Customer Due Diligence for Law Firms: 2026 Guide
What Australian law firms must do to satisfy CDD obligations under the Tranche 2 AML/CTF Act 2006 reforms from 1 July 2026.
Customer due diligence (CDD) is the process Australian law firms must apply to identify, verify, and risk-rate clients before providing a designated service. Under the Tranche 2 amendments to the AML/CTF Act 2006, every law firm providing a designated service must document CDD procedures in Part B of its AML/CTF Programme, operational from 1 July 2026. This guide covers what Part B must address for the client types most common in Australian legal practice.
What does CDD require for law firms?
CDD has four core elements that Part B must address for each designated service: - Identification — collect full name, date of birth, and address for individuals; legal name, registration details, and principal officers for entity clients - Verification — confirm identity against a reliable source such as a government-issued document or an approved electronic verification service - Beneficial ownership — identify the natural persons who ultimately own or control entity clients, tracing through all corporate and trust layers - Ongoing monitoring — maintain active scrutiny throughout the client relationship and re-screen against PEP and sanctions lists at the frequency your programme specifies
How does beneficial ownership apply to legal clients?
When your client is a company or trust, the AML/CTF Act 2006 requires you to trace through every ownership layer until you reach the natural persons who ultimately own or control it. A company owned by a discretionary trust with a corporate trustee requires at least three layers of mapping. AUSTRAC expects each step to be documented and retained with the CDD file — tracing to the signatory alone does not satisfy the obligation. For conveyancing matters, beneficial ownership must be confirmed before settlement funds are held or transferred.
When does enhanced due diligence (EDD) apply?
EDD is mandatory for politically exposed persons (PEPs) and requires additional source-of-wealth documentation and senior-management approval before the matter proceeds. Your programme should also trigger EDD when: the client is a non-resident connected to a FATF high-risk jurisdiction; beneficial ownership is unclear after reasonable enquiry; settlement funds come from an unexplained third party; or the client is unwilling to explain an unusual arrangement. All EDD decisions must be documented with reasoning and retained for seven years.
What does ongoing monitoring mean in practice?
For conveyancing matters, ongoing monitoring means checking that settlement instructions and fund flows are consistent with the client's profile. Unusually large third-party payments, last-minute account changes, or cash involvement are red flags requiring assessment. For longer-term corporate services clients, it means periodic re-screening against PEP and sanctions lists and a CDD refresh when ownership or control changes. Your programme must define re-screening frequency and the triggers for a full CDD review.
Key Takeaways
- CDD is a four-part obligation — identification, verification, beneficial ownership mapping, and ongoing monitoring — not a one-off identity check
- Entity clients require ownership mapping through all company and trust layers to natural persons; this must be documented in the CDD file, not assumed
- EDD is mandatory for PEPs and should be applied wherever beneficial ownership is unclear, the client is a non-resident, or fund flows require explanation
- Ongoing monitoring continues through the matter — re-screen PEP and sanctions lists and refresh CDD when circumstances change
- Get compliant now — document CDD procedures in your Part B now; AMLify for law firms includes guided CDD and beneficial ownership workflows
Frequently Asked Questions
Q: Must CDD be completed before the matter starts?
Yes. CDD must be completed before you begin providing the designated service — in a conveyancing matter, before taking instructions, executing a contract, or holding trust account funds. If CDD cannot be completed satisfactorily before the matter proceeds, your programme should require you to withhold acting or escalate to the AMLCO.
Q: Does CDD apply to the opposing party?
No. CDD obligations apply to your own client, not the counterparty represented by another firm. However, receiving settlement funds from a third party who is not your client and whose connection to the transaction is unexplained is a red flag that may require a suspicious matter report.
Q: Can a firm rely on CDD completed by another entity?
Yes, with conditions. The AML/CTF Act 2006 permits third-party CDD reliance where there is a written agreement, the third party is subject to equivalent AML/CTF obligations, and your firm remains legally accountable. Any such arrangement must be set out in Part B of your programme and cannot be used to avoid the underlying verification obligation.
This is general information only and not a substitute for legal advice.