Separate the evidence from the image
A CDD record explains the information collected, analysis and decisions. A saved identity image alone does not explain this work.
Section 111 requires records reasonably necessary to demonstrate compliance with Part 2. It expressly includes accurate records of collected data and relevant analysis or decisions.
Records must be in English, or readily accessible and readily convertible into written English. Full identity-document copies are not generally required under the current framework.
Sources: Federal Register of Legislation: 111; Office of the Australian Information Commissioner: Key points; sections B, I and J.
- Identity image
Shows the document that was copied. It does not by itself explain the check.
- CDD record
Shows the information used, the verification result and how differences were resolved.
An image and a CDD record answer different questions
The AML/CTF Act does not generally require a scanned identity document. Examine other applicable duties before deciding what copies to retain.
Separate evidence questions. An answer to one does not settle the others.
Record what the check established
A practical CDD record can identify the evidence, verification result and responsible person or process. Explain how a difference was resolved or referred for action.
Record the information needed to demonstrate the work. Do not collect extra identity images merely because storage is available.
Sources: Federal Register of Legislation: 111; Office of the Australian Information Commissioner: Key points; sections B, I and J.
Invented example: an unclear name difference
In a fictional case, a customer’s details and identity document use different forms of a name. Saving the images does not explain the difference.
The reviewer records the further evidence, conclusion and reason. If the difference remains unresolved, the record identifies the next action.
The example does not prescribe a verification method. It shows how evidence and reasoning support a CDD record.
Sources: Federal Register of Legislation: 111; Office of the Australian Information Commissioner: Key points; sections B, I and J.
Design for privacy and retrieval
Identify necessary information, authorised users and a way to retrieve the record. Preserve the applicable retention event.
Before destroying an identity image, consider other AML purposes, earlier records and other legal duties. The current framework is not a blanket deletion instruction.
OAIC guidance treats identity-document copies made before 31 March 2026 separately. Apply the relevant rules to those records.
Sources: Federal Register of Legislation: 111; Office of the Australian Information Commissioner: Key points; sections B, I and J.
Examine supplier terminology
If a supplier labels a result verified, establish what the result means and what evidence supports it.
Confirm that the business can obtain the records it needs. A supplier label does not by itself demonstrate compliance with every CDD obligation.
Sources: Federal Register of Legislation: 111; Office of the Australian Information Commissioner: Key points; sections B, I and J.