Why Your CRM's KYC Isn't Enough for Tranche 2 AML

Legal CRMs like LEAP, Smokeball, Actionstep, and Clio now offer built-in identity verification and 'KYC' features — and they genuinely help. But on their own they do not make an Australian law firm or conveyancing practice compliant with the Tranche 2 reforms to the AML/CTF Act 2006 from 1 July 2026. KYC identity checks are one slice of customer due diligence, which is itself only one part of the full obligation AUSTRAC assesses. Here is the value they add — and what they miss.

What do legal CRM KYC features actually do?

Used well, these tools deliver real value: - Centralised client and matter records — one source of truth for each client - Electronic identity verification — document and sometimes biometric checks at intake - An audit trail — a timestamped record that identity was collected and verified - Some onboarding screening — a few platforms run an initial PEP or sanctions check through a partner

Why isn't that enough for AML/CTF compliance?

Because identity verification sits inside customer due diligence, which sits inside a much larger framework. Under the AML/CTF Act 2006 you must maintain a written AML/CTF programme — Part A (governance) and Part B (CDD procedures). Verifying identity satisfies one element of Part B. It says nothing about your ML/TF risk assessment, ongoing screening, monitoring, AUSTRAC reporting, or independent review. AUSTRAC measures you against the whole framework, not the identity check.

What do these tools miss?

• A written Part A and Part B programme — CRMs don't generate or version-control it
• An ML/TF risk assessment calibrated to your designated services
• Beneficial ownership mapping — verifying the signatory is not the same as tracing who ultimately controls a trust or company client
• Ongoing PEP and sanctions screening — an onboarding-only check is not periodic re-screening
• Monitoring and source-of-funds scrutiny — critical for conveyancing and property matters
• AUSTRAC reporting — SMRs and TTRs with tipping-off safeguards
• Record-keeping, staff training, an AMLCO, and independent review

How do you close the gap?

You don't need to replace your CRM. Keep it as your practice-management system and add a dedicated AML/CTF layer alongside it. AMLify generates your Part A and Part B programme, runs CDD with beneficial-ownership mapping, screens for PEPs and sanctions on an ongoing basis, and prepares AUSTRAC-aligned reports — most firms set up in under 30 minutes. Identity can flow through AMLify or your existing CRM partner. Book a demo or see AML/CTF for law firms.

Key Takeaways

• KYC is not AML/CTF compliance — it's one element of customer due diligence
• Legal CRMs add real value — centralised records, ID verification, and an audit trail
• But they leave major gaps — no programme, risk assessment, beneficial-ownership mapping, ongoing screening, monitoring, or AUSTRAC reporting
• You don't need to replace your CRM — add an AML/CTF layer like AMLify before 1 July 2026

Frequently Asked Questions

Q: Does LEAP make my firm AML/CTF compliant?

No. LEAP and similar platforms verify identity and centralise matter data, which supports part of your CDD — but they don't produce an AML/CTF programme, run a risk assessment, map beneficial ownership, screen on an ongoing basis, or lodge reports with AUSTRAC.

Q: Is identity verification enough for customer due diligence?

No. CDD also requires you to identify beneficial owners, understand the purpose of the relationship, assess ML/TF risk, and monitor it over time. For company and trust clients, verifying the signatory is only the starting point.

Q: Do I need to replace my legal CRM to comply with Tranche 2?

No. Keep your CRM and add a dedicated AML/CTF platform alongside it for the programme, risk assessment, screening, monitoring, and AUSTRAC reporting. AMLify is built to work this way.

This is general information only and not a substitute for legal advice.

Related articles