workflow for relying on another party’s customer due diligence. 1. Eligible party: an Australian reporting entity or AML/CTF-regulated foreign business. 2. Assess risk: assess their business, customers, channels and country risk. 3. Obtain KYC: all KYC information before service, with verification data on request. 4. Document: record why reliance is appropriate. 5. Your obligations: risk rating, ongoing CDD and reporting stay with you.Figure 1. Illustrative decision path for case-by-case reliance. A CDD arrangement adds a written arrangement and regular assessments.

A worked example

Illustrative example. A real estate agency is selling a property. The buyer is represented by a conveyancing practice that is a reporting entity and has already verified the buyer’s identity. The agency decides to rely on the conveyancer’s checks on a case-by-case basis. Before providing its service, it obtains the KYC information the conveyancer collected, confirms the conveyancer will provide copies of the verification data on request, and records why reliance is appropriate. The agency still rates the buyer’s risk under its own program and screens the buyer as its program requires, and it keeps all of this on its own file.

Privacy and consent

AUSTRAC reminds businesses to consider whether they need the customer’s consent before disclosing KYC information to a third party, and to comply with their privacy obligations. Build this into your engagement terms or onboarding forms so that sharing can happen when it is needed.

Frequently asked questions

Can I rely on any business that has checked my client?

No. The other party must be an Australian reporting entity or a foreign business subject to AML/CTF regulation, and you must meet AUSTRAC’s conditions for reliance.

Do I need a written agreement to rely on another firm?

Not for case-by-case reliance, but you must document why reliance is appropriate. For ongoing reliance, a CDD arrangement that meets AUSTRAC’s requirements is needed.

If I rely on another firm, am I still responsible?

Yes. Reliance lets you use their KYC information. Your risk assessment, ongoing CDD, suspicious matter reporting and record keeping remain your obligations.

Is using a screening tool a form of reliance?

No. When you run a screening check, you review the results and make the decision yourself, so it forms part of your own CDD.

What records should I keep?

Keep the KYC information you obtained, your reasons for relying, any arrangement and its assessments, and your own risk rating and screening results, with the client’s CDD records.

How NameScan can help

Even when you rely on another firm’s identity checks, your own program may require you to screen the client and associated people. NameScan lets small firms run PEP, sanctions and adverse media checks on a pay-as-you-go basis and record the decision for each result, so your file shows your own screening alongside the information you relied on.

Add your own screening to every file

Run PEP, sanctions and adverse media checks under your own program, with a dated record of each decision.