Address Verification for AML/CTF: When and How

Under the AML/CTF regime, address verification is a risk-based decision, not a fixed step. For an individual customer, the AML/CTF Rules set no minimum list of KYC information, so what you collect and verify must suit that customer’s money laundering and terrorism financing (ML/TF) risk. AUSTRAC’s guidance says you could collect a residential address, and it gives verifying name and date of birth as its example. Sole traders and trusts are different, because the Rules require the principal place of business. When an address does not match, you do not ignore it and you do not reject the customer automatically. You resolve it with a reliable, independent document, then record the mismatch and the fix.

This guide is for principals and compliance officers at real estate agencies, buyers agents, conveyancers, law firms, accounting practices and trust and company service providers. These Tranche 2 obligations commenced on 1 July 2026 and are in force.

TL;DR

• For individuals, the AML/CTF Rules set no minimum KYC list. What you collect and verify, including address, must be proportionate to the customer’s assessed risk (section 28(3)(c) and (d)).
• AUSTRAC says a residential address is something you could collect so you can tell one customer from others with a similar name and details. Its worked example of verification is name and date of birth.
• Sole traders and trusts differ: the Rules require the principal place of business (Rules 6-1 and 6-3). For a trust not run as a business, that is often a trustee’s home.
• Acceptable sources are an ID document showing the address, or a secondary document showing name and address, such as a utility bill or government notice.
• A mismatch is a prompt to resolve and document, not a reason to stop. Record what differed, what you used to resolve it, and who approved it.

Table of Contents

• What address verification means in AML/CTF customer due diligence
• When you should verify an address
• Individuals, sole traders and trusts: whose address do you need?
• What counts as acceptable proof of address
• Handling an address mismatch
• Keeping address checks audit-ready
• Our perspective
• Putting it into practice with AML Guard
• FAQ
• Sources

What address verification means in AML/CTF customer due diligence

Address verification is one part of initial customer due diligence (CDD). Its purpose is the same as the rest of CDD: to establish that the customer exists and is the person they claim to be, using information that is reliable and independent. AUSTRAC’s initial CDD guidance for individuals expects you to collect enough information, which can include a residential address, to distinguish an individual from others with the same or similar name and details.

Two points follow from that wording.

First, an address is a tool for distinguishing people. A common name and a common date of birth can describe several people. A residential address can help separate them. That is the reason to collect it, and it is also the test for whether you need to verify it.

Second, the Rules do not prescribe an address check for every individual. They require you to scale information collection and verification to risk. An agency that applies the same address check to every customer regardless of risk has made a policy choice, not met a rule. An agency that applies no address step to anyone, without a risk-based reason recorded in its program, has a gap a supervisor will notice.

When you should verify an address

Initial CDD is generally completed before you provide a designated service, subject to the delayed CDD circumstances your program allows for. Address collection and any verification belong in that same window, so the information is on file before the engagement proceeds, not after settlement.

A practical way to decide is to work from the customer’s risk rating. AUSTRAC’s real estate program starter kit rates customers low, medium or high. High-risk customers receive enhanced CDD, and simplified CDD is not appropriate for medium-risk customers. Mapped to address work, that gives you a sensible pattern:

This table is a way of applying the principle, not a rule from the Rules. Your own AML/CTF program sets the detail, and your business-wide risk assessment should explain why. For the triggers that move a customer into enhanced CDD, see our guide to enhanced due diligence in Australia.

Simplified CDD is not an address exemption

Readers often ask how simplified due diligence (SDD) compares with CDD. SDD streamlines identification and verification for certain low-risk customers, but only where your program provides for it and enhanced CDD is not required. AUSTRAC’s overview of initial CDD is clear that it is not an exemption: you must still collect the required KYC information and enough information to identify risk and establish the relevant matters on reasonable grounds.

In practice, SDD may mean you verify less, but not that you collect nothing. If your program lets low-risk customers go through SDD, write down what the lighter touch is for address, and apply it consistently.

Individuals, sole traders and trusts: whose address do you need?

The address you need depends on who the customer is.

Individuals. The residential address is the usual starting point. The Rules set no minimum list, so the amount of verification is a judgement tied to risk under section 28(3)(c) and (d).

Sole traders. The Rules require the principal place of business (Rules 6-1 and 6-3). This is not necessarily the person’s home, although for a sole trader working from home it may be the same place. Collect the business address as the Rules require, and consider whether the individual’s residential address is also useful for distinguishing them from others.

Trusts. Rules 6-3 requires the address of the trust’s principal place of business or operations. AUSTRAC’s guidance for trusts says that where a trust does not operate as a business, this is usually the place from which it is administered, which will often be the residential address of each trustee. The same guidance leaves the principal place of business out of the details it suggests you verify, so for a trust the address is usually collected and recorded rather than checked against a document. Where the trustee is a company, its own CDD runs on its own details.

Companies. Company records give a registered office and a principal place of business, and these can differ. Record which one you collected and why.

For how the wider CDD process runs across customer types, see Tranche 2 customer due diligence in Australia.

What counts as acceptable proof of address

AUSTRAC’s guidance for individuals sets out two routes. The acceptable documents to verify identity and address include:

1. A primary photographic ID document, such as a driver’s licence or passport. Where the document shows an address, it can serve for the address as well.
2. A combination of primary non-photographic ID, such as a birth certificate, and secondary identification showing name and address, such as a utility bill or a government notice.

So there are two source types for address: an ID document that shows it, or a secondary document that shows name and address. A passport does not usually show a residential address, which is why a second document often does the work when the address matters.

Three habits keep this clean:

• Use independent, reliable documents. The aim is data that does not simply come from the customer’s own say-so.
• Match the document to the question. If you need the residential address, pick a document that shows it. If you need a principal place of business, a utility bill in the owner’s name at home will not answer it.
• Do not invent a recency window. The Rules and AUSTRAC’s guidance quoted here do not set a number of days or months a document must be dated within. Your program can set an internal standard, but present it as your own policy, not as AUSTRAC’s requirement, and keep it tied to risk.

Handling an address mismatch

A mismatch means the address the customer gave differs from the address on a document, or two documents disagree. It is common, and most mismatches have ordinary explanations.

AUSTRAC’s own example captures the usual case: the driver’s licence shows an old address, the customer has just moved, and a recent utility bill resolves it. Licences are not always updated promptly after a move, so a difference between the licence and the stated address does not by itself signal fraud.

A workable process:

1. Note the difference. Record exactly which two sources disagree and what each says.
2. Ask the customer for the reason. Moving house is the usual answer. Ask in a neutral way and write down what they say.
3. Seek a document that resolves it. A secondary document showing name and current address, such as a utility bill or government notice, is the standard fix.
4. Consider the risk. An explained, low-risk mismatch can close quickly. An unexplained one, or one that appears alongside other concerns such as a foreign address with unusual funding, may move the customer into a higher risk tier and enhanced CDD.
5. Record the mismatch and the fix. Write what differed, what resolved it, who decided, and when.
6. Escalate when it cannot be resolved. If you cannot establish who the customer is on reasonable grounds, your program should say what happens next, including whether to pause the service and whether a suspicious matter report needs to be considered.

The point of step 5 is that the file should let a supervisor retrace your reasoning without asking you. “Address differed, new utility bill supplied, resolved” is a complete and defensible entry.

When the customer lacks standard ID

Some customers, such as people who have recently arrived, are experiencing homelessness or are escaping family violence, cannot easily produce a document showing a current address. AUSTRAC’s page on identifying individuals who don’t have standard ID says that where a customer cannot obtain or access standard identification, or has inconsistent details, you may use alternative identification after identifying and mitigating the associated ML/TF risks.

The same AUSTRAC page lists alternatives such as referee statements and recently expired identification, and allows an individual’s self-attestation of their identity as a last resort, where you cannot establish their identity any other way. This is how you keep legitimate customers inside the system without lowering the standard. Write the alternative route into your program before you need it, and record the risk reasoning each time you use it.

Keeping address checks audit-ready

Address verification only protects you if the record shows what you did. AUSTRAC’s record keeping overview expects full and accurate records that demonstrate compliance: the customer information collected, the verification steps, and the rationale for risk assessments. These must be kept for 7 years after the end of the business relationship or the completion of an occasional transaction. Our guide to AML record keeping and the seven-year clocks explains how those periods start.

For each address check, a file should show:

• the address as the customer stated it;
• the document or documents used, and what each showed;
• whether they matched, and if not, the mismatch and the explanation;
• the document that resolved it;
• the customer’s risk rating and the reason the level of verification was proportionate;
• the name of the person who approved it and the date.

Address documents also contain personal information, so collect what you need and protect it. Our note on privacy and AML/CTF for Tranche 2 covers that balance.

Our perspective

We see address verification handled inconsistently more often than any other part of customer checks. One agency collects a utility bill from everyone. Another collects nothing and relies on a licence. Neither can explain why, and that is the weakness. The Rules ask for a decision tied to risk, and a decision only counts if it is written down.

That is why we built AML Guard so that each identity check is recorded in one case record. The address stated, the documents captured, any mismatch, the fix and the officer’s approval sit together, rather than across email threads, photos and a spreadsheet. The record shows the level of address verification you chose and why.

AML Guard’s guided wizards also produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so what your policies say about address checks starts from the risks you assessed. We automate the lookups and the record keeping, not the decisions: an officer still approves each determination, because judging whether a mismatch is innocent is a human call.

AML Guard

Putting it into practice with AML Guard

AML Guard is an Australian AML/CTF compliance platform for Tranche 2 reporting entities. It keeps one case record holding each identity check, screening result and officer decision, with ACN-based beneficial ownership determination and an officer approving each one.

AML Guard is not self-service; every firm starts with a demo. Book a demo, or see the pricing page for the subscription and per-check fees.

FAQ

Do I have to verify the address of every individual customer?

No rule requires it for every individual. The AML/CTF Rules set no minimum KYC list for individuals, so what you collect and verify must suit the customer’s risk. AUSTRAC’s guidance says you could collect a residential address and gives name and date of birth as its verification example. Whatever you decide, write the reasoning into your program.

What is acceptable proof of address?

An ID document that shows the address, such as a driver’s licence, or a secondary document showing name and address, such as a utility bill or a government notice. Secondary documents are used alongside primary non-photographic ID where there is no photographic ID. There is no fixed recency window in the guidance, so any age limit you set is your own policy.

What should I do if the address on a licence differs from the one the customer gives?

Ask why, and look for a document that resolves it. AUSTRAC’s example is a customer who has just moved, where a recent utility bill settles the difference. Record the mismatch and the fix. If the explanation is not credible or other risk signs appear, consider enhanced CDD.

How is simplified due diligence different from CDD?

Simplified CDD is a lighter form of CDD for low-risk customers, available only where your program provides for it and enhanced CDD is not required. It is not an exemption: you still collect the required KYC information and enough to identify risk. It is not appropriate for medium-risk customers.

Which address do I need for a trust or sole trader?

The Rules require the principal place of business (Rules 6-1 and 6-3). For a trust that is not run as a business, that is often a trustee’s home. Record which address you collected and what it represents.

Sources

• Initial CDD for individuals, AUSTRAC
• Step 2: Use your real estate program, AUSTRAC
• Overview of initial customer due diligence, AUSTRAC
• Identifying individuals who don’t have standard ID, AUSTRAC
• Initial CDD for trusts, AUSTRAC
• Record keeping overview, AUSTRAC

Recommended

• Client Can’t Provide ID? AML/CTF Options
• Reducing False Positives in AML Screening
• Counterparty due diligence under the AML/CTF Act
• AML False Positives & Data Quality. The Fix Starts at Intake.