I keep a running diff of AUSTRAC's guidance pages. Most weeks it turns up a fixed link or a reworded heading. On 9 September the suspicious matter reports page picked up an entirely new subsection, and I read it three times before I was sure which part was new and which part was AUSTRAC saying something it had already said somewhere else. Both parts matter. Here is the honest version.
The new subsection is short. You must conduct enhanced CDD if both of the following occur: you are required to submit an SMR in relation to the customer, and you continue providing designated services to them. If you have applied enhanced CDD previously on the customer, AUSTRAC expects you to include a summary of the enhanced CDD and what it showed in your SMR. And you must not delay submitting your SMR to complete enhanced CDD if you have already formed a suspicion on reasonable grounds. (AUSTRAC, suspicious matter reports, updated 9 September 2026)
The Part That Was Already True
The first sentence is not a new rule. It is section 32(b) of the Act, and AUSTRAC's enhanced CDD page has carried the same words since July: you must conduct enhanced CDD if you are required to submit an SMR in relation to the customer and intend to continue providing a designated service to them. (AUSTRAC, enhanced customer due diligence, updated 15 July 2026) We wrote it up two weeks ago as the second of the six enhanced CDD triggers.
So if your program already treats a suspicious matter report as an enhanced CDD trigger, nothing about that changed on 9 September. If it does not, it was wrong in July too, and the SMR page now says so in a place where the person drafting the report will actually see it. That placement is the point. Until this month, the rule lived on the enhanced CDD page, which is where people go when they are thinking about due diligence. It did not live on the SMR page, which is where people go at four in the afternoon with a deadline. Now it lives in both.
The Part That Is New
The second sentence is the one to read slowly. If you have applied enhanced CDD previously on the customer, AUSTRAC expects the SMR to include a summary of the enhanced CDD and what it showed.
Think about when that applies. Enhanced CDD does not usually come out of nowhere. A transaction looks odd, or a client's story shifts, or the deposit is arriving from somebody you have never heard of, and under your policies you take a closer look. Sometimes the closer look produces a perfectly good explanation and the file goes quiet. Sometimes it produces the opposite: the source of funds the client described does not match the bank statement they handed over, and that mismatch is what turns an unusual transaction into a suspicion on reasonable grounds. In that second case, the enhanced CDD is not background to the SMR. It is the middle of the story, and AUSTRAC is asking for the middle.
That fits how AUSTRAC already wants the grounds for suspicion written. An effective grounds for suspicion explains a summary of your suspicion, what suspicious activity you believe is or has occurred, and what led you to form the suspicion. (AUSTRAC, suspicious matter reports) "What led you to form the suspicion" is, very often, "we asked and the answer did not hold up." A report that skips from the odd transaction straight to the conclusion leaves out the part that makes it credible.
Two things are worth being precise about. This is phrased as an expectation in guidance, not as a new line in the Rules' list of what an SMR must contain. And it is an expectation AUSTRAC assesses you against, which for a small firm is the distinction that matters least. Write the summary.
It Reads as a Loop, Because It Is One
Put the two halves side by side and the relationship runs in both directions.
Going forward, an SMR obligation plus a decision to keep acting for the client means enhanced CDD from that point. Going backward, any enhanced CDD you already did feeds into the SMR. And if you keep acting, the enhanced CDD you do after the report may well surface the next suspicion, which is a new SMR. AUSTRAC is clear that you submit an SMR each time you form a new suspicion on reasonable grounds, even about someone you have already reported, and that you should quote the reference numbers of any earlier SMRs on the same customer. (AUSTRAC, suspicious matter reports)
So the file on a client you have reported and retained is not a report with some due diligence attached. It is an alternating sequence of looking harder and telling AUSTRAC what you saw, each step referencing the last. That is a different shape from the one most firms have in their heads, which is "lodge the SMR, done."
The Clock Does Not Wait for the File
The third sentence is the one that will save someone a penalty. You must not delay submitting your SMR to complete enhanced CDD if you have already formed a suspicion on reasonable grounds. The enhanced CDD page says the same thing from the other side: you are not required to complete enhanced CDD before you submit an SMR, and the SMR must be submitted within the required timeframes even if enhanced CDD is still being conducted. (AUSTRAC, enhanced customer due diligence)
Those timeframes are 24 hours from forming the suspicion where it relates to terrorism financing, and three business days after the day you formed the suspicion for everything else, with five business days where you are withholding information under legal professional privilege. (AUSTRAC, suspicious matter reports) And the decision itself has a clock: you must decide whether there are reasonable grounds for the suspicion as soon as practical.
The intuitive sequence is the wrong one. It goes: something is off, send the client a source of funds request, wait for the documents, assess them, then decide whether to report. That sequence is fine right up until the moment the suspicion forms. From then on, waiting for the client's documents is delaying the SMR to complete enhanced CDD, which is exactly the thing the new sentence prohibits.
The workable version is less tidy and completely acceptable. An SMR that says "enhanced CDD is in progress, a source of funds enquiry was sent on 15 September, no response as at the date of this report" is a complete SMR. When the response arrives and changes the picture, that is a further report, quoting the first.
The Tipping-Off Trap in the Middle of It
Here is where the loop gets uncomfortable, and the tipping-off page was itself updated on 18 September, so it is worth reading the two together.
Asking a customer reasonable questions, or conducting enhanced CDD, is listed as something that does not breach the tipping-off offence, with one condition attached: your SMR obligation has not been triggered. (AUSTRAC, tipping off, updated 18 September 2026) Once it has, the same page names requesting further information from a customer, including when applying enhanced CDD, as a situation that carries tipping-off risk. The guidance it gives is to provide the customer with genuine reasons for engaging with them that do not mention their suspicious conduct.
The worked example is a bank, but the technique transfers. The bank tells the customer its checks are necessary because it has to follow up significant changes in account activity under its AML/CTF obligations and its own policy. It does not mention reporting, suspicion or crime. It then documents the interaction, including the reason it gave. AUSTRAC's verdict is that this was not tipping off, because the enquiry was framed as ordinary process and the customer was never given enough to work out that the bank had reasonable grounds to suspect them. (AUSTRAC, tipping off)
For a conveyancer or an accountant, the script is a sentence: "Our AML program requires us to follow up when the funding for a matter changes, so I need to ask a couple more questions about where the deposit is coming from." True, boring, and it names a policy rather than a person. Agree the sentence before someone has to improvise it at the counter. Our post on the tipping-off rules covers the rest of the offence.
You Can Also Stop
The trigger has two limbs, and the second one is a choice. Enhanced CDD after an SMR is only required if you continue providing designated services. AUSTRAC's list of how to respond to enhanced CDD findings includes considering whether you will continue providing designated services or end the business relationship to manage the risk. (AUSTRAC, enhanced customer due diligence) Ending the relationship is a legitimate outcome, and for a sole practitioner with one uncomfortable file it is often the right one.
It is not an escape from the loop, for two reasons. The SMR still goes in; deciding not to act for someone does not cancel a suspicion you have already formed. And the tipping-off page lists deciding to end the business relationship, where you need to explain the reasons to the customer, as another tipping-off risk. (AUSTRAC, tipping off) The same rule applies: a genuine reason that is not the suspicion.
One more edge. An SMR sometimes names a client who is not the subject of the suspicion, a victim of a suspected fraud for instance. AUSTRAC does not expect enhanced CDD on that person unless it is needed to manage their own risk. (AUSTRAC, enhanced customer due diligence)
What the Summary Should Look Like
AUSTRAC does not prescribe a format for the enhanced CDD summary. What follows is our suggestion, built from what the guidance says the grounds for suspicion should do and what the enhanced CDD record has to contain anyway, which is the additional information you collected, how you verified it, and any changes you made to the customer's risk because of it. (AUSTRAC, enhanced customer due diligence)
Four short parts, in this order:
- What triggered the enhanced CDD, and when. The unusual thing and the date you decided to look harder.
- What you asked for and what the customer said. In their words where you can, in plain case, not capitals.
- What you checked and what did not match. The document against the story. This is the sentence the analyst reading your report is looking for.
- What you concluded. Established, not established, or still in progress as at the report date.
A made-up file, to show the length. "Enhanced CDD was applied on 3 September after the purchaser advised that the balance of the deposit would be paid by a third party. We asked for the source of those funds. The purchaser said they were a loan from a family member. The bank statement provided shows a transfer of $180,000 from a company two days earlier, with no loan agreement and no explanation of the connection between the purchaser and the company. We were unable to establish the source of funds. The purchaser has since asked to bring settlement forward by three weeks." Six sentences. It says who, what, when and why, it shows the work, and it does not speculate about crime types beyond what the facts support.
If you find yourself unable to write part three because nothing was checked, that is useful information too. It usually means the enhanced CDD was a label rather than a step, which is the failure mode our six triggers post was about. And if the whole thing turns on where the money came from, the source of funds versus source of wealth distinction decides which question you should have asked.
What to Do With This
- Check the SMR trigger is in your program. Not just on the enhanced CDD page of your policies, but in the SMR procedure itself: "if we lodge and continue acting, enhanced CDD applies from that point." If it is missing, it has been missing since 1 July.
- Add a field to your SMR drafting template for prior enhanced CDD: trigger and date, what was asked, what was checked, what it showed. Empty is an acceptable answer. Missing is not.
- Separate the two clocks. The suspicion decision is "as soon as practical" and the report is three business days from the day it forms, or 24 hours for terrorism financing. A source of funds request that is still outstanding does not pause either.
- Agree the sentence you say to the client before you need it. Policy, not person. Write down which reason you gave.
- Decide continue or end, deliberately, and record it. Both are allowed. Neither cancels the report, and neither is a reason to tell the client why.
- Cross-reference. Every later SMR on the same customer quotes the earlier reference numbers. Every enhanced CDD record notes whether an SMR was lodged.
Where AML Mate Fits
The summary AUSTRAC is now asking for is, almost line for line, the shape of the source of funds and source of wealth enquiry on each client's file in AML Mate: why you are asking, what the customer said, whether it was verified or documented and monitored, and the conclusion. An enquiry concluded as "not established but continuing" cannot be closed without SMR consideration and a written justification, which is the loop in this post enforced by a form rather than by memory. The guided SMR preparation carries AUSTRAC's indicators and the 24-hour rule, and it is the place that enquiry record gets summarised from. The free compliance check takes about five minutes and will tell you whether your current program treats an SMR as an enhanced CDD trigger at all.
The change itself is three sentences on one page. I would not normally write this many words about three sentences. But two of them describe a loop that most small-firm programs do not yet draw, and the third is a deadline rule that the intuitive way of working breaks by default. That combination is worth your Tuesday morning.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.