You're finalising a client file, the trust deed's in one hand, and the bank has asked for more identification, ownership and source-of-funds evidence in the other. That's normal in Australia now. Know your customer requirements are the identification, verification and ongoing due diligence checks built into the Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) regime, administered by the Australian Transaction Reports and Analysis Centre (AUSTRAC), and they matter because the file doesn't end at onboarding.
By Panbo Ye, CFP® | FCPA | SSA® | Founder, Everglow
Who this article is for: accountants, advisers, mortgage and lending teams, fund managers, professional practices, overseas investors, and business owners who keep getting asked for KYC documents and want to understand why.
Currency note: This article reflects Australian rules, thresholds and regulator guidance current as at 08/2026.
Why Know Your Customer Requirements Matter in Australia
A Sydney accountant opens a trust file for a new client, then the bank asks for identity documents, trustee details, ownership evidence and the purpose of the relationship. The client thought the trust deed was enough. It isn't, because know your customer requirements in Australia are part of a broader AML/CTF control system, not a one-off admin exercise.
The practical point is simple. If a business is a regulated reporting entity, it must identify and verify the customer, understand who really owns or controls the structure, and keep that information current over time. AUSTRAC's 2024 reforms broaden the regime to more tranche 2 sectors and require an AML/CTF program that covers customer due diligence, ongoing monitoring and escalation of suspicious activity, rather than just collecting ID at onboarding. For a plain-English overview of governance and compliance in this space, the Everglow governance and compliance hub is a useful starting point.
Practical rule: if the relationship can change, the KYC file can change too.
That's why the topic matters to firms serving new migrants, Chinese enterprises, professional practices, property structures and fund clients. KYC isn't just about ticking a box, it's about proving to a regulator, a banker or an auditor that the firm understood the client properly at the start and kept understanding the client as circumstances moved.
For readers trying to map the broader compliance requirements, this also sits well beside practical KYC resources such as the data-driven AML framework 2025, especially where teams are building internal checklists and risk workflows.
Who Must Comply and How the AML/CTF Regime Defines a Customer
Not every business in Australia is inside the AML/CTF perimeter. The obligation sits with reporting entities, which includes businesses that provide designated services under the legislation and rules, not ordinary service providers acting outside that perimeter. That's why a small business owner may never run a formal KYC program themselves, yet still be asked for documents by a bank, broker or fund administrator that does.
The legal point matters because know your customer requirements come from the AML/CTF framework, not from general good practice alone. In regulated settings, the regime requires customer identification and verification before designated services are provided, plus proper records of those checks. The distinction is important for accountants, advisers and operators who deal with banks or other reporting entities, because the KYC ask often comes through the counterparty even when your own business isn't the reporting entity.
A useful way to think about it is this. A customer is the person or entity receiving the designated service, while a beneficial owner is the person who ultimately owns or controls the entity behind it. For trusts, companies and other structures, the regulator cares about who stands behind the paperwork, not just whose name is on the form.
If you want a broader operational lens on why firms are moving to more structured KYC controls, the developer-friendly VAT API is a helpful example of how data validation and compliance logic can be embedded into workflow design.
Identification, Verification and Beneficial Ownership in Practice
A KYC file usually starts with identity, but the hard part is control. That is where the distinction between identity verification and customer due diligence matters. Identity verification asks who the person or entity is. Due diligence asks why the relationship exists, who controls it, and whether the structure makes sense.
Under the customer due diligence approach used in major financial centres, institutions must verify the identity of the beneficial owner of a legal entity, and the baseline threshold used there is a person with at least 25% equity interest in the entity. That is useful as a practical anchor for Australian practitioners too, because it turns a simple ID check into an ownership map. The Everglow trust deed requirements guide is a good companion when a trust structure is part of the client file.
A worked example with a Parramatta trust
Take the Nguyen family in Parramatta, buying a Sydney investment property through a discretionary trust with a corporate trustee. The accountant may need identity documents for the natural persons, company details for the trustee, the trust deed, authority evidence for signatories, and ownership or control information for anyone who effectively directs the structure. If the trust is borrowing $1.2 million and the source of funds comes from several related entities, the file should reflect that chain clearly, because the issue is not only who signed, but who controls and funds the arrangement.
| Customer type | Identity evidence | Ownership and authority evidence |
|---|---|---|
| Individual | Passport, driver licence, or other reliable identity evidence | Signing authority, purpose of account, and any representative authority |
| Company | ACN or company registration details, director identity evidence | Shareholding, beneficial owner details, director authority and control structure |
| Trust | Trust deed, trustee details, and identity evidence for controllers | Trustee authority, appointor or controller roles, and beneficiary or control mapping where relevant |
A short working rule helps in practice. If the structure is simple, the file should stay proportionate. If the structure is layered, overseas-owned, or linked to property, funds management or SMSF activity, the evidence has to work harder.
Evidence quality matters as much as evidence presence. A file that cannot be explained to an auditor is usually not strong enough for a review.
That's why many compliance teams now look beyond scanned PDFs and ask whether the data is auditable, current and internally consistent. A document sitting in a folder is not the same thing as a defensible KYC position.
Record-Keeping, Reporting and Ongoing Monitoring Obligations
KYC doesn't finish when the account opens. AUSTRAC expects reporting entities to keep customer information current through ongoing due diligence, and to use reliable and independent documentation or electronic data when verifying identity and beneficial ownership. For a fuller technical checklist of record and control design, the Everglow data protection obligations page is relevant where KYC records overlap with privacy and retention discipline.
The lifecycle logic is straightforward. If ownership changes, if source-of-funds evidence no longer matches the relationship, or if transaction patterns shift, the firm may need to re-risk the client and refresh the file. That's why a KYC process should be built around review triggers, not just onboarding tasks.
Compliance takeaway: a stale KYC file can be more dangerous than an incomplete one, because it creates false confidence.
Operationally, recordkeeping, escalation and monitoring come together. Firms need a clean audit trail that shows what was checked, what was accepted, who approved it, and when the next review should occur. For firms under pressure to align technology with controls, the core question is whether the system helps staff make better decisions, or merely stores documents.
Sector-Specific Considerations for Professionals, Fund Managers and Overseas Clients
The same KYC framework looks different across client types. A sole practitioner, a fund manager and an overseas investor can all trigger different evidence needs, even where the underlying rule is the same. The question is not only whether a person is identified, but how much structure, authority and source evidence the file must carry.
Dr Anya Sharma is a fictional example used to show how the rules work. She is not an Everglow client.
For a professional such as Dr Anya Sharma in Sydney, the file may need to reflect personal services income, business structure and account purpose more carefully than a standard retail customer file. For a fund manager, the focus often shifts to unit trust investors, control layers and the relationship between the entity and the underlying beneficiaries. For a Chinese enterprise setting up in Australia, translated or certified documents, source-of-wealth evidence and ownership mapping often become central because the structure is more likely to be cross-border and layered.
The internal logic is simple. The more complex the ownership or transaction path, the more the KYC process needs to show the who, why and how of the relationship. That's why teams handling new migrants, family structures and offshore business relationships should treat source-of-funds and source-of-wealth as core data, not optional extras.
If the client mix includes managed funds, the Everglow managed investment scheme guide can help frame where fiduciary structure and investor identification issues sit in the broader compliance picture.
Common Pitfalls and a Practical Compliance Checklist
A lot of KYC failures happen after onboarding, not at it. The most common problems are stale beneficial ownership records, weak source-of-wealth evidence, manual review bottlenecks, and teams treating the process as an IT project rather than a risk control. The timing pressure is real, too, because global banking research cited in 2025 found that completing an initial KYC review for a new corporate entity takes an average of 95 days, only about 33% of periodic KYC reviews are fully automated, and 70% of banks worldwide say they are losing clients because onboarding is too slow. For a deeper compliance-program lens, the By Design Law Firm compliance guide is a useful structure reference, even though the legal setting differs from Australia.
The practical response is not to chase speed at the expense of control. It is to design a review process that can update information when ownership, purpose or transactions change, and to document the exceptions cleanly when human judgment is needed.
A workable checklist is:
- Verify beneficial ownership early, then refresh it when control changes.
- Keep records explainable, not just stored, so an auditor can follow the logic.
- Escalate higher-risk files, especially where offshore ownership or trust layering appears.
- Avoid stale source-of-funds evidence, because old documents can hide new risk.
- Measure turnaround time, since slow onboarding often becomes a client-retention issue as well as a compliance issue.
The best KYC programs don't just collect documents, they keep pace with the relationship.
Frequently Asked Questions on Australian Know Your Customer Requirements
How often should KYC be refreshed for an SMSF or trust? There isn't one universal interval. The right review cycle depends on the risk profile, changes in trustees or controllers, and the type of services being provided. If ownership, beneficiaries, source of funds or transaction patterns change, the file usually needs review sooner.
Does an accountant without an AFSL have KYC duties of their own? Usually not in the same way as a reporting entity under AML/CTF. But the accountant may still be asked for KYC information by banks, fund managers or other regulated partners. The practical issue is often responding to someone else's compliance process.
What should an overseas client prepare before onboarding? They should expect to provide identity evidence, ownership documents, certified translations where needed, and source-of-wealth or source-of-funds material if the structure is complex. The cleaner the documents, the easier it is to show authority, control and the origin of funds.
What triggers a re-risking review in practice? Changes in beneficial ownership, unusual transaction patterns, new signatories, altered business activity, or inconsistent source-of-funds evidence are common triggers. The question is not whether the client was acceptable last year. It is whether the current relationship still fits the risk profile.
For most Australian businesses, know your customer requirements are not just about collecting documents, they're about proving identity, ownership and risk in a way that stays current as the relationship changes. The right approach depends on the customer, the service and the risk profile, so a file that looks complete at onboarding can still need review later if the structure or activity moves.
If you would like clarity on how these principles may apply to your own circumstances, contact Everglow on 1300 913 929 or email contact@everglow.au.
To book directly: Book a meeting with Panbo.
Suggested WordPress tags: KYC, AML/CTF, AUSTRAC, beneficial ownership, Australian compliance, trusts, SMSF, foreign investors
Want help applying this to your situation?
Every situation is different. Book a time with our team to talk it through, or call us on 1300 913 929.
Book a free meetingAustralian tax guide →Estimate your fees →
Keep exploring