What you have to submit to AUSTRAC, and how to do it

On 9 September 2026 AUSTRAC added an enhanced customer due diligence section to its suspicious matter reports page. One part restates a rule that has been in force since July. One part is new: if you have already run enhanced CDD on the customer, AUSTRAC expects a summary of it, and what it showed, inside the SMR. And the report cannot wait for the file. Here is what changed, what did not, and how to write the summary without tipping anyone off.

The office manager who emails on behalf of the company. The son selling his mother's unit under a power of attorney. The buyer's agent bidding for a couple at auction. In each case the person you deal with is not the customer, and AUSTRAC's initial CDD lists them as a separate matter: identify the representative, establish their authority to act, and screen them. Here is who counts, what evidence of authority looks like, when you can skip verification, and what has to be in the file.

Initial CDD comes before the service. There is a narrow exception, and ten weeks into the regime it is the one firms reach for without having read it. You may start before verification is finished, but only if delay is essential to avoid interrupting the ordinary course of business and the added ML/TF risk is low. Here is what you can actually delay, what never moves, and the 20 business day clock that starts the moment you act.

Ten weeks into the regime, the CDD question that keeps coming up is not how to verify a client. It is whether you have to, when another firm in the same transaction already did. AUSTRAC's answer is yes, in two forms: a case-by-case file note, or a written arrangement a senior manager approves and you reassess at least every two years. Here are the conditions, what the referring firm has to hand over, and why an ID-check vendor never counts.