Since Tranche 2 began on 1 July 2026, many accountants, lawyers, conveyancers and real estate agents have had their first awkward conversation: a client who does not want to hand over identification, or a company client that will not say who owns it. Some of these clients are simply private people who have never been asked before. A few are trying to hide something.
AUSTRAC’s rules decide what you can do next, and they are firmer than many small firms expect. This guide explains the rule, how to tell a reluctant client from a refusing one, when the situation may need a suspicious matter report (SMR), and what to record. It is general information, not legal advice, and your AML/CTF program sets the detail for your firm.
The rule: no customer due diligence, no designated service
AUSTRAC is clear that you must complete initial customer due diligence (CDD) before you start providing a customer with a designated service. You complete it by establishing certain matters on reasonable grounds, including the identity of the customer and, for customers that are not individuals, the identity of their beneficial owners.
If you cannot establish those matters on reasonable grounds, AUSTRAC says you must not start providing the designated service.
There are limited circumstances where initial CDD can be completed after the service starts. AUSTRAC calls this delayed initial CDD, and it is only available where the conditions in the rules and your program are met. A client preferring not to provide ID is not one of those circumstances, and delaying because the conversation is uncomfortable does not meet the test.
Reluctant or refusing: work out which one you have
Most hesitation has an ordinary explanation. Treat the first refusal as a conversation, not a verdict.
| What you are seeing | Likely reason | Practical response |
|---|---|---|
| “Why do you need this? You’ve known me for years.” | The client does not know about the new obligations | Explain that the law now requires it for every client receiving the service |
| Concern about privacy or identity theft | Reasonable caution | Explain how you store records, who can see them and that you record document details rather than keeping copies where your program allows |
| Cannot find a document | Lost, expired or never held | Ask for alternative documents or use other reliable and independent data your program accepts |
| A company client gives the directors but not the owners | Does not understand what a beneficial owner is | Explain the 25% ownership or control test and ask for a simple ownership chart |
| Vague answers, changing stories or pressure to proceed anyway | Possible concealment | Stop, escalate to your compliance officer and consider whether an SMR is required |
| A flat refusal with no reason | Unknown | You cannot provide the service. Consider whether an SMR is required |
AUSTRAC’s guidance allows you to establish matters by collecting and verifying different information, or by using other independent and reliable data, where its baseline examples do not fit a client. Flexibility on how you verify is real. Flexibility on whether you verify is not.
A short script for the first conversation
You do not need to sound like a regulator. Something like this usually works:
‘Since 1 July, Australian law requires us to confirm the identity of every client we act for in this kind of matter, and for companies, the people who own or control them. We have to do this before we can start. We record the document details and keep them securely. If you don’t have a passport or licence to hand, we can talk about other documents that would work.’
Avoid hinting at suspicion or mentioning reporting. If a suspicion does form later, anything you have already said about reporting can make the tipping off risk harder to manage.
When beneficial owners cannot be identified
Sometimes the problem is not refusal but genuine difficulty: a complex structure, an overseas parent or a register that is out of date. AUSTRAC’s guidance for bodies corporate, partnerships and unincorporated associations includes a fallback where you have taken reasonable steps and still cannot identify a beneficial owner. Follow your program, document each step you took and why it did not work, and treat the difficulty as a factor in the client’s risk rating.
That fallback is for clients who cooperate but cannot produce the answer. It is not a route around a client who will not tell you.
When refusal may require a suspicious matter report
AUSTRAC lists a customer who refuses, or is reluctant, to provide identification information, and a customer who refuses to give reasons for wanting a service or gives vague information, among the indicators of suspicious activity. A refusal on its own does not automatically mean you must report, but it is a signal you need to assess.
Two points matter for small firms:
- The SMR obligation applies even if you do not provide the service. AUSTRAC states that the obligation arises when you start or propose to provide a designated service, or someone asks for one. Turning the client away does not end the question of whether to report.
- The deadlines are short. An SMR must be lodged within 24 hours if the suspicion relates to terrorism financing, and within 3 business days in other cases, counted from when you form the suspicion.
If you do decide to stop acting, AUSTRAC says you must not provide information that establishes you have submitted an SMR. Keep the explanation to the client simple: you are unable to proceed because the required information has not been provided.
Existing clients who refuse
Clients you acted for before 1 July 2026 are pre-commencement customers. AUSTRAC’s transition guidance says initial CDD is needed for them in specific situations, including when an SMR obligation arises in relation to them, or when there is a significant change in the nature and purpose of the relationship that makes their risk medium or high. In those situations, you must complete initial CDD before you provide them with a designated service. A long-standing client who refuses at that point is in the same position as a new one.
What to record
Whatever the outcome, write it down while the details are fresh. Your record should show:
- what you asked for and when
- what the client provided, refused or could not provide, and any reason given
- any alternative information or verification you considered
- the steps taken to identify beneficial owners, where relevant
- your decision to proceed, delay under your program, or not act, and who made it
- whether you assessed the matter for an SMR and the outcome, with the SMR record itself kept separately and securely
In Australia, CDD records generally need to be kept for 7 years after the business relationship ends, or 7 years after an occasional transaction is completed.
Common mistakes
- Starting work ‘while the ID comes through’. Unless your program allows delayed CDD and the conditions are met, this is providing a designated service without completing initial CDD.
- Accepting the directors as the owners. Directors and beneficial owners are often different people.
- Turning the client away and closing the file. You still need to assess whether an SMR is required.
- Explaining too much. Telling a client that you may report them creates a tipping off risk.
- Not recording the refusal. If you decline to act, the reason belongs on file.
Frequently asked questions
Can I start work and collect ID later?
Only where delayed initial CDD is permitted under the rules and your AML/CTF program, and its conditions are met. Otherwise, initial CDD must be complete before you start providing the designated service.
Do I have to lodge an SMR every time a client refuses ID?
Not automatically. A refusal is an indicator of possible suspicious activity that you must assess. If you form a suspicion on reasonable grounds, you must report, even if you do not provide the service.
What can I tell a client when I decline to act?
That you cannot proceed because the information required by law has not been provided. Do not mention any suspicion or report.
What if the client cannot provide a standard ID document?
AUSTRAC’s guidance allows other reliable and independent data where the baseline documents do not fit. Check what your program accepts.
Does this apply to clients I had before Tranche 2?
In specific situations, yes. Initial CDD is needed for a pre-commencement client if an SMR obligation arises or the relationship changes significantly in a way that makes their risk medium or high.
How NameScan can help
Once you have a client’s details, NameScan lets you run PEP, sanctions and adverse media checks on individuals and companies on a pay-as-you-go basis, plus ID verification and KYB checks, with a dated result for your file. Screening does not replace the identification conversation, but it gives you a quick, recorded check as soon as the information arrives.
Start screening with NameScan, or read our guide to the information you need before screening a company.
0 Comments