Ongoing Due Diligence: Keeping Files Current
Home / Insights / Ongoing Due Diligence: Keeping Files Current

Ongoing Due Diligence: Keeping Files Current

Ongoing due diligence under section 30 of the AML/CTF Act: what triggers a review, when simplified CDD applies, and the records your agency must keep.

AML/CTF Compliance 30 October 2026 13 min read AML Guard

Compliance officer reviewing a customer file

Ongoing due diligence is the obligation to keep a customer’s file accurate for as long as you act for them. Under section 30 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), you must monitor your customers for unusual transactions and behaviours and, where you have a business relationship, review and, where appropriate, update the customer’s ML/TF risk and their KYC information, reverifying it where needed. Since Tranche 2 obligations commenced on 1 July 2026, this applies to real estate agencies, conveyancers, law firms, accounting practices and trust and company service providers. This guide explains what the duty requires, what should prompt a review, and what a supervisor will expect to see on file.

AML Guard
amlguard.com.au
Keep Customer Checks Current
AML Guard keeps each identity check, screening result and officer decision in one case record, for Australian reporting entities.
Explore AML Guard

TL;DR

Table of Contents

What ongoing due diligence means

AUSTRAC’s guidance on ongoing customer due diligence says you must monitor your customers to appropriately identify, assess, manage and mitigate the money laundering, terrorism financing and proliferation financing (ML/TF) risks you may reasonably face. What is appropriate depends partly on the customer risks you identified during initial CDD, which is why the two stages cannot be treated as separate exercises.

The distinction is one of timing and purpose. Initial CDD is completed before you start providing a designated service, unless the delay rules apply. Ongoing CDD then runs for the life of the relationship. AUSTRAC frames identification, verification and monitoring as three core elements that work together to build the customer knowledge on which the whole regime depends. Initial CDD gives you a snapshot. Ongoing CDD is what stops that snapshot from going stale.

If you are searching for the difference between ODD and CDD, the short answer is that ODD is the continuing part of CDD, not a separate program. For the front end of the process, see our guide to Tranche 2 customer due diligence in Australia.

What ongoing due diligence means

What section 30 requires

Section 30 of the Act has two limbs that matter to day-to-day practice. The text of section 30 requires a reporting entity providing designated services through a permanent establishment in Australia to:

  1. Monitor for unusual transactions and behaviours that may give rise to a suspicious matter report (SMR) obligation.
  2. Review and, where appropriate, update the customer’s ML/TF risk when there is a significant change in the matters established at initial CDD, unusual transactions or behaviours, or circumstances the Rules specify; and review, update and reverify their KYC information at a frequency appropriate to the customer’s risk, and where you doubt the adequacy or veracity of the information you hold.

The second limb applies where you have a business relationship. The phrase “where appropriate” matters. The law does not demand that every file be rebuilt at every review. It demands that you look, decide, and record what you decided.

Why there is no fixed review interval

Many readers search for a standard KYC review frequency, such as every year for high-risk customers and every few years for low-risk ones. The Act sets no such period, and neither should your policy pretend that it does. AUSTRAC’s position is that what is appropriate depends on your ML/TF risk assessment, the customer’s risks identified during initial CDD and any changes you see as they use your services.

In practice this means your AML/CTF policies should explain how risk determines frequency, and your records should show the policy being followed. A higher-risk customer is looked at more closely and more often. A low-risk customer may be reviewed less often under simplified measures. What you cannot do is leave the question unanswered, or set an interval and then fail to meet it. A review calendar that your own policies promise, and your team does not keep, is a finding waiting to happen.

Time-based reviews are also only half the picture. They sit alongside event-driven reviews, which are the subject of the next section.

Triggers that should prompt a review

A scheduled review catches slow drift. A trigger catches sudden change. Your policies should name the triggers and say who acts on each. For an Australian Tranche 2 entity, the core list is as follows.

Change of ownership or control

When a company customer changes its directors, shareholders or controllers, the beneficial ownership you determined at the start may no longer be true. Treat this as a prompt to repeat the determination, not just to note the change. If your customer is a trust or SMSF acting through a corporate trustee, the trustee’s own ownership and control also needs to be checked. Ownership is a stake; control is influence, and either can change without the other.

A new service

A customer you acted for on a sale who now wants a buyers agent service, or wants to buy through a new company, has changed the risk picture. The new service may carry different ML/TF risks, and your risk rating should be reconsidered before you provide it. This is especially relevant for a buyers agent, where the two customers and two clocks mean obligations can start at different moments.

Unusual activity

Unusual transactions or behaviours are both something you must monitor for and a reason to revisit the file. Examples include a sudden change in how funds are sourced, reluctance to provide information that was previously offered freely, or a purchase that does not fit the customer’s stated circumstances. AUSTRAC’s real estate examples show that an agent monitors a high-risk customer’s behaviour more closely than for a low- or medium-risk customer, and your process should reflect that gradation.

The customer becomes a PEP

A customer, or one of their beneficial owners, may become a politically exposed person after onboarding. Under section 6-24 of the AML/CTF Rules 2025, if the customer, a beneficial owner or a person the customer acts for becomes a foreign PEP, or a domestic or international organisation PEP where the customer’s risk is high, you must review and, where appropriate, update and reverify the KYC information, and your policies must have a senior manager decide whether to continue the relationship. If you screened only at the start, you might not know, which is why your policies should say how and when you re-check.

A sanctions list change

Sanctions lists are updated, and a customer who was clear last month may not be clear today. A list change should prompt a re-check of your customer base against the new entries, with the outcome recorded whether or not there is a match.

Doubts about the information

Section 30 itself names this trigger: where you doubt the adequacy or veracity of KYC information you hold, you must act on it. A returned letter, a mismatched document or an inconsistent statement from a second party can all be sufficient.

What a review should actually check

A review is a short, structured decision, not a fresh onboarding. AUSTRAC’s guidance says a review should consider whether to update the customer’s ML/TF risk assessment and whether to review, update and reverify KYC information. A practical sequence is:

  1. Open the current file and note the risk rating, the KYC information held and the date and basis of the last review.
  2. Identify what changed: the trigger, the new service, new information from the customer or an outside source.
  3. Re-score the risk against your business-wide risk assessment, and write down the reasoning, not only the result.
  4. Update and reverify the KYC information that the change affects. Reverify only what needs it, but be able to explain why.
  5. Decide whether enhanced CDD is now required and apply it if so.
  6. Record the outcome and the officer who approved it.

Do not skip the sixth step. A review that happened but left no record cannot be shown to a supervisor.

Simplified ongoing CDD: when it is available

Simplified ongoing CDD is allowed in limited circumstances, set out in section 31. It applies only where all three of the following hold:

AUSTRAC’s guidance confirms that, for low-risk customers, KYC information may be updated and reverified less frequently under simplified CDD measures. Two cautions follow. First, simplified does not mean skipped: monitoring for unusual activity continues. Second, a trigger can change the answer overnight. A low-risk customer who becomes a foreign PEP, or whose behaviour becomes unusual, may no longer qualify, and the file should move to a higher level of scrutiny straight away.

After a suspicious matter report: do not tip off

Ongoing CDD can lead you to a suspicion, and a suspicion can lead to an SMR. What you do next needs care. AUSTRAC states that if you submit an SMR and continue to provide designated services, you must apply enhanced CDD and undertake as much ongoing CDD as possible without alerting the customer to your suspicion.

In practice, this changes how you gather information. Routine, expected requests that fit the transaction are appropriate. Questions that signal you are concerned are not. Decisions about what to ask, and how, should sit with your AML/CTF compliance officer rather than the agent handling the sale. If you are unsure how far you can go, take advice from a lawyer experienced in AML/CTF law before you act, because the cost of tipping off is borne by you.

Monitoring for unusual activity

Monitoring is the part of ongoing CDD that runs between reviews. Your policies must set out how you will monitor for unusual transactions and behaviours, and your process should say who acts when something is flagged. For most agencies this is a mix of staff awareness, defined red flags and system alerts. AUSTRAC notes that failure to monitor transactions and behaviour can have serious flow-on effects to other AML/CTF obligations, so this is not an area to leave to chance. Staff cannot spot what they have not been trained to see, which is why AML training for real estate belongs in the same conversation.

Records that make ongoing due diligence audit-ready

AUSTRAC expects CDD records that reasonably demonstrate compliance, including the information collected, the verification steps and the risk analysis or decisions. The record keeping guidance sets retention at 7 years from when the business relationship ends or an occasional transaction is completed. For ongoing CDD, the same guidance suggests keeping:

Note that the clock runs from the end of the relationship, not from the date of the review, so a file for a long-standing customer will be held for a long time. The test is whether a stranger could read the file and understand what you knew, when you knew it, and why you made each decision. AUSTRAC also expects you to regularly check that your ongoing CDD is effective and to address problems promptly. That means testing your own process, for example by sampling files to see whether triggers were acted on.

Our perspective

A common failure in the design of ongoing CDD is not a missing step but a broken link between documents. A risk assessment says one thing, the policies say another, and the training manual describes a third process. When a supervisor reads the set, the inconsistency is the finding. AML Guard’s guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so the review triggers in your policies start from the risks in your assessment.

The second failure is a review that leaves no trace. Teams intend to re-check customers when circumstances change, and then the work competes with settlements and appraisals. We do not automate judgement: the accountability sits with a person, not a platform, and the record should show who decided.

Our advice to principals is to design for the file you would want to hand over on the day of a supervisory visit, and then work backwards.

How AML Guard supports keeping files current

AML Guard is built for Australian reporting entities. Each identity check, screening result and officer decision sits in one case record, which is the file a review starts from and adds to. For companies, beneficial ownership is determined from the ACN, and an officer approves each determination.

AML Guard is not self-service; every firm starts with a demo. Book a demo to see how this fits your agency, or start at our pricing page. For a wider view of what to have in place, our real estate AML/CTF compliance checklist is a useful companion.

A worked example

Consider a company buyer onboarded as medium risk for a purchase. Six months later the same company instructs your agency to sell a different property. Three things have changed: the service (a sale rather than a purchase), possibly the ownership (a new director appears on the ASIC record), and the source of funds (the proceeds will go to an overseas account).

A sound review would repeat the beneficial ownership determination, re-screen the new director for sanctions and PEP status, re-score the risk with the overseas payment in mind, and record why the rating moved or did not. If the review leaves you with a suspicion, the SMR process begins, and from that point the customer is dealt with using enhanced CDD and without any hint of your concern. For the overseas element, see our guidance on overseas buyer AML checks.

A worked example of an ongoing CDD review

FAQ

How often should we review a customer’s KYC information?

The Act sets no fixed interval. Section 30 requires review and, where appropriate, update and reverification at a frequency appropriate to the customer’s risk, and whenever you doubt the information you hold. Your policies should explain how risk determines frequency, and your records should show it being followed.

What is the difference between ODD and CDD?

CDD is the overall process of identifying, verifying and monitoring a customer. Initial CDD is completed before you provide a designated service (unless the delay rules apply), and ongoing CDD continues for as long as the relationship lasts. ODD is the continuing part, not a separate obligation.

Can we use simplified ongoing CDD for every low-risk customer?

Only if three conditions are met: the risk is low, enhanced CDD is not required, and your policies deal with simplified measures (section 31). Monitoring for unusual activity still applies, and a trigger such as a foreign PEP determination can remove eligibility.

What should we do if we have lodged a suspicious matter report and the customer is still our client?

Apply enhanced CDD and carry out as much ongoing CDD as you can without alerting the customer to your suspicion. Route decisions about contact through your AML/CTF compliance officer, and seek legal advice if the position is unclear.

How long do we keep ongoing CDD records?

AUSTRAC’s guidance sets retention at 7 years from the end of the business relationship, or from the completion of an occasional transaction. Keep the information collected, the verification steps, the risk decisions and the logs of updates.

Sources

See How AML Guard Works

Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.

Book a Demo
This article is for general information purposes only and does not constitute legal advice. Firms should obtain independent professional advice on their specific AML/CTF obligations.
Last reviewed: 30 October 2026.