An 84-year-old vendor is selling the family home from an aged care facility. Her driver licence expired six years ago, when she stopped driving, and she never got around to handing it in or replacing it. A recently arrived migrant wants you to set up his cleaning business. A woman instructs you on a property settlement three weeks after leaving a violent household with a phone, a child and nothing else.
Every one of these people is exactly who they say they are. None of them can pass the ID check your onboarding form describes. If your AML/CTF program's answer is "no licence, no service", you have written yourself a policy that is stricter than the law, and you will spend this year turning away real clients for no reason.
AUSTRAC has published detailed guidance on alternative identification. It is written with banks in mind in places, but it applies to any individual whose identity you need to establish for initial customer due diligence, and the core carve-out sits on the initial CDD overview page that every reporting entity works from. Here is what it actually allows.
First, know what "standard" is, so you know when you have left it
For an individual, standard verification runs on either a government-issued primary photographic identification document, such as a current driver licence, passport, proof of age card or foreign national identity card, or a primary non-photographic document like a birth certificate, citizenship certificate or concession card paired with a secondary document showing name and address, such as a utility bill (AUSTRAC, initial CDD for individuals, updated 31 March 2026). Our identity verification walkthrough covers that ordinary path.
The client in front of you is outside that path when they cannot obtain those documents, cannot access them because of circumstances beyond their control, or hold documents whose details do not match each other, an old name, a wrong date of birth, an address from three moves ago (AUSTRAC, identifying individuals who don't have standard ID, updated 27 March 2026).
Note what is not on that list: refusal. A client who has documents and will not show them is a different situation with a much colder script, which we covered in the client won't hand over ID. This article is about "can't". That one is about "won't". Confusing the two costs you in both directions.
The carve-out that makes it legal
The initial CDD overview page says that where an individual can't obtain identity information or evidence, or can't access it because of circumstances beyond their control, you are considered compliant with your obligation to establish their identity if you have done all of the following (AUSTRAC, overview of initial CDD, updated 27 March 2026):
- implemented AML/CTF policies that mitigate and manage the additional ML/TF risk these situations create
- taken reasonable steps to establish the individual is who they claim to be, such as applying alternative identification procedures
- identified the customer's ML/TF risk
- collected KYC information appropriate to that risk
- taken reasonable steps to verify it using data reasonably available to you, in a manner appropriate to the risk
Read the first bullet again. The policies have to exist. If the first time your firm thinks about alternative identification is while the client is sitting in reception, you are improvising, and improvisation is not a documented procedure. This is a page in Part B of your program, written now, before you need it.
And the alternative options are not just for the person paying your invoice. AUSTRAC says you can use them for any individual whose identity initial CDD requires you to establish: the customer, a person receiving the service on the customer's behalf, a person acting for the customer, and an individual beneficial owner of a company or trust client (AUSTRAC, node 1312). That last one matters for accountants: the beneficial owner who cannot produce Australian documents is the same problem in a different chair.
The toolkit, strongest to last resort
AUSTRAC's list of acceptable alternatives, which it says is not exhaustive (AUSTRAC, node 1312):
A referee statement. The workhorse. The referee should hold a position of trust in the community and have an existing relationship with the individual: a doctor, a school principal, an employer, a minister of religion, a police officer, a financial counsellor, an Elder, a refuge manager, an aged care facility manager, Centrelink staff. One prior interaction is not a relationship; AUSTRAC expects the connection to be real. The statement should carry the referee's name, position, contact details, relationship to the individual, and what they know of the person's full name, date of birth and address. AUSTRAC even publishes an example referee statement form you can tailor.
You are allowed to be sceptical in both directions. Ask for the statement on letterhead, sent directly from an official email address so it cannot be altered in transit. If the referee claims a profession, check the register: AHPRA for health practitioners, the Australian Legal Profession Register for lawyers. If the same helpful referee keeps vouching for different new clients, that pattern is itself worth investigating.
Government correspondence. A letter from a federal, state, territory or foreign government body showing the individual's name. For people leaving prison, this includes identification issued by corrective services, such as a Corrections Record Number.
Recently expired identification. The aged care vendor's lapsed licence is not worthless. AUSTRAC accepts recently expired ID, and even older expired ID where the risk supports it and you can either match one other identifying detail, such as date of birth, or visually match the person to the photo. Its own example of who this helps: elderly people who never officially handed in the licence when they stopped driving.
Community identification. For Aboriginal and Torres Strait Islander individuals, a community ID or organisation membership card, or confirmation from an organisation known to them, such as a Land Council. AUSTRAC maintains dedicated guidance on alternative identification for First Nations peoples, updated 25 March 2026.
Self-attestation, last and least. If you cannot establish identity any other way, the individual's own declaration of who they are can be accepted as a last resort, typically for people experiencing homelessness or refugees without documents. You must not rely on it if you know or suspect it is wrong or misleading, you must still take reasonable steps to verify against whatever data is reasonably available, and ongoing monitoring carries more of the weight (AUSTRAC, node 1312).
Accepting the document is a risk decision, and you write it down
Alternative identification is not a lower bar. It is a different bar with a risk assessment attached. You must identify the ML/TF risk of accepting the alternative form and manage anything extra it creates, and the risk rating you give the client is where that lands. AUSTRAC's steer is pragmatic: a person in these circumstances seeking routine, low-value services may well be low risk, and it expects the least invasive procedure that works, especially for vulnerable people, where a demanding process causes real hardship (AUSTRAC, node 1312).
Time matters too. For short-term barriers, a bushfire, a flight from a violent home, documents in a country that is slow to reissue them, use the alternative now and ask for standard documents when they exist again. For long-term barriers, remote communities, long-term homelessness, you can keep relying on the alternative indefinitely; AUSTRAC is explicit that some circumstances never change.
And if the risk changes later, the guidance has a detail worth framing: the problem is usually the money, not the identity. In AUSTRAC's own worked example, a bank that accepted an employer's reference later saw large unexplained cash deposits, reassessed the customer as high risk, and ran a source of funds check under enhanced CDD rather than demanding more ID. The cash turned out to be wedding gifts, and the rating went back to low (AUSTRAC, node 1312). More documents were never the answer; understanding the transactions was.
Some of the surrounding controls in the guidance are bank furniture, transaction caps, account limits, a 20-day window banks get to complete checks after opening an account. You do not have accounts to cap. The translatable principle is sequencing: where a matter allows it, keep your exposure small while your confidence builds.
Family violence changes the rules of the conversation
AUSTRAC's worked examples give people affected by family and domestic violence their own treatment, and one instruction stands above the rest: do not ask for details or evidence of the violence, from the client, their advocate, their referee or anyone else. A referee statement is generally sufficient if it says the person has experienced family or domestic violence and why that has affected their access to identification. Confidentiality is critical, and nothing you do should risk alerting the perpetrator to the person's activities (AUSTRAC, examples of alternative identification procedures, updated 27 March 2026).
For a family lawyer or conveyancer, this is not a rare scenario. It is a property settlement, which means it is a Tuesday. The refuge manager's emailed statement is the document. The follow-up question about what happened is the mistake.
The file you keep
You must keep records of what you did to identify the individual, which alternative identification you used, and the circumstances that made it necessary (AUSTRAC, node 1312). The record is the compliance. Two files can hold the same expired licence; the one with a dated note explaining the barrier, the risk assessment and the mitigation is compliant, and the one with a bare photocopy is a question waiting for an AUSTRAC examination.
Remember the copies rule while you are at it: what you must retain for seven years is the record of what you collected and how you verified it, not the ID images themselves, which should be destroyed once no longer needed. We covered the split in what to keep and what to destroy.
Where AML Mate fits
An alternative identification file is mostly a story: what the barrier was, what you accepted instead, why the risk still stacked up. In AML Mate that story has a home. The client record holds the referee statement and correspondence as uploads, the risk rating documents its factors, sanctions and PEP screening runs the moment the client is added regardless of what ID they carry, and a review date does the remembering when a short-term barrier means standard documents should arrive later. When the licence finally lapses into a question at audit time, the dated trail answers it. The free check at /check shows in five minutes whether your current program even has an alternative ID page to point to.
Tranche 2 was sold to the professions as a burden, and plenty of it is. This corner of it is something else: the regulator telling you, in writing, that you are allowed to act for the bushfire couple, the woman from the refuge and the vendor in aged care, as long as you think about the risk and write down what you did. Take the permission.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.