When should you re-verify an existing client?

One of the biggest sources of confusion we’re seeing as businesses settle into Tranche 2 compliance is how to deal with existing clients. On top of that, there is a misconception that customer due diligence (CDD) ends once you've verified your client's identity. In reality, AML/CTF compliance doesn't stop at onboarding, and your existing clients are still impacted by the new regime (even if their transaction commenced prior to 1 July 2026).

AML compliance for the duration of your business relationship with that particular customer is known as ongoing customer due diligence (ongoing CDD). Ongoing CDD is one of the key differences between traditional identity verification (that some Tranche2-impacted industries may be used to) and Australia’s new AML/CTF framework.

So, when should you re-verify an existing customer? What happens if they've been a client for years? And what exactly is a pre-commencement customer?

Ongoing customer due diligence isn't about checking ID again

When people hear the phrase "ongoing customer due diligence", they often assume it means asking clients to provide their passport or driver's licence every time they instruct you. Fortunately (for both practitioners and clients), that's not what AUSTRAC expects. Instead, ongoing CDD is about asking a much broader question: Does what I'm seeing today still align with the customer and risk profile I originally assessed?

Your understanding of a client shouldn't remain static. As their circumstances, transactions or behaviour change, you should continue considering whether your original assessment is still accurate. Oftentimes, the answer will be yes, and no further action is required. However in other cases, those changes may warrant asking additional questions, updating the information you hold on the customer or undertaking further due diligence.

What is a pre-commencement customer?

Another concept that has generated plenty of questions is the idea of a pre-commencement customer. A pre-commencement customer is someone who became your customer for a particular transaction before your AML/CTF obligations commenced on 1 July 2026. In developing the Tranche 2 framework, AUSTRAC recognised that many businesses already have in-flight transactions and don't necessarily need to stop everything and immediately re-identify every existing client on day one.

However, being a pre-commencement customer doesn't mean they are permanently exempt from AML/CTF obligations. As your relationship with that customer continues, you still need to consider whether circumstances have changed to the point where further customer due diligence is appropriate. This is where ongoing monitoring becomes so important.

If you commence a new transaction for that customer post-1 July 2026, you will also need to conduct initial CDD, at which point the client will no longer be considered a pre-commencement customer.

What you’re looking for in your ongoing monitoring

Unlike an initial CDD, ongoing monitoring is about identifying changes in circumstances rather than simply the passage of time. Once any of these changes have been identified, you may need to update and/or reverify your Know Your Customer (KYC) information held for that client. Some common examples which you might identify as part of your ongoing monitoring of existing clients, include:

A significant change in ownership

If you're acting for a company and its ownership structure changes substantially, you may need to revisit beneficial ownership information to ensure it remains accurate. If new Ultimate Beneficial Owners (UBOs) are identified, you will need to conduct KYC on those new parties.

A new authorised representative

Perhaps a different director, trustee or attorney begins acting on behalf of an existing client. Before relying on their instructions, you may need to verify their authority and identity.

The customer's risk profile changes

Perhaps your real estate client initially purchased residential property locally but is now purchasing commercial property through a complex trust structure with overseas beneficiaries Or your accounting client begins requesting services that were never part of your original engagement. These changes don't necessarily indicate wrongdoing, but they may justify a fresh look at the customer's risk profile.

Unusual or unexpected transactions

One of the purposes of ongoing monitoring is identifying activity that doesn't align with what you originally understood about your client. For example:

• A conveyancing client unexpectedly introduces funds from overseas.
• A lawyer is instructed to establish multiple entities with no obvious commercial purpose.
• A precious metals dealer sees a long-term customer suddenly making significantly larger purchases than usual.

Again, none of these automatically suggest criminal activity. However, under the ongoing monitoring requirements, you are expected to acknowledge this, and take reasonable steps to respond to the updated risk profile for that client or transaction.

Your existing information is no longer reliable

If you have a long-standing business relationship, you may find that documents previously relied upon have now become outdated. Or perhaps information you've obtained from another source suggests something has changed. If you can no longer reasonably rely on the information you hold, further due diligence may be appropriate.

Ongoing monitoring seeks to understand change

One of the simplest ways to think about ongoing monitoring is this: You're not continually checking who your customer is. Instead, you're checking whether the customer you continue acting for is still the same customer you originally assessed.

• Has their ownership changed?
• Has their business changed?
• Has the nature or purpose of the relationship changed?
• Has the transaction become more complex?
• Has the level of risk increased?

These are the questions that ongoing CDD is designed to answer.

What should you do if something changes?

Noticing or finding a change in your client or the transaction doesn't automatically mean you must stop acting. It simply means you should exercise reasonable judgement to determine whether additional due diligence is required. Depending on the circumstances, your response to new or unusual transactions or behaviour may include:

• Updating customer identification (KYC) records
• Confirming beneficial ownership
• Asking additional questions about the transaction
• Obtaining Source of Funds or Source of Wealth information
• Requesting further supporting documentation or undertaking Enhanced Customer Due Diligence where appropriate
• Increasing the level of ongoing monitoring.

The response should always be proportionate to the level of risk you've identified.

The human element still matters

Technology, like easyAML, can help identify trigger events. It can remind you when reviews are due under your AML/CTF Program, and it can flag changes in customer information or highlight transactions that warrant closer attention. But it can't make professional judgement calls for you. Your business still needs to decide whether the information available is sufficient to reasonably satisfy itself that the money laundering and terrorism financing risks have been appropriately managed.

Don't forget to document your decisions

Regardless of whether you decide additional due diligence is required or perhaps determine that no further action is necessary, your reasoning should be documented. Good AML recordkeeping should explain what change was identified, what enquiries were made (and the information obtained as a result), as well as what decision was made (why and by whom). If AUSTRAC ever reviews your business, demonstrating how you reached your decision is arguably just as important as the decision itself.

How easyAML supports ongoing customer due diligence

Managing ongoing CDD manually can quickly become difficult, particularly for businesses with hundreds or even thousands of active clients. It's easy to lose track of changing circumstances, review dates and documentation spread across multiple systems or spreadsheets. easyAML helps businesses just like yours stay on top of ongoing customer due diligence by bringing customer information, risk assessments, ongoing monitoring and compliance records together in one place.

The easyAML platform helps identify changes that may warrant further attention, supports Enhanced Customer Due Diligence, and creates a complete audit trail of the decisions your business has made over time. Ultimately, it supports you in making sure the customer you continue acting for is still the customer you originally assessed (and enables you to demonstrate that you've taken reasonable steps whenever circumstances change).

Get started with easyAML for free today. There are no lock-in contracts, no credit card required and no commitments.