Three ordinary Thursday engagements. A company's office manager emails an accounting practice with instructions to set up a new subsidiary. A man in his fifties instructs a conveyancer to sell his mother's unit; she is in aged care and he holds an enduring power of attorney. A buyer's agent bids for a couple at auction and hands the real estate agent a signed contract on their behalf.
In each case the person in your inbox, in your office or at the auction is not your customer. The company is. The mother is. The couple are. Eleven weeks into the regime, this is the initial CDD matter most firms have handled by instinct: identify whoever turns up, file the ID, move on. AUSTRAC's guidance treats it as a separate item with its own collection rule, its own verification rule and its own screening obligation. It is not hard. It is just not the same as identifying the customer, and the two get merged.
A Matter in Its Own Right
Initial CDD is a list of matters you must establish on reasonable grounds before you provide a designated service. The customer's identity is the first. The second, in AUSTRAC's own order, is "the identity of any person acting on behalf of the customer, and their authority to act." Then any person on whose behalf the customer is receiving the service, the beneficial owners where the customer is not an individual, and whether any of those people is a politically exposed person or designated for targeted financial sanctions. (AUSTRAC, overview of initial customer due diligence, updated 27 March 2026)
Two words in that matter do the work. Identity and authority. You need to know who the representative is, and you need to establish that they are entitled to act for the customer in relation to your service. An ID check on the office manager satisfies the first and says nothing about the second.
The scope is narrower than it sounds. You only need to do this for representatives who engage with you in relation to your designated services, and AUSTRAC says in terms that you do not need to verify every representative the customer has. (AUSTRAC, initial CDD on a body corporate, partnership or unincorporated association, updated 7 May 2026) The company's forty employees are not your problem. The two who instruct you are. And if there is no information to suggest an individual is acting for someone else, or will have someone else act for them, you do not need to establish the matter at all. (AUSTRAC, initial CDD on an individual, updated 31 March 2026) A sole trader instructing you about their own business is not their own representative; their bookkeeper who rings you about it may well be. (AUSTRAC, initial CDD on a sole trader, updated 22 April 2026)
First Decide Who the Customer Is
The guidance keeps returning to one sentence: if an individual is interacting with you on behalf of another person, the person they are representing is the customer. (AUSTRAC, initial CDD on an individual) That sounds obvious until it is applied. The son with the power of attorney is easy to onboard because he is present, articulate and has a driver licence. His mother is the customer. Her identity is the one that has to be established on reasonable grounds, and if she has no current standard ID because she is in care, that is the alternative identification path, not a reason to file the son's licence and call it done.
CDD's stated purpose includes exactly this: to establish that customers are who they claim to be and to know "whether they're acting on behalf of another person." (AUSTRAC, customer due diligence overview, updated 27 March 2026) The direction of the question matters. A person acting on behalf of your customer is the representative. A person on whose behalf your customer is receiving the service, such as a trust beneficiary, is a different matter, and our post on family trusts covers it. For an ordinary individual customer whose identity you have established, AUSTRAC's sole trader guide says you are generally not required to collect or verify whether they are receiving the service for someone else, with an exception for life policies that will not trouble a Tranche 2 firm. (AUSTRAC, initial CDD on a sole trader) The obligation that does bite on every file is the representative.
How You Find Out
AUSTRAC lists three ways you learn that a representative is in the picture: the way the person engages with you, such as seeking the service in a company's name rather than their own; the person telling you the service is not for them; and your onboarding process, which can simply ask whether the person is acting on behalf of someone else or will have someone act on their behalf. (AUSTRAC, initial CDD on a body corporate, partnership or unincorporated association)
The third is the one to build in. The onboarding forms in AUSTRAC's program starter kits carry a dedicated section for the client representative, with a question on whether they have authority to act for this service and where that authority comes from, and a line in the document checklist for "authority for any client's representative to act." (AUSTRAC, accountant program starter kit) If your intake form does not ask, you are relying on the office manager to volunteer that the company is the client. Most will. The one who does not is the one the rule exists for.
What to Collect
Once you know a representative is involved, you collect two things. The identity of the representative, using the process for whatever kind of person they are: an individual in most cases, occasionally a company acting for another company. And the nature of their authority to act, which AUSTRAC describes as, for example, appointment under an agency agreement, a power of attorney, or employment with appropriate authority. (AUSTRAC, initial CDD on an individual)
There is a third, optional item that is worth more than it costs: the reason the authority was granted. AUSTRAC's example is a real estate purchase where the representative explains they have been hired under an agency agreement to broker it. The point is stated plainly: this gives you a baseline from which to judge related ML/TF risk and "whether the behaviour of the representative is unusual through the course of your business relationship with the customer." (AUSTRAC, initial CDD on an individual) A son selling his mother's unit to fund her care is a reason. A son selling his mother's unit and asking for the proceeds to go to a company you have never heard of is a different one, and you only notice the difference if you asked the first time.
For trusts the picture has one extra layer. With a corporate trustee you identify both the corporate trustee, as the trustee, and the individual from that company who actually engages with you, as its representative and by extension the trust's. The trust deed and the instrument of appointment are the reliable, independent data for a trustee's authority. (AUSTRAC, initial CDD on a trust, updated 5 May 2026)
When You Can Skip Verification, and When You Cannot
Here the guidance splits by customer type, and the split matters.
Individual customers. You are taken to have established the representative's identity and authority without verifying what you collected if all of the following hold: you identified the customer's ML/TF risk from the KYC information reasonably available before starting; that risk is low and enhanced CDD does not apply; you took reasonable steps to establish the customer is who they claim to be; you collected KYC information about the representative and their authority appropriate to that risk; and you have no reasonable grounds to doubt the adequacy or veracity of it. (AUSTRAC, initial CDD on an individual) Low-risk client, ordinary story, no red flags: collect, record, proceed.
Companies, partnerships and associations. The simplified route covers the representative's identity on similar conditions, but the page then adds a sentence the individual page does not: "You still need to verify a person's authority to act as a representative of the customer." (AUSTRAC, initial CDD on a body corporate, partnership or unincorporated association) That is done by gathering reliable and independent data establishing the authority. And even where the beneficial-owner exception applies to a low-risk company, you still verify the identity of, and run PEP and sanctions checks on, any representative who engages with you. (AUSTRAC, initial CDD on a body corporate, partnership or unincorporated association)
What counts as reliable and independent data for authority is, refreshingly, a list. (AUSTRAC, initial CDD on an individual; AUSTRAC, initial CDD on a body corporate, partnership or unincorporated association)
- Power of attorney: the document granting it.
- Employees: written confirmation from their employer that they are authorised to act.
- General appointments: a letter, agency agreement or other authorisation from the customer, or confirmation from a reliable third party such as a legal practitioner, accountant or other professional who is not themselves the person acting for the customer.
- Insolvency practitioners: the court order appointing them, or the insolvency notice on ASIC's published notices site.
Applied to the Thursday files: the office manager's authority is a short letter on the company's letterhead signed by a director, not the office manager's own say-so. The son's authority is the enduring power of attorney, and the document is what you record, not the fact that he mentioned one. The buyer's agent's authority is the agency agreement with the couple.
The Representative Gets Screened Too
This is the step that gets skipped when the representative is merely "the contact." Before providing the service you must establish whether any person acting on behalf of your customer is a politically exposed person, alongside the customer, beneficial owners and anyone on whose behalf the service is received. (AUSTRAC, politically exposed persons, updated 29 July 2026) The same list applies to targeted financial sanctions, and you must also check whether any of them become designated during the relationship. (AUSTRAC, persons designated for targeted financial sanctions, updated 27 March 2026)
The consequences run through to enhanced CDD. If the person acting on behalf of the customer is a foreign PEP, or is physically present in or formed in a jurisdiction the Financial Action Task Force has called for enhanced CDD on, enhanced CDD is mandatory for that customer. (AUSTRAC, enhanced customer due diligence, updated 15 July 2026) A low-risk domestic company does not stay low risk because its representative, rather than its director, is the one with the exposure. Our post on the six enhanced CDD triggers has the full list, and what to do with a match covers the day the screen comes back with a name on it.
It Moves the Risk Rating
Whether the customer is acting through anyone, "for example, as an agent or under a power of attorney," is one of the KYC inputs AUSTRAC names for sorting a customer into a risk category. Its own low-risk example is a resident individual buying with a bank loan "without using any representative." (AUSTRAC, assigning customer risk ratings, updated 27 March 2026)
The starter kit worked examples make the weight explicit. In the legal and accounting kits, a person instructing the firm on behalf of an overseas client is rated medium, and two of the three medium factors are the representative: "there's a third party interacting with you on the client's behalf as their representative" and the fact that dealings with that representative are entirely remote. (AUSTRAC, legal profession starter kit worked examples, updated 2 April 2026; AUSTRAC, accounting starter kit worked examples, updated 2 April 2026) In the real estate and conveyancing kits, a couple buying at auction through a buyer's agent picks up a medium factor because they are "using a third-party agent who isn't enrolled with AUSTRAC," and after exchange the firm verifies the identity of the representative and the two buyers, and separately verifies the representative's authority to act. (AUSTRAC, real estate starter kit worked examples, updated 2 April 2026; AUSTRAC, conveyancing starter kit worked examples, updated 2 April 2026)
Note what that last example does not say. The buyer's agent being a reporting entity in their own right does not transfer the obligation. The agent for the seller still identifies the buyers' representative and still verifies the authority. A representative's own enrolment can lower the factor; it does not remove the matter. That is a different thing from formally relying on another firm's CDD, which has its own conditions and paperwork.
And It Does Not End at Onboarding
Ongoing CDD requires you to monitor for information that "suggests the customer or their agent isn't who they claim they are." (AUSTRAC, ongoing customer due diligence overview, updated 27 March 2026) Among the unusual behaviours AUSTRAC expects you to notice are a customer "appearing directed by a third party" and "using an agent or third party without a clear commercial or lawful purpose." (AUSTRAC, what you must monitor, updated 31 March 2026)
Both indicators are about the gap between the representative you recorded and the one you observe. The office manager who suddenly starts taking instructions from someone who is not on the company's letterhead. The son whose sale instructions arrive from a third email address. The reason you collected the nature of the authority, and ideally the reason for it, at the start is that this is the baseline the behaviour is unusual against. Without it, "directed by a third party" is a feeling. With it, it is a file note with a date on it, and if it hardens into a suspicion, the SMR has something to stand on.
What Goes in the File
For each customer you must keep records showing how you complied with initial CDD, including the type and content of the data you collected and the decisions you made, for seven years after the relationship ends. You are not required to keep copies of identity documents themselves. (AUSTRAC, overview of initial customer due diligence) For a representative, that means the record shows who they were, how their identity was established, what their authority was and what evidence of it you saw, the screening result, and whether the presence of a representative moved the risk rating. Our guide to what to keep and what to destroy covers the retention mechanics.
What to Do With This
- Put the question on the intake form. "Are you acting on behalf of another person, or will someone act on your behalf?" It is the cheapest control in the regime and the starter kits already contain it.
- Name the customer before you name the representative. If the answer is yes, the CDD file belongs to the person represented. The representative is a section inside it, not a substitute for it.
- Collect the authority, not the claim of it. Power of attorney document, employer letter, agency agreement, or a professional's written confirmation. Record the nature of the authority and, where you can, why it was granted.
- Know which verification rule you are under. Low-risk individual customer: the simplified route can cover both identity and authority. Company or partnership: authority still has to be verified against reliable, independent data.
- Screen the representative. PEP and sanctions, before the service, and again during the relationship. A foreign PEP representative or one in a FATF call-to-action jurisdiction puts the whole customer into enhanced CDD.
- Let it touch the risk rating. A representative is a named KYC input and, in AUSTRAC's own examples, a medium factor. If your rating method cannot see one, it is rating the wrong person.
- Write the baseline down. The reason for the authority is the thing next month's unusual instruction gets compared against.
Where AML Mate Fits
The representative is easy to lose because it lives between two records: the customer's and the person who talked to you. In AML Mate the client file is the customer's, with the deterministic risk rating and its documented factors on it, screening against the DFAT Consolidated Sanctions List and PEP data running when the client is added and re-runnable on demand, and document uploads where the power of attorney or the authority letter sits next to the CDD outcome on a dated trail. That is the shape an examiner is looking for: one customer, the person who acted for them, the paper that connects them, and a date on each. The free compliance check takes about five minutes and will tell you whether your program currently says anything about representatives at all.
The rule is small and the habit is old. Every practice has always known that the person on the phone is not necessarily the client. What changed on 1 July 2026 is that "necessarily" now has to be established on reasonable grounds, and written down.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.