Enhanced due diligence in Australia: triggers

You must apply enhanced customer due diligence when one of the triggers in section 32 of the AML/CTF Act applies: the customer’s ML/TF risk is high, a suspicious matter reporting obligation has arisen and you propose to continue the service, a foreign politically exposed person is involved, or a relevant person is in, or formed in, a jurisdiction the FATF has called for enhanced due diligence on. Two narrower triggers cover nested services relationships and, under the Rules, unusual services. Medium risk does not trigger it. Measures must be appropriate to the risk identified, not a fixed checklist applied in the same way to every file.

TL;DR:

• Domestic and international organisation politically exposed persons call for enhanced CDD only where the risk is high; a foreign politically exposed person always does.
• Rules 6-20 adds unusual services (no apparent economic or legal purpose, unusually complex or large transactions, an unusual pattern); nested services relationships, the other narrow trigger, arise only between remitters, virtual asset service providers and financial institutions.
• Where enhanced CDD applies because the risk is high, an SMR obligation arose or a FATF jurisdiction is involved, establish source of funds and wealth where relevant to the risk; for a foreign PEP, or a high-risk domestic or international organisation PEP, establish the PEP’s own.
• Use independent sources for added identity checks, increase sanctions, politically exposed person, and adverse media screening, and review transaction patterns more closely as risk warrants.
• Record the trigger, evidence and verification sources, officer approval and reasoning, decision, and monitoring schedule; retain due diligence records for at least seven years.

Table of Contents

• When you must apply enhanced CDD: statutory triggers and common high-risk scenarios
• Enhanced CDD measures you can apply, and how to scale them to risk
• Specific measures required in defined circumstances
• Recording enhanced CDD: approvals, retention and audit readiness
• Embedding enhanced CDD in your AML/CTF program and policies
• Practical step-by-step checklist when enhanced CDD is needed
• Our view on operationalising enhanced CDD
• How AML Guard supports your enhanced CDD obligations
• FAQ
• Sources

When you must apply enhanced CDD: statutory triggers and common high-risk scenarios

Section 32 sets out the triggers precisely, and we quote them because practitioners often paraphrase them loosely: enhanced CDD is required where the customer’s ML/TF risk is high; a suspicious matter reporting obligation has arisen and you propose to continue providing the service; the customer, a beneficial owner, a person on whose behalf the service is received, or a person acting on behalf of the customer is a foreign politically exposed person; or any of them is physically present in, or formed in, a jurisdiction the FATF has called for enhanced due diligence on. Section 32 also covers a service provided as part of a nested services relationship, which arises only between remitters, virtual asset service providers and financial institutions, and customers of a kind the Rules specify: for these sectors, Rules 6-20 adds a customer who requests unusual services.

Domestic PEPs and international organisation PEPs sit differently to foreign PEPs: they require enhanced CDD only where the customer’s ML/TF risk is high. The head of a local council, or of a state agency with a prominent public function, is a domestic PEP and is not automatically enhanced CDD territory; a foreign government minister is, as a matter of law, regardless of your own risk rating. AUSTRAC’s PEP guidance lists who falls in each group.

Common scenarios that should prompt you to check against these triggers:

• A buyer’s funds arrive through several intermediary accounts with no clear commercial reason for the structure.
• A trust or company client has a nested ownership chain that obscures who ultimately controls the entity.
• A party to a conveyancing or real estate transaction is physically present in, or a company or trust was formed in, a jurisdiction the FATF has called for enhanced due diligence on (its call-for-action list, not the wider list of jurisdictions under increased monitoring).
• A customer’s stated occupation or income does not plausibly support the transaction value.

Enhanced CDD measures you can apply, and how to scale them to risk

Once a trigger is confirmed, the Act does not prescribe a single response. AUSTRAC’s enhanced CDD guidance expects measures that are targeted, proportionate and effective, which means the depth of your enquiry should track the seriousness of the risk rather than a template.

1. Collect additional KYC information and re-verify identity against an independent source, such as a second government-issued document or a credit bureau check, and record exactly which sources you used.
2. Where relevant to the risk, make reasonable enquiries into source of funds and source of wealth, distinguishing the money used for this transaction from the customer’s broader financial history.
3. Increase the frequency and depth of ongoing monitoring, including more frequent sanctions, PEP and adverse media re-screening and closer review of transaction patterns.
4. Escalate findings that raise concern to your AML/CTF compliance officer for a documented decision on whether to continue, limit or cease the service.

In conveyancing, this might mean asking for bank statements covering the deposit source rather than accepting a solicitor’s letter alone. For a trust client, it might mean verifying the settlor’s and trustee’s own source of wealth where the structure itself is flagged as higher risk. For a company client with layered shareholdings, it means tracing beneficial ownership back to the natural persons who ultimately control it, not stopping at the first corporate layer.

Pro Tip: Keep a short written rationale on file for why you chose a particular depth of enquiry: it is the single detail that turns a defensible decision into one a supervisor has to take on faith.

Specific measures required in defined circumstances

Some enhanced measures are not discretionary once a trigger applies. Rules 6-21 and 6-23 set out when source of funds and source of wealth enquiries move from good practice to a requirement.

• Rules 6-21 requires you to establish the customer’s source of wealth and source of funds on reasonable grounds, where enhanced CDD applies because the risk is high, an SMR obligation has arisen or a FATF call-for-action jurisdiction is involved, and the matter is relevant to the nature of the risk.
• Rules 6-23 requires you to establish the PEP’s own source of wealth and source of funds where a foreign PEP is involved, or a domestic or international organisation PEP where the customer’s risk is high.
• In practice, establishing a matter on reasonable grounds calls for evidence proportionate to the risk, not exhaustive proof: a payslip and bank statement may be enough where the concern is limited, while a complex offshore structure may warrant professional advice or independent verification.
• Unusual services (Rules 6-20) call for enhanced CDD whatever the customer’s apparent profile. Nested services relationships are a separate trigger in section 32(e), limited to remitters, virtual asset service providers and financial institutions, so they rarely arise for professional firms.

Recording enhanced CDD: approvals, retention and audit readiness

What you write down matters as much as what you do. Your file should show the trigger that applied, why enhanced CDD was applied, the evidence collected, the verification methods used, whether a suspicious matter report was submitted, and the decision to continue, limit or cease the service.

• Record which section 32 trigger applied and the date it was identified.
• Record the specific measures taken and the independent sources used to verify them.
• Record the approval and the approver’s reasoning before the service proceeds: a senior manager’s where a foreign PEP, or a high-risk domestic or international organisation PEP, is involved (Rules 5-5), and the compliance officer’s otherwise, as good practice.
• Record the monitoring cadence set for the file going forward.

The Act’s record-keeping minimum is seven years. Section 111 requires CDD records, including records of any analysis, risk assessment or decision-making, to be kept for seven years after the business relationship ends or the occasional transaction is completed. AML Guard’s audit trail holds them for 8 years, above the Act’s seven-year minimum.

AUSTRAC’s enhanced CDD guidance expects your policies to set out when you will apply different measures, who is responsible for applying them, how you will review their effectiveness and how you will manage tipping off, so a reviewer can reconstruct a decision without asking you to explain it from memory.

Embedding enhanced CDD in your AML/CTF program and policies

Enhanced CDD cannot sit as a standalone habit; it has to be written into the program itself.

1. Your AML/CTF policies, required under section 26F, must set out the procedures staff follow when a trigger is identified, including who approves the decision and how it is recorded.
2. Those policies must connect to your business-wide ML/TF risk assessment, which under section 26C covers proliferation financing as well as money laundering and terrorism financing.
3. Staff training needs to cover how to spot a trigger in practice, an independent evaluation should periodically test whether the policy is actually being followed, and a compliance calendar should schedule re-screening and file reviews.
4. In real estate, Rules 6-32 lets CDD on some parties finish after the service starts, but delay under section 29 needs the added risk to be low, so a file that triggers enhanced CDD is a poor candidate for it.

A risk assessment, a set of policies and a training manual that were each built separately tend to drift apart over time. When they are built as one linked exercise, your enhanced CDD decisions trace back to a documented risk category instead of an officer’s memory of a similar past file.

Practical step-by-step checklist when enhanced CDD is needed

1. Identify every relevant person: the customer, any beneficial owners, anyone receiving the benefit of the service, and anyone acting on the customer’s behalf.
2. Confirm which section 32 trigger applies and note it on the file before collecting further evidence.
3. Collect and verify additional documents from independent sources, and complete source of funds or source of wealth enquiries where Rules 6-21 or 6-23 apply.
4. Re-screen for sanctions, PEP status and adverse media, checking the DFAT Consolidated List for any targeted financial sanctions exposure.
5. Put the decision for approval, to a senior manager where a PEP requires it (Rules 5-5) and otherwise to your AML/CTF compliance officer, with the reasoning recorded; then set the ongoing monitoring cadence or escalate to cease the service if the risk is unacceptable.

Pro Tip: Build the DFAT sanctions check into step four every time, not just when a jurisdiction trigger is obvious: a strict liability sanctions breach carries consequences that dwarf a missed enhanced CDD step elsewhere in the file.

For a broader walkthrough of how enhanced measures fit into standard CDD obligations, our customer due diligence guidance covers the initial verification steps that precede these triggers. Agents preparing listings also face questions outside AML, covered in guides such as floor plan measurement standards Australia.

Our view on operationalising enhanced CDD

The gap between knowing the triggers and defending a decision later is almost always a documentation gap, not a legal one. Our software captures enhanced CDD triggers and the measures taken against each file, with an officer’s approval, so the reasoning exists at the time the decision is made rather than being reconstructed under supervisory pressure.

Linked program artefacts matter here too. When a risk assessment, policies and a training manual are linked, an enhanced CDD decision traces cleanly back to a documented risk category instead of sitting as an isolated judgement call.

How AML Guard supports your enhanced CDD obligations

Enhanced CDD becomes far easier to defend when the paperwork behind it already matches your actual workflow, rather than being assembled after the fact from scattered notes.

The platform supports identity verification with document capture and biometric liveness, sanctions and PEP screening with ongoing re-screening, and an officer approval step before any CDD determination proceeds, with every trigger, measure and approval recorded against the file in an 8-year tamper-evident audit trail.

• Guided wizards produce linked risk assessment, policies, compliance action plan and training manual from one set of answers.
• Beneficial ownership determination runs on a company’s ACN; a trust or SMSF with a corporate trustee is reached through that company’s own determination.
• A transaction party can pay for their own check, and each eligible CDD check fee earns a credit against that calendar month’s subscription, capped at the subscription fee.

If your firm handles real estate, legal, accounting or trust and company services under Tranche 2, you can see how the workflow applies to your files by booking a demo, or review plans on our pricing page.

FAQ

What triggers enhanced CDD?

Enhanced CDD is triggered under section 32 of the AML/CTF Act when the customer’s ML/TF risk is high, a suspicious matter reporting obligation has arisen and you propose to continue the service, a foreign PEP is involved, or a relevant person is in or formed in a jurisdiction the FATF has called for enhanced due diligence on. Nested services relationships and unusual services (Rules 6-20) are narrower triggers. Medium risk alone does not trigger the obligation.

What are the changes in the AML update for 2026?

Tranche 2 obligations for real estate, legal, accounting, and trust and company service providers are now in force, bringing these sectors under the same CDD and reporting duties as existing reporting entities. The Department of Home Affairs notes that the reforms clarified when enhanced CDD must be applied in higher risk situations, and it can arise in initial or ongoing CDD.

What falls under enhanced due diligence?

Enhanced due diligence covers additional identity verification from independent sources, source of funds and source of wealth enquiries where relevant under Rules 6-21 and 6-23, and increased ongoing monitoring including more frequent sanctions and PEP re-screening. The measures must be appropriate to the customer’s ML/TF risk, rather than a single fixed set of steps for every file.

When must you do enhanced due diligence?

You must apply enhanced CDD as soon as one of the section 32 triggers is identified, which can happen during initial onboarding or at any point during an ongoing customer relationship. It is also required where you have a suspicious matter reporting obligation and intend to keep providing the service; the SMR itself is still due on time, even if enhanced CDD is not finished.

Sources

• Enhanced customer due diligence | AUSTRAC
• Anti‑Money Laundering and Counter‑Terrorism Financing Rules 2025
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
• Changes to customer due diligence | Department of Home Affairs
• Politically exposed persons | AUSTRAC
• Consolidated List | Australian Sanctions Office (DFAT)

Recommended

• Tranche 2 customer due diligence in Australia
• Suspicious matter reports for Tranche 2 firms
• Beneficial owners: two tests, one 25% trigger
• Trust KYC in Australia: what the Rules require