KYC, KYB and CDD: What are they and what do they mean under Tranche 2?

If you’ve been following the rollout of Australia’s Tranche 2 AML/CTF reforms, you’ve probably heard the acronyms KYC, KYB, and CDD more than a few times. And while you’ve heard of them, do you know exactly what they mean and how they apply to your business and its processes?

For many property professionals, accountants, and lawyers, these concepts may not be entirely new. You may already be doing elements of them through Verification of Identity (VOI) or basic client onboarding. But Tranche 2 brings a new level of compliance and due diligence requirements. These checks will move from ‘good practice’ to legally required, and the way they’re done will need to meet specific, regulated standards.

This article breaks down these terms and looks at how they fit together, and what they might look like under the new rules, so you can be clear on what’s ahead before the industry-specific guidance is shared by AUSTRAC later this year.

What do KYC, KYB and CDD actually mean?

Customer Due Diligence (CDD)

CDD is the umbrella term for the process of identifying and verifying your customer, understanding the nature of your business relationship with them, and assessing their risk of being involved in money laundering or terrorism financing.

Under Tranche 2, CDD will become a core part of your AML/CTF program. It’s a step up from VOI. You’ll still need to carry out an identity check, but you will then also need to confirm you’re dealing with the beneficial owner of the transaction. In other words, you must take reasonable steps to identify the person ultimately “running the show” and ensure you understand their role and connection to the transaction.  This may not always be the person signing your paperwork.

Know Your Customer (KYC)

KYC is the part of CDD that deals with individuals. It’s about verifying a person’s identity and making sure the information they provide matches trusted, independent sources. KYC is already common in banking, but under Tranche 2, it will apply across newly regulated sectors, including real estate, legal, and accounting services.

Know Your Business (KYB)

KYB is the KYC-equivalent process for corporate clients. It involves verifying a company’s identity, confirming its registration details, identifying its beneficial owners (the individuals who ultimately own or control it), and ensuring you understand its structure and activities.

Where KYC might involve a driver’s licence and passport check, KYB could require ASIC searches, company constitutions, and verification of directors and shareholders.

How do KYC & KYB apply under Tranche 2?

Tranche 2 will extend AML/CTF obligations beyond the financial sector to include professions offering ‘designated services’, including:

• Real estate agents and conveyancers
• Lawyers
• Accountants and certain tax advisers

For all of these professions, CDD will be mandatory before providing a service that falls under the AML/CTF regime.

That means you’ll need to:

• Identify and verify your customer, using KYC for individuals and KYB for entities.
• Understand the purpose of the transaction, including why they’re engaging you and whether the activity makes sense for that customer profile.
• Assess and document risk, including any red flags that might indicate suspicious activity (and subsequently report that suspicious activity).
• Keep records, so you can demonstrate to AUSTRAC that you have complied.

Importantly, CDD isn’t just a “once-off” at the start of the relationship. Under the reforms, you’ll also need to update and review this information when there’s a material change in the relationship or when risk indicators arise.  

How does CDD differ from VOI?

For property professionals in particular, the concept of checking a client’s ID is not new. VOI (Verification of Identity) is already required in various forms under state-based land transaction rules. But VOI and CDD are not the same thing.

VOI is about confirming a person is who they say they are, using an acceptable form of identification for a land transaction. Once that’s done, the process is complete.

CDD goes further. It’s about understanding who the person is in a broader sense.  Looking at things like the purpose of the transaction, the source of their funds, and whether their activity poses a risk under AML/CTF laws.

Think of it like VOI being one piece of the CDD puzzle. It can be part of your KYC process, but it’s not enough on its own to meet CDD requirements. Under Tranche 2, relying solely on VOI will leave you non-compliant.

What does CDD look like in practice?

While we’re still waiting for detailed sector-by-sector guidance, the broad outline of CDD under Tranche 2 will likely include:

• Collecting identification information from individuals (KYC) or companies (KYB).
• Verifying that information using reliable and independent sources such as government databases, ASIC records, or accredited digital verification platforms. Simply taking a copy is not sufficient, since its authenticity has not been validated.
• Gathering additional context, such as the nature of the client’s business, the source of funds for a transaction, or the reason they’re seeking your services.
• Assigning a risk rating based on factors like geography, transaction size, or client profile.
• Ongoing monitoring, including keeping client information up to date and re-checking if circumstances change.

For many businesses, the practical challenge won’t just be knowing what to collect, but putting systems in place so it’s done consistently, securely, and without creating unnecessary friction for clients. This is where digital AML solutions can help.  A solution like easyAML streamlines the process, reduces errors, and keeps records organised for compliance reporting.

The bottom line when it comes to CDD

CDD is the overarching process.

KYC and KYB are its two main components, focused on individuals and businesses, respectively.

VOI is not CDD.

It’s a valuable tool, but under Tranche 2, you’ll need to go further to meet compliance obligations.

The focus is on risk, not just identity. 

You need to understand your customer and the purpose of the transaction.

Recordkeeping matters.

To AUSTRAC, being able to demonstrate compliance is as important as doing it.

Now is the time to get familiar with these terms and start thinking about how they’ll fit into your workflows. While sector-specific requirements are still to come, the fundamentals of CDD are well established and are unlikely to change significantly.

By understanding the building blocks now, you’ll be better prepared to adapt quickly when the final rules land.

Get ready for Tranche 2 the easy way.

Preparing for Tranche 2 doesn’t have to be overwhelming. easyAML is designed to make compliance straightforward for small and medium-sized businesses, without the complexity, without the exorbitant cost of multiple piecemeal solutions and without the BS.

Join our readiness list today at easyaml.com to stay updated with plain-English guidance as the reforms take shape, and be ready to hit the ground running in 2026.