It is Thursday afternoon. A new client needs a trust deed executed before the end of the week, the onboarding form is filled in, the driver licence checked out, and the one thing still missing is verification of the two beneficial owners sitting behind the corporate trustee. The company extract is ordered. It will not be back today.
You know the rule. Initial customer due diligence comes before the designated service, not after (AUSTRAC, overview of initial customer due diligence, updated 27 March 2026). So the honest question is not whether you are allowed to be annoyed about it. It is whether the law has anything to say about Thursday afternoon.
It does. AUSTRAC calls it delayed initial CDD, and ten weeks into the regime it is the provision firms reach for most often without having read it (AUSTRAC, delayed initial customer due diligence, updated 22 April 2026). It is real, it is narrower than the phrase suggests, and it comes with a clock.
The default, and the door in it
The default is unforgiving by design. You must complete initial CDD before you start providing a customer with a designated service, and if you cannot establish the required matters on reasonable grounds, you must not start providing the service at all (AUSTRAC, overview of initial customer due diligence). We wrote about that timing rule in June, and it has not moved: do the checks before you act.
The door in it opens in five circumstances. The service has to be one of these:
- provided at or through a permanent establishment in Australia
- a financial institution opening an account or allowing deposits
- a certain financial market transaction that must be performed rapidly
- a real estate transaction
- provided in a foreign country
(AUSTRAC, delayed initial customer due diligence)
For a suburban accounting, legal or company services practice, only two of those are live. The real estate limb has its own clock and its own quirks, and we covered it in detail when we wrote about the counterparty in a property transaction. Everything below is the first limb: the ordinary Australian practice, serving an ordinary Australian client, from an office in Australia.
Two conditions come first, and both are yours to prove
Before you start providing the service, you must determine on reasonable grounds that both of the following are true:
- Delaying initial CDD is essential to avoid interrupting the ordinary course of business.
- There is a low additional risk of money laundering, terrorism financing or proliferation financing occurring if you delay.
(AUSTRAC, delayed initial customer due diligence)
Read condition one again, because AUSTRAC anticipated exactly how it would be misread and shut the door in advance:
It isn't a sufficient reason to delay initial CDD because it would be inconvenient for you or the customer to do it before you provide the designated service.
Essential is not the same word as awkward. A client who would prefer not to wait is not an interruption to the ordinary course of business. The examples AUSTRAC gives of genuine interruption are structural rather than social: an account opened remotely where identity cannot be verified electronically at the time, a successful bidder at an auction who by definition is not known before the auction starts, a customer in an emergency such as family violence or a natural disaster who has no access to identity documents, a visa applicant who needs an Australian account before the visa is granted, and time-critical services where an exchange rate or interest rate has to be locked on the day.
Notice what those have in common. In every case the sequence is impossible, not merely tight. Nothing you could have done earlier would have produced the verification in time.
Condition two is the one small firms tend to skip, and it is the one an examiner can test on paper. AUSTRAC says plainly that it expects you "to be able to demonstrate how you determined that the ML/TF risk of delaying verification was low." That is a determination about this customer and this matter, not a house view. If your file says low with no reasons attached, you have the same problem we described in low risk by default is not a risk assessment, except now it is holding up an exception rather than a rating.
What you can actually delay: verification, not collection
This is the part that surprises people, and it is the most useful sentence in the guidance. Delayed CDD lets you start the service after you have collected, but before you verify, the KYC information about:
- the identity of any person on whose behalf the customer is receiving the designated service
- the identity of any beneficial owners of the customer
- whether the customer, any beneficial owners, any person on whose behalf the customer is receiving the service, or any person acting on behalf of the customer is a politically exposed person or a person designated for targeted financial sanctions
- the nature and purpose of the business relationship or occasional transaction, where enhanced CDD applies
(AUSTRAC, delayed initial customer due diligence)
So the onboarding form still gets filled in. The questions still get asked. What moves is the independent checking of the answers, and only for those items.
Two things are conspicuously absent from that list. The first is your customer's own identity. AUSTRAC's worked example is explicit: you collect the same information you ordinarily would, you identify the customer's ML/TF risk from it, and then "you establish their identity as you normally would, including by verifying KYC information to establish that they are who they claim to be." Only then do you start providing the service. The person in front of you is verified before anything happens. It is the layer behind them that can lag.
The second is anything you are unlikely to be able to get afterwards. AUSTRAC says delay will not be appropriate "where you're unlikely to be able to later collect the information from the customer that you need for initial CDD." A client with a live matter answers the phone. A client whose deal has already completed does not. If the leverage disappears when you deliver, the delay was never available.
Which is why the second half of that sentence matters even more.
Where the exception simply is not available
AUSTRAC's other disqualifier is the case "where the customer could exploit your service for ML/TF before you have identified them and assessed their ML/TF risk." Its two named examples are a customer cashing out winnings at a casino, and a customer purchasing an item of jewellery (AUSTRAC, delayed initial customer due diligence).
Dealers in precious metals and stones should read that twice. The single transaction over the threshold, walk in, pay, walk out, is the archetype of the service that cannot be un-provided. There is no ongoing relationship to come back to and no later moment at which verification adds a control. For a counter sale, delayed CDD is not a tight option. It is not an option.
The same logic scales down to professional practices. The delay works where a relationship continues and you retain the ability to stop. It does not work where your service is the exit.
The clock: as soon as reasonably practicable, and no later than 20 business days
For a designated service provided at or through a permanent establishment in Australia, you must complete initial CDD as soon as reasonably practicable and no later than 20 business days of starting to provide the customer with the designated service (AUSTRAC, delayed initial customer due diligence).
Both halves bind. Twenty business days is the outer wall, not the target. "Reasonably practical is an objective assessment based on the facts that apply to you," AUSTRAC says, and "you must be able to demonstrate that you've taken reasonable steps to complete initial CDD at the earliest possible time." If the ASIC extract landed on day two and you verified on day nineteen, you were inside the wall and outside the standard.
And the clock has teeth. Civil penalties may apply if you do not verify KYC information within the required timeframes.
For contrast, the rapid financial market transaction limb runs on 5 business days, which is a useful reminder that 20 is a ceiling AUSTRAC chose for this specific circumstance rather than a general grace period.
The hard stop that is not about time at all
Here is the limit that catches firms who read only the clock. Whatever day you are up to, you must complete initial CDD before you:
- transfer, or allow or facilitate the transfer of, money, property or virtual assets for or on behalf of the customer, or
- otherwise make money, property or virtual assets available to the customer, other than holding it in an account or on deposit from the customer
(AUSTRAC, delayed initial customer due diligence)
Translated for a practice with a trust account: you can open the file, take instructions and start the work. You cannot move the money. If funds land on day three and CDD finishes on day eleven, nothing leaves the account until day eleven, and the twenty business days are irrelevant to that.
AUSTRAC adds a related warning for the case where verification finally happens and the customer turns out to fall outside your risk appetite. Be careful when refunding, to avoid converting or legitimising funds: avoid cash or bank cheque, and return electronic deposits to the originating account. And, in terms that leave little room:
In most cases, you must not return funds to a customer until you complete initial CDD.
Handing the money back is not a way out of the check. It is a transaction, and an unverified one at that.
Your policies have to say this before you use it
Delayed CDD is not a decision an individual makes at the desk on Thursday. Before you start providing the service, you must already have AML/CTF policies that do two things: complete initial CDD as soon as reasonably practicable and within the Rules timeframes, and mitigate and manage the risks associated with delaying (AUSTRAC, delayed initial customer due diligence).
AUSTRAC goes further: "We expect your AML/CTF policies will set out under what circumstance it's appropriate for you to delay initial CDD." If your program is silent on delayed CDD and your file notes say you used it, the file note is evidence against the program rather than support for the decision.
One of AUSTRAC's mitigation examples translates neatly to a small practice: manage the risk "that the customer could use your service to prove their identity with other service providers," for instance by withholding correspondence, or clearly marking it, so it is visible that the relationship is unverified. A letter on your letterhead naming a client as your client is a credential. Until the checks are done, it is a credential you have not earned the right to issue.
Delayed CDD is not the only tool, and often not the best one
Two adjacent options exist, and both are cleaner than a delay when they apply.
Reliance. If another reporting entity in the same transaction has already done the CDD, you may be able to rely on it, either case by case or under a written CDD arrangement. That is a different mechanism with its own paperwork, and we set it out in relying on another firm's CDD.
Pre-commencement customers. If the client was already in an ongoing business relationship with you on 1 July 2026 and you provide them only Tranche 2 services, you are not in delayed CDD territory at all. There is no fixed deadline for initial CDD on those customers, and no 20 business day clock. It is trigger-based instead, as we explained in existing clients and pre-commencement customers. Confusing the two is the fastest way to apply a 20 day deadline to a back book that does not have one, or to give a brand new client relief that belongs to someone else.
And in most Thursday-afternoon cases the real answer is duller than any of them: the beneficial owner check that is holding you up is usually a company extract you can pull in minutes. The exception is for the sequence that is impossible, not the one you started late.
What to do with this
- Write the circumstances into your program. One short clause: when your firm will delay, who approves it, and how the risk is managed. Without it, the exception is not available to you.
- Record both conditions at the time, not afterwards. Why delay was essential, and why the additional risk was low, in the words of this matter. Keep the record of how each matter was established on reasonable grounds (AUSTRAC, overview of initial customer due diligence), and keep it for seven years alongside the rest of your CDD records (AUSTRAC, record keeping overview, updated 10 July 2026). Our guide to what to keep and what to destroy covers the rest.
- Diarise the earlier of two dates. The day you expect the outstanding verification, and the twenty business day wall. Chase from the first.
- Put a block on the money, not just a reminder. No transfer, no release, no property made available until CDD is complete. That is the control an examiner can see working.
- Screen as soon as you have the details. PEP and sanctions status is on the delayable list, but nothing stops you running it on day one, and if it returns a possible match you want that in week one rather than week four.
- Count how often you use it. A delay or two a quarter is an exception. A delay a week is a workflow problem wearing an exception as a disguise, and it will read that way to AUSTRAC too.
Where AML Mate fits
The awkward part of delayed CDD is not the decision, it is the trail: two determinations made on the day, a partial CDD record that has to visibly close later, and a date nobody wants to be the person who missed. In AML Mate the client file carries the risk rating and the reasoning, screening against the DFAT Consolidated Sanctions List and PEP data runs the moment the client is added, and verification steps sit on a dated trail that an audit export turns into evidence. A file that started incomplete and finished complete looks like a control working. The same file with no dates on it looks like an oversight. The free compliance check takes about five minutes and will tell you whether your program currently says anything at all about delaying.
Delayed initial CDD is a genuine allowance for the situation where the sequence cannot be done in order. It is not a grace period, it is not a default, and it is not a way to bill Thursday's work on Thursday. Used twice a year with the reasons written down, it is exactly what it was drafted to be. Used weekly, it is the finding.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.