My Client Refuses to Complete AML Checks. What Can I Do?

“I’ve been your client for 15 years. Why do you need my ID now?”, “I’m not uploading my passport to some website.”, “Why do you need to know where my money came from? That’s none of your business.”  Since Tranche 2 commenced, conversations like these have become increasingly familiar.  Most clients likely complete your AML checks without an issue.  But, occasionally, someone will push back.  And when they do, it can put your business (and your staff) in an uncomfortable position.

No one wants to frustrate a long-standing client.  Nor do you want to make them feel as though they're being accused of something illegal. But you also can't simply decide to skip your AML obligations just because a customer doesn't want to participate.  So, what can you actually do?

Start by understanding why they're refusing

A client pushing back on AML checks isn't necessarily a red flag in itself.  There could (likely) be a perfectly reasonable explanation. Some people are uncomfortable uploading identity documents online.  In today’s modern world, others may be concerned about scams and identity theft. A long-standing client might be offended or even just confused that you're asking them to prove who they are after working together for years.  And then there are those who simply don't understand why their lawyer, accountant or real estate agent suddenly needs information they've never been asked to provide before.

Before treating a client’s refusal as suspicious, make sure you take the time to understand the reason behind it.  Sometimes a simple explanation from the client is enough to resolve the problem.

Explain that it's legislation, not a business policy

How you explain AML checks can make a big difference.  Some businesses we speak to feel like they can’t discuss AML requirements openly with customers because of the tipping off provisions.  As a result, they might think it’s safer to be vague, telling customers that the checks are simply a new internal policy.  But tipping off rules don’t prevent you from explaining your general AML/CTF obligations (or why you need to conduct CDD).  So, rather than saying, ‘It's our new policy that everyone has to do this’, you can specify that your entire industry is now regulated under Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) legislation through AUSTRAC.  Explain that all businesses like yours which provide certain designated services are legally required to complete Customer Due Diligence.  And, even if they were to go elsewhere, they would need to complete the same checks with their new provider.

Remember that initial CDD involves more than simply obtaining a driver's licence. For each customer, you need to: 

• Establish their identity
• Identify people acting on their behalf or any beneficial owners (if applicable)
• Understand the nature and purpose of the relationship 
• Assess the customer's ML/TF risk.

In most cases, AUSTRAC requires you to establish these things on reasonable grounds before you start providing a designated service.  That means you don't have discretion to simply waive the process for a ‘good’ client.  Explain this to your client.  It can also help to reassure clients that completing AML checks doesn't mean you consider them suspicious. CDD is now a standard compliance requirement that applies to every single customer engaging you for that same service.

Find out what they're actually objecting to

There's also an important difference between a client refusing to complete their CDD and a client refusing to complete it in the particular way you've offered.  Perhaps they don't want to use an electronic identity verification platform.  Subject to your AML/CTF Program and the circumstances, there may be another compliant method available. For example, you might be able to verify information face-to-face without a digital ID check, and conduct their PEPs and Sanctions screenings manually. 

Similarly, someone who doesn't have standard identification documents isn't automatically excluded from receiving services. AUSTRAC provides detailed guidance on alternative identification procedures where a person genuinely cannot conform to the standard ID requirements.

The requirement is to comply with your CDD obligations, but that’s not to say that every customer needs to go through one identical process.

What if your client still refuses?

There does come a point where you may simply be unable to proceed.  AUSTRAC's position on initial CDD is clear: if you cannot establish the required matters on reasonable grounds, you must not start providing the customer with the designated service.

There are limited circumstances where initial CDD can be delayed, subject to specific requirements. Don’t mistake these for a workaround for a customer who simply doesn't want to comply.  So if you've explained why the information is required and considered reasonable alternatives, but the customer still refuses to provide you what you need?  Well, you may have no choice but to decline to provide the designated service.

For existing customers, the position can be more nuanced.  Ongoing CDD obligations apply throughout your relationship. If updated information or additional checks are required and the customer refuses to cooperate, you'll need to consider the circumstances as well as your AML/CTF Program and the risks involved in continuing to provide designated services.  Depending on what you identify, your response could include any or all of:

• Updating the customer's risk assessment
• Applying ECDD
• Escalating the matter internally 
• Considering whether to submit an SMR

Does refusing AML checks make the client suspicious?

Not automatically.  AUSTRAC identifies refusing to provide information during CDD as an example of behaviour that may be unusual. Reluctance or refusal to provide identification information is also listed among its common indicators of suspicious activity.  However, the context around the client’s refusal is important.

One indicator on its own may not amount to suspicious activity. There may be a legitimate explanation.  A client saying, “I don't trust links asking me to upload my passport because I've recently been targeted by scammers” is very different from someone repeatedly providing inconsistent identity information, refusing to explain who they're acting for and becoming evasive when asked about unexplained third-party funds.

You don’t need to label the client as suspicious just because they said no.  Instead, stop and consider the behaviour alongside everything else you know.  Then, you can decide what, if anything, it means for their ML/TF risk.  If the circumstances ultimately give you reasonable grounds for suspicion, you may decide that it is warranted to lodge an SMR.

Document the interaction

Whatever the outcome, this is exactly the kind of interaction you need to document.  Rather than simply writing: “Client refused AML”, capture enough context that someone reviewing the file later can understand what happened.  

For example:

“Customer advised they were unwilling to complete electronic identity verification due to concerns about uploading ID documents online. Explained that CDD is required under AML/CTF legislation. Discussed alternative verification methods available under our AML/CTF Program. Customer agreed to complete verification using that process. Identity subsequently established on reasonable grounds. No other unusual behaviour identified.”

Or, where the client continues to refuse:

“Customer declined to provide information needed to complete initial CDD.  Gave explanation of our AML/CTF obligations and the alternative verification options available. Unable to complete CDD to determine risk on reasonable grounds. Matter escalated to Compliance Officer. Decision made not to commence designated service and SMR has been lodged.”

The documents and correspondence show what happened. Your note explains what you did about it and why.  We have written a couple of more detailed blogs recently which look at evidence and file notes.  You can read them here and here.

It doesn’t need to be confrontational

Perhaps the most important thing to remember is that AML compliance doesn't need to become a confrontation.  Most clients aren't refusing because they're trying to launder money.  They're more often confused, frustrated or concerned about privacy.  A simple, calm explanation will often solve the problem.  But where it doesn't, your obligations don't disappear.  Assess the behaviour in context, and where appropriate, escalate it to your Compliance Officer.  And above all, be sure to document the events as well as your reasoning behind whatever decisions you make.

A great analogy we have found that makes sense to consumers is likening AML checks to going on a flight.  Nobody likes going through security, taking off their shoes and emptying their pockets.  But we do it, because we know it's for our safety, and that of our community.  AML is the same thing.  It is keeping our country and our people safer from the crimes associated with money laundering and terrorism financing.  When they understand it like this, you’ll find that many of your clients will relax their attitude and be more willing to comply with your requests.

And, at the end of the day, sometimes the answer really is:

“I understand you'd prefer not to complete these checks, but unfortunately, without them, we're legally unable to provide this service.”

This is also where having flexible verification options can make a real difference. With easyAML, you're not limited to sending customers a link and hoping they can complete the process themselves. Our in-house Verification of Identity functionality allows your team to complete face-to-face VOI checks, which can be particularly helpful for clients who aren't confident with technology, struggle with online verification or are uncomfortable completing the process independently.

Sometimes, a little personal assistance is all it takes to turn a frustrating experience into a straightforward one.  If you’re ready to make AML compliance easier for your team and your customers, get started with easyAML for free today!