Customer Due Diligence for Accountants: PEPs and Sanctions

The trigger is the service, not the job title. From 1 July 2026, Australian accounting firms providing designated services must conduct customer due diligence on clients. For customer due diligence for accountants, that means identifying and verifying clients, assessing money laundering and terrorism financing risk, and monitoring activity during the service relationship.

Customer due diligence accountants perform can feel like another layer of administration, especially when ownership is complex or a client is a politically exposed person (PEP) or appears on a sanctions list. A clear, risk-based approach makes the process easier to manage. This article explains when CDD applies, what to check and record, how staff training supports consistent practice, and how PEP and sanctions screening fits into the process.

What is Customer Due Diligence for Reporting Entities?

Customer due diligence (CDD) establishes who a customer is, verifies their identity and supports ongoing monitoring. In Australia, reporting entities must complete initial CDD before providing a designated service to a new client.

Identity documents and electronic verification

Identity verification checks customer details against reliable evidence, using documents or electronic methods. For an individual, collect their full name, date of birth and registered address, then verify those details. A government-issued passport or driving licence can support identity checks, while a utility bill or bank statement can help verify an address.

Electronic verification can help match customer information against electronic records, while documents provide evidence that can be retained. Treat a mismatch as a prompt for further review: compare the name, date of birth and address supplied with the evidence, then record how you resolved the discrepancy. The aim is a supported identity decision, not simply a completed check.

Verifying individuals, companies and trusts

Verification must reflect the customer’s legal form and the service involved. For an individual, collect and verify the required identifying details. For a company, gather registration details, directors’ names and information identifying beneficial owners. A beneficial owner is an individual who ultimately owns or controls an entity; for company clients, this includes a person owning or controlling 25% or more.

Trust checks can extend beyond the person receiving the service. When creating a company or express trust, consider proposed directors, beneficial owners, trustees, settlors and beneficiaries. Verify each beneficial owner’s identity. This gives the regulated practice a clearer view of who controls or benefits from the arrangement, rather than relying only on the representative giving instructions. For a more detailed breakdown of the people and roles to assess, see this guide to client due diligence for trusts.

Sequence matters. Identify the customer and establish the relevant ownership or control structure before providing the designated service. For a company, compare its registration details with the people named as directors and beneficial owners. For an individual, check that identifying details align across the information and documents collected. Keep a record of the evidence and verification outcome.

CDD also differs from commercial due diligence when buying a business. CDD helps establish a client’s identity and assess risk; a buyer’s review examines the business being acquired. A targeted review can examine revenue, liabilities, tax compliance and cash flow. These checks can reveal overstated revenue, unprovided expenses or unpaid tax, informing negotiations about price adjustments, holdbacks or seller warranties.

For a buyer, begin reviewing business information once access is granted after signing a letter of intent or heads of agreement. An independent review can add value even when the seller’s accountant prepared the financial figures. Keep the purpose clear: identity verification supports AML/CTF obligations, while acquisition due diligence tests the business’s financial position and potential liabilities.

What is Customer Due Diligence and How Does It Apply to Accountants?

In Australia, CDD applies when an accounting practice provides a designated service, rather than simply because it performs accounting work. Firms providing designated services need to conduct CDD and continue monitoring clients, including those who joined before the requirements took effect.

Risk assessment and reporting

Money laundering and terrorism financing risk assessment considers the client, ownership structure, service and activity. The resulting risk profile informs the depth of checks and ongoing monitoring.

Complex ownership, foreign PEPs, high-risk jurisdictions, unexplained wealth, and unusual use of physical currency or virtual assets can raise concern. Reassess risk as new information emerges or a client’s transaction pattern changes. Unusually large transactions, sudden activity shifts, transfers to high-risk geographies and attempts to obscure funds may require reporting. In a business acquisition, risk findings can also affect the buyer’s view of the transaction and its price.

Due diligence by client risk level

Risk-based due diligence adjusts checks to the client’s assessed exposure. This helps firms focus enhanced scrutiny where risk is high, while keeping checks proportionate for lower-risk clients.

Simplified due diligence may suit low-risk clients, such as public sector organisations or regulated financial institutions. High-risk clients require enhanced CDD, which can include examining source of funds. A PEP is a risk indicator, not proof of wrongdoing. For enhanced due diligence, firms should consider appropriate oversight before starting or continuing a client relationship. Medium-risk clients should be reviewed annually; high-risk clients every 6 months or more frequently.

Beneficial owners and source-of-funds checks

These checks establish who ultimately owns or controls an entity and, where relevant, where funds originated. They matter when a client’s structure or transactions create higher ML/TF risk.

Compare ownership information with company and trust records, identify each beneficial owner, and verify their identity. Screen the client and relevant individuals for PEP status, then assess the result alongside their role, location and services sought. For source of funds, examine evidence explaining the origin of money involved in a transaction, especially where a high-risk assessment calls for enhanced checks. Record your reasoning and any unresolved inconsistencies.

Do obligations vary by firm size? The trigger is providing a designated service, not being a sole practitioner or a large firm. Each practice must meet applicable CDD obligations, with workflows suited to its client base and services.

What penalties apply for non-compliance? There is no single penalty figure for every CDD or AML/CTF failure. Consequences depend on the specific breach and regulatory response, so firms should address gaps promptly.

When do reforms take effect? The reforms affecting accounting firms providing designated services take effect from 1 July 2026. Ongoing CDD also applies to pre-commencement customers.

What does CDD software or screening cost? Pricing depends on the case, including screening scope, workflow needs and integrations, and is provided after a quote request.

How are beneficial owners, PEPs and source of funds checked? Identify and verify beneficial owners, screen relevant people for PEP status, then assess source-of-funds evidence against the transaction and client risk.

For firms building consistent checks into their workflow, client verification and screening can support CDD processes.

CDD record-keeping and staff training

CDD records should make each client check understandable after the work is complete. In Australia, maintain records for minimum of seven years. A clear file helps staff explain what evidence was considered, what decision followed, and whether later monitoring changed the client’s risk assessment.

Build a consistent record for each client or entity. For example, an individual file might capture the identity information collected, documents reviewed, verification results and date of the check. A company file could also show how the practice identified and verified beneficial owners. Record the outcome, not just that screening took place.

• Keep the evidence reviewed, such as a passport or company registration details.
• Note the verification method and any mismatch, including how staff resolved it.
• Record the risk assessment, its reasons and any follow-up action.
• Document monitoring decisions and relevant changes in the client’s circumstances.
• Retain records of suspicious activity reviews and reporting decisions.

These details support audit evidence by showing the path from information to action. If a client’s address differs between a form and a document, record the discrepancy, the clarification received and the resulting decision. If screening identifies a potential match, note how staff assessed it and whether further review was needed. A complete file lets another team member follow the reasoning without relying on memory.

Staff training turns written procedures into consistent practice. Training should explain how to collect client information, document identity checks, recognise unusual activity and escalate concerns under the practice’s process. Use examples relevant to the firm’s designated services, such as a new company formation, a complex ownership structure or an unexpected change in transaction activity.

Make learning practical. Ask staff to work through a sample file, identify missing evidence and explain what they would record next. A short scenario involving an unusual transaction can help employees practise escalation and document their reasoning. Keep training materials aligned with current procedures, then use questions or file reviews to identify topics needing reinforcement.

Clear ownership also matters. Assign responsibility for maintaining the client file, recording monitoring outcomes and reviewing unresolved issues. When a staff member leaves or a client relationship changes, the records should still show the checks completed and decisions made. This continuity supports sound handovers and consistent responses when circumstances change.

Politically exposed persons and targeted financial sanctions

PEP screening and sanctions checks address distinct risks in a client relationship. A politically exposed person may require enhanced scrutiny, while a potential sanctions match needs careful review before the practice proceeds with relevant activity.

A PEP is someone entrusted with a prominent public function, whose position may expose them to increased money laundering risk. A match is not evidence of wrongdoing. Assess the person’s role, the client’s ownership structure, the service requested and the activity involved. For a company or trust, consider relevant beneficial owners and controllers, not only the representative giving instructions.

Targeted financial sanctions screening checks whether a client or connected person may match a sanctions listing. Names can be similar, so compare available identifying details and the entity’s ownership or control information. Record the screening result and steps taken to resolve a possible match. Do not treat a name resemblance alone as a conclusive match or assume PEP and sanctions status mean the same thing.

For an accountant, practical screening can form part of initial verification and ongoing review. Re-screen when relevant client details change, such as a new beneficial owner, director or transaction pattern. If a potential match appears, pause the normal workflow while the identity and relationship are assessed under the practice’s procedures. Keep a clear record of the decision and any escalation.

These checks can also inform financial due diligence during a corporate acquisition, but they answer different questions. CDD examines identity and risk; acquisition due diligence tests the business’s financial position. Review revenue, liabilities, tax compliance and cash flow. Earnings normalisation can help a buyer assess whether reported earnings reflect the business’s ongoing trading position, including where revenue appears overstated or expenses are under-provided.

Funding decisions also depend on post-purchase cash flow. Compare expected operating cash flow with liabilities, tax obligations and planned finance repayments. A business with strong reported revenue may still face pressure if expenses are understated or cash collection is weak. These findings can shape a buyer’s funding assessment and support discussions about price reductions, holdbacks or seller warranties.

Keep the conclusions separate and traceable. A PEP or sanctions screening outcome informs the client risk assessment; a revenue adjustment informs the acquisition model. For example, record a potential name match and its resolution in the CDD file, then document any earnings adjustment in the buyer’s financial review. This distinction keeps each decision clear, proportionate and supported by evidence.

Customer due diligence guidance for accountants

A workable CDD process connects the client’s identity, ownership, service and risk position. For an accounting practice, the key is to apply consistent decision logic across each designated service and record what changes the assessment.

Start by defining which services trigger CDD and who in the practice handles each decision. A sole practitioner may manage checks directly; a larger firm can assign responsibilities across client-facing staff and compliance reviewers. In either structure, staff need a clear escalation route for unusual activity, incomplete ownership information or a screening result requiring review.

For each new relationship, use a consistent sequence:

• Identify the customer and the designated service being provided.
• Establish relevant ownership and control, including beneficial owners.
• Assess risk using the client profile, structure, service and expected activity.
• Set the appropriate checks, approvals and monitoring arrangements.
• Revisit the assessment when material information or circumstances change.

This sequence helps prevent a common process gap: treating a completed identity check as the end of CDD. For example, a company may add a new controller, change its operating location or begin using a service differently. Each change can affect the practice’s understanding of the relationship and should prompt a considered review, rather than an automatic repeat of every check.

Set review intervals according to risk, then make event-based reviews part of the same calendar. Low-risk clients may be reviewed every 2-3 years, while a change in ownership or an unusual transaction can justify an earlier assessment. Accountants don’t need to re-verify a client’s identity every year as part of ongoing CDD. Instead, update information when required and keep monitoring proportionate to the client’s risk.

Use a practical register to give each client a visible compliance position. Include the designated service, risk level, review date, outstanding information and staff member responsible. A register can help a practice identify overdue reviews, unresolved ownership questions and clients whose circumstances have changed. It also supports handovers when a client moves between teams or a staff member leaves.

Review the workflow against real client files. For instance, trace a company client from onboarding through an ownership change, and check whether the risk assessment and monitoring plan were updated. Staff training and clear procedures help make those decisions consistent across a small practice or a larger team. Build that structure with client verification and due diligence workflows.

Trancher: End-to-End AML/CTF Program Management

Trancher helps Australian accounting practices bring client checks, ongoing monitoring and reporting into a coordinated AML/CTF programme. Its Client Verification & Due Diligence offering supports KYC/CDD checks and screening, while Ongoing Risk Monitoring & Client Activity Tracking helps practices maintain oversight as client information and activity change. Regulatory & Suspicious Matter Reporting supports the reporting component of the compliance workflow.

This support can suit a practice establishing procedures for designated services or refining how staff manage client reviews and records. The practical next step is to consider where your current process needs more structure, from initial verification through ongoing monitoring and reporting. Contact Trancher to discuss your accounting practice’s AML/CTF workflow, or visit trancher.global.

Build a workflow your team can sustain

The next step is to make sound judgement consistent across everyday client work. A practical customer due diligence approach for accountants should fit how your practice accepts clients, assigns responsibilities and responds when information changes. Give staff a clear route from an initial concern to a documented decision, while keeping the process workable for the services you provide.

Use the workflow as a living part of practice operations. Review it when responsibilities shift, services change or staff identify a recurring gap. A well-organised process can help your team act with greater clarity and integrate compliance into client management, rather than treating it as a separate administrative exercise.

Trancher can help you consider how your AML/CTF processes fit together. Discuss your practice’s CDD workflow and identify a practical next step. With a clear structure and steady attention, your team can approach its obligations with confidence.

Frequently Asked Questions

What About Existing Clients?

Existing client files need a transition review, rather than an automatic assumption that every initial check must be repeated. In most circumstances, reporting entities that were already reporting entities before 31 March 2026 don’t need to conduct initial CDD again. The practical focus is whether each client’s information remains current and whether new facts change the relationship’s risk. For example, newly identified ownership information may call for reassessment.

What Are the Different Types of CDD?

CDD can be understood through the depth and timing of the work: initial checks, risk-adjusted checks and ongoing review. The useful distinction is the reason for each activity. Initial checks establish the relationship’s baseline; additional enquiries address specific risk concerns; ongoing review responds to new information or changing activity. Record why the chosen level fits the client and service, so another staff member can follow the decision later.

What Are the Key Steps in CDD Checks?

Beyond completing each check, test whether the file tells a coherent story. Can a reviewer see what service the client requested, what information shaped the assessment, and why the practice proceeded or sought more detail? For example, if a company’s stated activity differs from how it uses the service, record the discrepancy and its resolution. This quality check can reveal gaps a ticked checklist alone might miss.

What information can be verified as part of due diligence?

CDD can establish more than a client’s name. Depending on the service, the practice may need to understand the purpose and intended nature of the relationship, how an entity is owned or controlled, and whether a transaction’s funding has a credible explanation. For a trust arrangement, identify the relevant parties and their roles. The information gathered should help explain who benefits, who directs activity and how the service will be used.

When do I need to undertake CDD?

Complete initial CDD before providing a designated service to a new client. For a one-off service, consider whether the service and business relationship have genuinely ended. If they have, ongoing monitoring can stop as appropriate and the relationship can be closed. Make the closure decision clear in the file. If the client later seeks another designated service, assess the new engagement and relevant information.

Why Are CDD Checks Important?

CDD gives an accounting practice a reasoned basis for deciding whether a client relationship fits its services and risk controls. It can also help identify when a client’s activity no longer aligns with the information originally provided. For example, a sudden change in transaction patterns may prompt a closer review. The value lies in connecting client information to decisions, rather than treating verification as an isolated onboarding task.

What is customer due diligence (CDD) for accountants in Australia?

For Australian accountants, CDD is a set of checks and review activities used to understand clients for AML/CTF purposes. It provides a structured way to establish identity, consider relevant ownership, assess risk and keep that understanding current. The work relates to designated services under Australia’s AML/CTF framework, so the accounting task itself does not determine whether CDD applies.

Which Australian accountants must comply with AML/CTF customer due diligence requirements?

Compliance depends on whether the practice provides a designated service covered by the AML/CTF framework, not on whether it is a sole practice or a larger firm. Map your actual services against the designated-service categories, then identify where client relationships trigger CDD. For instance, services involving company or trust creation may involve different relevant parties from a routine accounting engagement.