Most accountants think CDD is the onboarding step.
The obligation that runs every day from 1 July 2026 until the client relationship ends is ongoing CDD. Most firms have not built a system for it.
Three practical jobs of ongoing CDD (Section 30, AML/CTF Act)
- Monitor for unusual transactions and behaviours. Continuous, not periodic. The obligation runs from the first day of the relationship to the last.
- Periodically review and update the customer’s ML/TF/PF risk rating. The frequency must be appropriate to the customer’s risk and documented in the firm’s AML/CTF policies.
- Review and, where appropriate, update and reverify KYC information. Triggered by the periodic review cycle and by specific events.
One obligation most firms are not yet assessing: proliferation financing. AUSTRAC’s reformed framework refers consistently to ML/TF/PF as a single risk lens. The risk assessment cannot be silent on PF.
The trigger events most firms have no system to detect, per AUSTRAC’s published guidance on ongoing CDD:
- Change in beneficial ownership of a customer entity.
- Customer or beneficial owner becoming a foreign PEP, or a domestic or international organization PEP assessed as high ML/TF risk.
- Change in how services are delivered — moving from in-person to online, or the involvement of a third-party agent.
- Change in the countries the firm deals with for that customer.
- Doubts about the adequacy or veracity of previously collected KYC information.
The structural problem: most of these changes happen outside a firm’s normal client interactions. By the time a partner notices, the obligation has been live for months.
The structural problem: most of these changes happen outside a firm’s normal client interactions. A new director added to a foreign entity. A trust deed amended without the accountant being told. A counterparty added in a sanctioned jurisdiction. By the time a partner notices, the obligation has been live for months.
Under examination, AUSTRAC does not ask if you knew. They ask if your system was designed to find out.
Ongoing CDD is not an event you complete. It is a state you maintain.
Of the five trigger types above, which one do you think is least well-handled by current systems in Australian accounting firms?
