A conveyancer takes a call from the selling agent: "We've already done the vendor's ID, want me to send it over?" An accountant refers a new company to a law firm for the constitution and the shareholders agreement, and the client has already sat through the accountant's onboarding. A buyer's agent, a mortgage broker, a bank and a solicitor all touch the same purchase in the same fortnight. Ten weeks into the regime, the customer due diligence question that keeps coming up isn't how to verify someone. It's whether you have to, when somebody regulated already did.
AUSTRAC calls the answer reliance, and it's a yes with conditions. In June we wrote about why four professions had to sit in one room with the regulator to talk about exactly this. That piece was about the question. This one is about the rules, which have been on AUSTRAC's site since March and which I suspect very few firms in the new sectors have read.
What Reliance Is, and the Two Things It Isn't
Reliance means using know-your-customer information that another reporting entity has already collected and verified, instead of collecting and verifying it yourself. The other party has to be either an Australian reporting entity or a business regulated under foreign laws that give effect to the FATF recommendations on customer due diligence and record keeping. It comes in two forms, an ongoing agreement or arrangement, or case by case, and it sits in sections 37A and 38 of the Act and sections 6-29 and 6-31 of the Rules. (AUSTRAC, overview of reliance on customer identification by a third party, updated 27 March 2026)
AUSTRAC's own examples of when you might want it read like a Tranche 2 client list: a conveyancer and a bank in a property transfer, a lawyer and an accountant setting up a company. The stated purpose is to stop the customer being asked for the same passport four times, and to cut the cost of initial CDD. So far, so sensible.
Now the two things it isn't, because this is where most firms' mental model is wrong.
Reliance is not outsourcing. If you pay a consultant or a platform to run your checks, that's outsourcing, and the guidance is blunt: you remain liable for any breach of your CDD and record keeping obligations. (AUSTRAC, overview of reliance) We covered what that looks like when it goes wrong in the Mounties case.
An ID-check vendor is not a reliable third party. The same page says reliance "doesn't include a KYC or outsourced service provider because these entities aren't subject to oversight and supervision under Australia's AML/CTF laws." The verification app on your phone is a tool you use to do your own CDD. It isn't another reporting entity whose CDD you're adopting. If a vendor's sales deck says otherwise, that's the sentence to send them.
It Covers the Identification, Not Your Judgment
The second thing to get straight is what you're actually borrowing. Reliance lets you take another firm's collection and verification of KYC information. It doesn't let you take their opinion of the client.
AUSTRAC makes the point in an "important note" on both reliance pages: the third party's risk assessment and policies may not match yours, and the same customer can present a different risk to your business because you're providing different services or providing them differently. You must still conduct initial CDD, including enhanced CDD where it's required, in a way that's appropriate to the risk the customer presents to you. Otherwise, in AUSTRAC's words, you're unlikely to be able to demonstrate that the arrangement was appropriate to the risks you face. (AUSTRAC, reliance under CDD arrangements, updated 27 March 2026)
In practice that means the file the agent sends you covers "who is this person and how was it verified." The risk rating, the source of funds question if one is needed, and the decision to proceed stay on your desk. A low rating that arrived with the referral is somebody else's low rating.
Route One: Case by Case
This is the one-off. Another reporting entity refers a client, you don't expect it to become a pipeline, and you'd like to use the identification they've already done.
Section 38 lets you, if three things are true. The reliance must be appropriate to the ML/TF risks you face, judged against the nature, size and complexity of the other firm, the services it provides, the customers it serves, its delivery channels and the countries it operates in. You must have reasonable grounds to believe you can get all the KYC information they collected before you start providing the designated service, and copies of the data they used to verify it immediately or as soon as practicable after you ask. And you must document why you believe both of those things. (AUSTRAC, reliance on a case-by-case basis, updated 27 March 2026)
That word "document" is the whole obligation at small-firm scale. Case-by-case reliance is a file note, written before the service starts, that says who you relied on, why that was reasonable, and how you'll get the underlying evidence if you need it. The checks still come before you act; reliance changes who did the checking, not when.
AUSTRAC's worked example shows what the referring firm handed over to make the note easy to write: its AUSTRAC enrolment details as evidence it's a reporting entity, the sections of its AML/CTF policies covering CDD and record keeping, its latest independent evaluation, its ML/TF risk assessment, and confirmation that it stores KYC information electronically and can produce the documents within 24 hours. (AUSTRAC, overview of reliance) That is a reasonable checklist to send back to the agent who offered to "send the ID over." If they can't answer the first item, you've learned something.
The example ends the way AUSTRAC examples tend to. One of the referred customers turned out to have been onboarded in a false name, both firms lodged suspicious matter reports, and the relying firm went back and re-reviewed every other client from the same source. Reliance doesn't make the referred client someone else's problem.
Route Two: The Standing Arrangement
If the same firm sends you clients every month, case-by-case notes stop making sense and the Act gives you the second route: a CDD agreement or arrangement under section 37A. This is what most referral relationships between an accounting practice and a law firm, or an agency and its conveyancers, should probably become if they want reliance at all. It's also more work, by design.
It has to be in writing. AUSTRAC doesn't mind the format. A contract, a memorandum of understanding, a standard operating procedure, or another written document all qualify, as long as the content meets the Rules. (AUSTRAC, reliance under CDD arrangements)
A senior manager has to approve it. Not the compliance officer on their own, unless they're the same person, which in a small firm they often are. Keep the record of who approved it and when.
It has to contain three things. Provisions that set out each party's responsibilities, including for record keeping. Provisions that let you obtain all the KYC information before you begin the designated service, or within the timeframe for delayed initial CDD where that applies. And provisions that let you get copies of the verification data immediately or as soon as practicable after you ask. On that last one AUSTRAC has put a number on "practicable": it would not expect to see delays beyond one business day. For higher-risk services that can move quickly, it may need to be minutes.
Both sides agree the standard. Before signing, AUSTRAC expects the two firms to agree what level of CDD will be carried out and relied upon, appropriate to the customer's risk. That conversation is where the mismatch problem gets solved in advance: if your policies require a certified copy and theirs accept a photo, write down which one governs. How you verify identity is now a term of the deal.
You have to check it, on a clock. While the arrangement is in force you must conduct regular assessments of it, at least every two years or more often if your risk warrants, and again whenever there's a significant change in circumstances. Each assessment gets a written record within 10 business days of completing it. If an assessment leaves you not satisfied that the arrangement still complies with the Rules, you must do your own initial CDD on the customers. And in case anyone thought the review was optional, the page ends with: "Failure to conduct regular assessments may result in civil penalties."
Any arrangement that existed before 1 July 2026 has to be reviewed against these requirements too. (AUSTRAC, overview of reliance) A handshake understanding with the agency down the road, in place since 2019, is not a CDD arrangement until somebody writes it down and signs it.
What "Assess the Other Firm" Means When You Have Four Staff
None of this requires a due diligence team. AUSTRAC says you can assess the other party on information reasonably available to you: their answers to your questions about their CDD and record keeping systems, the findings of any independent evaluation, whether there's adverse media about them, and whether a regulator has published disciplinary action against them. (AUSTRAC, reliance under CDD arrangements)
The triggers for an early re-assessment are the same list read forwards: adverse regulatory findings, adverse media, a material shift in their risk profile, the outcome of a recent independent evaluation, a failure to fix known CDD problems, or a change in who owns or controls them. AUSTRAC's example of the last one is a new owner who turns out to be a politically exposed person in a high-corruption jurisdiction. For an accounting practice relying on a suburban law firm, the practical version is simpler: when the firm you rely on gets sold, merges or changes hands, the arrangement gets reviewed.
Two more things share a page with the reliance rules and deserve a line each. Before you hand a client's KYC information to another firm, or receive it, the guidance tells you to check your Privacy Act obligations and whether the customer's consent is needed. That's a live question for firms that lost the small business exemption on 1 July. And every reliance page opens with the same warning: it's a criminal offence to disclose certain information to another person where it could reasonably be expected to prejudice an investigation. (AUSTRAC, overview of reliance) Sharing an ID file under a reliance arrangement is fine. Sharing why you filed an SMR on that client is not.
The Form Is Already in Your Starter Kit
If you work in property, AUSTRAC has quietly done part of this for you. The real estate, conveyancing and legal profession starter kits each include a customer form called "Request to verify information", described as being for all kinds of customers, "to record reliance on third parties to assist with CDD if you work with conveyancers, real estate agents or buyer's agents." (AUSTRAC, real estate starter kit document library; conveyancing; legal profession; all updated 16 June 2026)
That's the regulator telling the property chain it expects reliance to be routine between the agent, the conveyancer and the solicitor on a sale, and handing over the template for the file note. It doesn't replace the written arrangement if the relationship is ongoing, and it doesn't replace your risk rating. It does mean the "we've already done the vendor's ID" phone call has an official answer sheet. If you haven't opened your kit since June, check you were eligible for it first, then go and find the form.
Should You Bother?
Honestly, sometimes not. Reliance exists to save the client friction and you cost. If you verify twenty new clients a year and your process is a licence, an electronic check and ten minutes, doing it yourself is simpler than maintaining an arrangement, assessing it every two years and keeping the 10-day records.
The June advice stands: decide your default position and write it in your program. AUSTRAC expects your AML/CTF policies to set out how you'll use reliance, when it's appropriate, and how you'll assess arrangements, and to record the steps you take to confirm the other firm has appropriate measures in place and actually applies them. (AUSTRAC, overview of reliance) "We don't use reliance; we verify every client ourselves" is a complete and acceptable policy. So is "we rely on referring reporting entities case by case, using the request-to-verify form, and never for high-risk clients." What isn't acceptable is the unwritten version, where the file just contains someone else's PDF.
One caution on size. AUSTRAC says that where the other firm is very different from yours in nature, size and complexity, you need to think carefully about whether reliance is appropriate, and its example is a complex trust structure being verified by a small foreign business that mostly serves individuals. (AUSTRAC, managing risk and assessing foreign jurisdictions for reliance, updated 27 March 2026) A family trust verified by a firm that has never done one is not a file you want to inherit. The same page says it generally won't be appropriate to rely on firms in jurisdictions FATF has listed as high risk or placed under increased monitoring over CDD concerns, which matters the day an offshore adviser offers to "handle the KYC" for a foreign buyer.
What to Do This Week
- Write your reliance position into your program, even if the position is "never." One paragraph: whether you rely, on whom, case by case or by arrangement, and how you assess. AUSTRAC expects it to be there.
- List the firms that regularly send you clients, or receive yours. For each, decide: no reliance, case by case with a file note, or a written arrangement. Anything already operating on a nod needs to be documented or stopped.
- Build the file note. Who you relied on, evidence they're a reporting entity, why it was appropriate, how you'll get the verification data within a business day, and your own risk rating. The starter kit form is a fine starting point.
- Diarise the two-year assessment for any standing arrangement, and the 10-business-day record after each one. Put the "significant change" triggers next to it so a merger or a news story prompts the early review.
- Keep the risk rating yours. Whatever arrives with the referral, the rating, any enhanced CDD and the decision to act are on your file, under your name.
Where AML Mate Fits
AML Mate keeps each client's CDD record, the documents behind it and a review date on the one file, so the note that says whose verification you relied on, and the date you next check the arrangement, sit where an examiner would look. The free compliance check takes five minutes and shows where your program is thin.
Reliance was written so that a client isn't asked for the same passport four times on one transaction. It works. It just has to be done on paper, in advance, with your own judgment stapled to the front.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.