AML/KYC Requirements in Australia 2026: Complete Guide for Compliance

In 2026, Australia's anti-money laundering (AML) and know-your-customer (KYC) framework is more robust and far-reaching than ever. Significant legislative reforms, enhanced regulatory expectations, and evolving financial crime risks mean that any business operating in the financial services, digital assets, or high-risk sectors must have a solid understanding of AML and KYC obligations. This guide provides a deep dive into Australia's AML/KYC regime — what is required, how to comply, and why getting it right is essential for any regulated entity operating in the Australian market.

What Is KYC and Why It Matters in Australia

Understanding KYC Under the AML/CTF Regime

Know Your Customer (KYC) is the process by which a business verifies the identity of its clients. Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) and associated AUSTRAC rules, entities must collect and verify certain information before establishing a customer relationship. This helps prevent money laundering (ML) and terrorism financing (TF) by ensuring that customers are who they claim to be — and that the business understands the nature and purpose of the relationship it is entering.

The Core Information Required

According to the AML/CTF Rules (2025), regulated entities in Australia must collect Core KYC Information, which typically includes full legal name, date of birth, residential or business address, and government-issued identity documents. These details must be verified using reliable and independent sources such as passports, driver's licences, or national identity cards. In some cases, electronic verification via trusted databases is acceptable and increasingly preferred by AUSTRAC as a modern, auditable approach.

Connection to Customer Due Diligence

KYC is closely tied to Customer Due Diligence (CDD). While KYC identifies the customer, CDD assesses the risk they may pose in terms of ML and TF. Based on the customer's profile and transaction behaviour, a business may conduct simplified due diligence, standard CDD, or Enhanced Due Diligence (EDD) for high-risk clients. The level of scrutiny applied must be proportionate to the risk presented — this risk-based approach is the central principle of Australia's AML framework.

Who Regulates AML/KYC in Australia

The Australian Transaction Reports and Analysis Centre (AUSTRAC) is the principal AML/CTF regulator. It not only oversees compliance but also acts as Australia's Financial Intelligence Unit (FIU). AUSTRAC receives reports of suspicious transactions, enforces regulatory obligations, and guides businesses on compliance best practices through detailed rules, published guidance, and direct engagement with regulated entities.

Several other Australian agencies are involved in AML enforcement and oversight. The Australian Prudential Regulation Authority (APRA) ensures financial institutions remain stable and trustworthy. The Australian Securities and Investments Commission (ASIC) enforces conduct and consumer protection laws in financial services. The Australian Taxation Office (ATO) investigates proceeds of crime and tax evasion. The Australian Criminal Intelligence Commission (ACIC) coordinates criminal intelligence including ML investigations. The Australian Federal Police (AFP) prosecutes serious financial crime, and the Commonwealth Director of Public Prosecutions (CDPP) handles legal proceedings for ML offences.

Figure 1: Key Australian regulatory bodies involved in AML/KYC enforcement and their primary roles

Key AML/KYC Regulations in Australia 2026

The AML/CTF Act and Its Latest Amendments

The backbone of Australia's AML requirements is the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, but significant updates came with the AML/CTF Amendment Act 2024, which takes effect in March 2026. These changes modernise the regime and expand its scope to reflect global best practice and the FATF Mutual Evaluation recommendations that identified gaps in Australia's prior framework.

Figure 2: Four key reforms introduced by the AML/CTF Amendment Act 2024 taking effect March 2026

AUSTRAC Rules and Guidance

Alongside the Act, AUSTRAC issues detailed guidance and rules covering KYC and CDD requirements under Part 6 of the AML/CTF Rules, risk-based supervision principles, ongoing customer monitoring obligations, transaction reporting requirements — including suspicious matter reports and threshold transaction reports — and recordkeeping requirements. Regulated entities are expected to follow this guidance actively, not merely satisfy the minimum requirements of the legislation.

Related Legislation

Regulated entities must also consider the Privacy Act 1988, which governs the protection of customer data collected for KYC purposes; the Corporations Act 2001, which applies to entities operating as financial service providers; and Commonwealth and state criminal laws that prosecute ML and TF offences. The intersection of these frameworks means that AML/KYC compliance in Australia is not a single-regulator, single-statute obligation — it requires coordination across multiple legal requirements simultaneously.

Building a Compliant KYC/AML Process in Australia

1. Risk-Based Approach

Under AUSTRAC's guidance, businesses must adopt a risk-based framework. This means assessing customer risk profile based on geography, services, and products; assigning risk categories of low, medium, or high; periodically reviewing risk assessments every three years or when there is a material change; and adjusting due diligence accordingly. The risk-based approach is not a licence to do less — it is a framework for doing the right amount in proportion to the actual risk presented.

2. Customer Due Diligence (CDD)

Entities must collect and verify identity information for all new customers. For individuals, this includes verified ID documents, residential address, source of funds, and beneficial ownership if applicable. For businesses under Know Your Business (KYB) procedures, entities need to identify the legal name and structure, registered office and principal place of business, directors and Ultimate Beneficial Owners, and the purpose of the business relationship.

3. Enhanced Due Diligence (EDD)

When customers are deemed high risk — including politically exposed persons, virtual asset service providers, or customers with large or unusual transaction volumes — additional checks must be performed. EDD requires verifying source of wealth and funds, obtaining senior management approval to onboard or continue the relationship, and increasing the frequency and depth of ongoing monitoring applied to that customer's transactions and behaviour.

Figure 3: Standard CDD vs Enhanced Due Diligence — when each applies and what it requires under AUSTRAC rules

4. Ongoing Monitoring and Reporting

Ongoing Customer Due Diligence (OCDD) ensures that customer behaviour aligns with the established risk profile. Key elements include transaction monitoring systems calibrated to the customer's expected activity, periodic reviews of customer risk, and reverification when risk level increases. Suspicious Matter Reports (SMRs) must be submitted to AUSTRAC within three business days of forming a suspicion — or within 24 hours for terrorism-related suspicions. This reporting obligation applies regardless of whether a transaction has been completed or prevented.

5. Recordkeeping

Businesses must keep detailed records for at least seven years after a customer relationship ends. This includes verified identity information, the results of ID checks via the Document Verification Service or other sources, risk assessments and reviews, EDD documentation, and transaction monitoring data including the justification for decisions made in response to alerts. These records must be accessible to AUSTRAC on request and must satisfy the evidentiary standards required for regulatory examination.

Acceptable KYC Documents and Data Sources in Australia

AUSTRAC accepts a range of primary and secondary identity documents, as well as electronic verification methods that meet reliability and independence standards. The combination of document type and verification method must provide sufficient certainty about the customer's identity given the risk level of the relationship.

Figure 4: Acceptable KYC evidence types and their appropriate use under AUSTRAC rules

Know-Your-Business (KYB) and UBO Verification Requirements

KYB Explained

When onboarding corporate clients, regulated entities must follow Know Your Business (KYB) procedures — similar to personal KYC but tailored to the structure and ownership of legal entities. Key requirements include company registration details, registered and operational address, the nature and purpose of the business relationship, and identification of directors and beneficial owners. KYB is often more complex than personal KYC because corporate structures can have multiple layers of ownership that must be traced to the natural persons who ultimately control the entity.

Ultimate Beneficial Owner (UBO) Verification

A UBO is any person who owns or controls 25% or more of an entity, or who otherwise exercises substantial influence or control over the entity's decisions. To comply with AUSTRAC rules, regulated entities must identify and verify all UBOs using documentation plus reliable data sources, maintain records explaining how UBO control was established and through what ownership structure, and reassess UBO status if significant changes occur in the entity's ownership or control structure. Failure to identify UBOs accurately is one of the most common compliance gaps identified in AUSTRAC examinations.

Steps to Become AML/KYC Compliant in 2026

For regulated businesses implementing or updating their AML programme for the 2026 regime, the following framework represents the minimum viable compliance structure required by AUSTRAC — and the logical sequence in which it should be built.

Figure 5: Seven-step AML/KYC compliance framework for Australian regulated businesses under the 2026 regime

The Costs of Non-Compliance: Penalties and Risks

Failing to meet AML/KYC requirements can carry severe consequences for Australian businesses. AUSTRAC's enforcement history demonstrates that non-compliance is treated as a matter of genuine regulatory priority — not a technical infringement that attracts nominal penalties.