Australia’s AML/CTF rules do not set a single re-screening interval for every client. They require ongoing customer due diligence that fits each client’s risk, plus specific steps when certain things change. In practice, that means two things working together: a schedule based on the client’s risk rating, and a short list of events that prompt a new check straight away.

This guide explains what the rules require, offers an example schedule a small firm can adapt, and lists the trigger events to build into everyday work. It is general information, not legal advice. Your own AML/CTF program sets the rules your firm must follow.

What the rules require after onboarding

Once initial customer due diligence (CDD) is done, the AML/CTF Act requires ongoing CDD for as long as the business relationship continues. The Department of Home Affairs summarises the reformed obligations as including reviewing and updating each customer’s money laundering, terrorism financing and proliferation financing risk where appropriate, and reviewing, updating and re-verifying know your customer (KYC) information where appropriate.

AUSTRAC’s guidance adds two screening-specific duties:

  • PEP changes. You must take reasonable steps to monitor whether your customer, a beneficial owner, or a person on whose behalf the customer receives the service becomes a politically exposed person (PEP) during the relationship. If one of them becomes a foreign PEP, or a domestic or international organisation PEP where the customer’s risk is high, you must review and, where appropriate, update and re-verify the KYC information.
  • Sanctions changes. AUSTRAC notes that sanctions listings change often and that you should always check against the most recently published list. You cannot deal with assets owned or controlled by a person designated for targeted financial sanctions, and you cannot make assets available to them.

AUSTRAC also expects KYC information to be reviewed, updated and re-verified at an appropriate frequency, and whenever you have doubts about whether what you hold is adequate or accurate.

There is no single legal interval

The law leaves the frequency to your program, as long as it matches the risk. A firm that re-screens every client every ten years would struggle to show that fits a high-risk client. A firm that re-screens a retired local client every month is probably spending effort it does not need to.

The practical answer is a tiered schedule linked to your client risk ratings, written into your AML/CTF program so that staff apply it consistently.

An example schedule a small firm can adapt

The table below is an illustrative starting point, not an AUSTRAC requirement. Adjust it to your own risk assessment and program.

Table showing client risk ratings and re-screening frequency: Low risk, re-screen at least every three years and at each new instruction, typically local individuals with simple services and no PEP or adverse media links; Medium risk, re-screen at least every two years and at each new instruction, typically company or trust clients with some cross-border activity or larger transactions; High risk, re-screen at least every year and before each significant transaction, typically foreign or high-risk PEP links, complex ownership or higher-risk countries.

Two points make the schedule work in practice. First, ‘at each new instruction’ matters more than the calendar for many professional firms, because clients often come back for a new matter months or years apart. Second, the schedule is a floor. A trigger event always overrides it.

Deciding When To Re-Screen a Client

A schedule sets the minimum. Trigger events bring the check forward.

Four-step workflow for deciding when to re-screen a client. 1. Risk rating: low, medium or high from your client risk assessment. 2. Scheduled date: set the next re-screen from the rating. 3. Trigger check: re-screen now if any trigger event occurs. 4. Record: keep the new result beside the old one. A schedule sets the minimum; trigger events bring the check forward.

Figure 1. Illustrative re-screening workflow for a small firm. Your AML/CTF program sets the actual intervals.

Trigger events that should not wait

Build these into your intake and file-opening steps so they are caught without anyone needing to remember the schedule:

  • A new or different service. AUSTRAC gives the example of a client asking for a new service in a way that is different from the existing relationship. Treat any new matter as a prompt to re-screen.
  • Changes in ownership or control. New directors, shareholders, trustees or beneficial owners need screening in their own right.
  • Money from an unexpected source. Funds from a third party, a new country or a structure you do not recognise.
  • News about the client. Media reports of investigations, charges or regulatory action, which an adverse media check would surface.
  • A change in public role. The client or a close family member is elected, appointed to a senior government position or joins the board of a state-owned company.
  • Sanctions developments. New designations that relate to a country or sector your client is connected with.
  • Doubts about the file. Information that seems out of date, inconsistent or possibly false.

If a re-screen produces a potential match, review it in the same way as at onboarding, and consider whether a suspicious matter report is required.

Keep the history, not just the latest result

Each re-screen is part of your CDD records. Keep earlier results alongside the new one rather than overwriting them, so the file shows what you knew and when. AUSTRAC’s record keeping guidance requires CDD records to be kept for 7 years after the business relationship ends.

A worked example

Illustrative example. An accounting practice rated a family company low risk when it took on the company’s bookkeeping in 2026, with the next re-screen due in 2029. In early 2027, the company asks the practice to set up a new trust and a second company with an overseas shareholder. That is a new service delivered in a different way, so the practice treats it as a trigger: it screens the overseas shareholder and the new directors, reviews the client’s risk rating, and resets the next scheduled re-screen from the new rating.

When pay-as-you-go re-screening fits, and when it does not

For a small firm with a manageable client list, re-running a check at scheduled dates and trigger events is a practical way to meet the screening part of ongoing CDD, with a dated record each time. If you have a large client book or many high-risk clients, automated ongoing monitoring that alerts you to profile changes may suit you better. NameScan offers ongoing monitoring through its enterprise solution, MemberCheck.

Frequently asked questions

Is there a legal requirement to re-screen every year?

No single interval applies to every client. The AML/CTF Act requires ongoing CDD appropriate to the client’s risk, and your AML/CTF program should set the frequency. Many firms re-screen high-risk clients at least annually.

Do I need to re-screen if the client’s details have not changed?

Yes, at the frequency your program sets. Sanctions and PEP lists change even when your client does not, and AUSTRAC notes that sanctions listings change often.

What should I do if a re-screen finds a new PEP match?

Confirm whether it is a true match. If the client or a related person has become a foreign PEP, or a domestic or international organisation PEP where risk is high, review and update the KYC information and follow your program’s approval steps.

Should I re-screen before a large transaction?

It is sensible to re-screen before significant transactions, especially for higher-risk clients, so you are checking against the current sanctions list before money or property moves.

Do I need to keep old screening results?

Yes. Keep them with the client’s CDD records. Records generally need to be kept for 7 years after the business relationship ends.

How NameScan can help

NameScan lets small firms re-screen individuals and companies against PEP, sanctions, and adverse media data on a pay-as-you-go basis, one at a time or in batches, and record the decision for each result in the dashboard. That makes it straightforward to run scheduled and trigger-based checks and keep a dated history on file.

Keep your client screening current

Re-screen clients when your schedule or a trigger event calls for it, with a dated record each time.