AML and KYC glossary
Overview. This glossary defines the anti-money-laundering (AML) and know-your-customer (KYC) terms Australian accounting, legal and property firms encounter under the Tranche 2 reforms, in plain English. Use it as a companion to the Tranche 2 explainer.
The core terms
AML/CTF. Anti-Money-Laundering and Counter-Terrorism-Financing. The body of law, overseen by AUSTRAC, that requires certain businesses to guard against being used to launder money or finance terrorism.
AUSTRAC. The Australian Transaction Reports and Analysis Centre, Australia's financial-intelligence agency and AML/CTF regulator. Captured firms enrol with, and report to, AUSTRAC.
Tranche 2. The extension of Australia's AML/CTF regime, from 1 July 2026, to around 90,000 new businesses including accountants, lawyers, conveyancers, real estate professionals, and dealers in precious metals and stones. See more on Tranche 2.
Reporting entity. A business that provides one or more designated services and is therefore subject to AML/CTF obligations.
Designated service. A specific activity that brings a business into scope, for example helping buy, sell or transfer real estate, holding or managing client money, or creating or restructuring companies and trusts. A firm is captured only for the designated services it actually provides.
Customer due diligence
KYC (Know Your Customer). The general practice of confirming who your customer is. In AML law this is delivered through customer due diligence.
CDD (Customer Due Diligence). Identifying and verifying a customer, understanding their risk, and keeping that understanding current. Initial CDD happens before you provide a designated service; ongoing CDD continues through the relationship.
EDD (Enhanced Due Diligence). The extra scrutiny applied when a customer is assessed as high risk, for example a PEP or a complex ownership structure. It means gathering more information and applying closer monitoring. See more on Enhanced Due Diligence.
Identity verification. Confirming a person is who they claim to be, typically by checking a genuine government-issued document and matching it to the person's face (a biometric or "selfie" check with liveness detection to prove a real, live person).
Beneficial owner / UBO. The real person or people who ultimately own or control an entity such as a company or trust, sometimes behind several layers. AML rules require you to identify the beneficial owners of entity customers.
Risk and screening
Customer risk assessment. Rating a customer's money-laundering risk as high, medium or low, using a consistent, auditable methodology, so you can apply the right level of due diligence. See more on running an AML risk assessment.
PEP (Politically Exposed Person). Someone who holds or has held a prominent public position, plus their close family and associates. PEP status raises risk and usually triggers enhanced due diligence. See more on PEP screening.
Sanctions screening. Checking a customer against government and international sanctions and watchlists of individuals and entities that firms are prohibited or restricted from dealing with. See more on sanctions screening.
Adverse media (negative news) screening. Checking whether a customer appears in credible negative news, an additional reputational-risk signal alongside PEP and sanctions screening. See more on adverse media screening.
Ongoing monitoring. Continuing to screen and review onboarded customers over time, so a new sanctions listing, PEP status or change in circumstances is caught after onboarding, not just at the start. See more on ongoing monitoring.
Reporting and records
SMR (Suspicious Matter Report). A report a reporting entity must lodge with AUSTRAC when it has reasonable grounds to suspect a matter may relate to money laundering, terrorism financing or another serious offence.
TTR (Threshold Transaction Report). A report lodged with AUSTRAC for certain transactions at or above a set cash threshold.
AML/CTF program. A firm's own documented approach to managing money-laundering risk: a risk assessment plus policies and controls, with senior-management approval, an appointed compliance officer, and independent review at least every three years.
Record keeping. Retaining a defensible, time-stamped record of the due-diligence actions you performed, so you can demonstrate compliance if asked.
A note on scope: IdentityCheck helps you perform and record several of these activities (identity verification, screening, risk assessment, EDD, ongoing monitoring and record keeping). It does not lodge SMRs or TTRs, write your AML/CTF program, or enrol you with AUSTRAC. See What is IdentityCheck?