Australian AML/CTF · Explainer

Collect and verify customer information

Separate what a customer tells you from the evidence used to check it.

General information only, not legal, compliance, or other professional advice. Does not confirm compliance.

Start with: Does AML regulation follow your service or your profession?

Collecting records a statement

When a customer gives a name, address, ownership chart or explanation of a transaction, the business has collected information. That information may be useful, but its presence in a form does not mean the business has checked it. Verification is the separate work of testing relevant information against suitable evidence.

Section 28 distinguishes these actions. It requires collection appropriate to the customer's risk and verification using reliable and independent data as appropriate to that risk. The Rules also require policies to state the circumstances for collection and for collection with verification. Staff need to understand the difference.

From a statement to a checked conclusionFollow the process from top to bottom. Identify the matter: State the fact that needs to be established. Collect information: Record what the customer or other source supplies. Verify as appropriate: Use reliable and independent data appropriate to the risk. Resolve differences: Assess conflicting or missing information. Record the conclusion: Explain what was established and what remains uncertain.Identify the matter Collect information Verify as appropriate Resolve differences Record the conclusion
  1. Identify the matter

    State the fact that needs to be established.

  2. Collect information

    Record what the customer or other source supplies.

  3. Verify as appropriate

    Use reliable and independent data appropriate to the risk.

  4. Resolve differences

    Assess conflicting or missing information.

  5. Record the conclusion

    Explain what was established and what remains uncertain.

From a statement to a checked conclusion

Collection and verification are different actions. The required evidence depends on the applicable duties and risk.

Follow the process from top to bottom.

Match the evidence to the fact

An evidence source can establish one fact without establishing another. A company record may help confirm existence while leaving a particular instruction unexplained. An identity check may concern the contact person but say nothing about authority to act for the customer.

The legal requirement is not satisfied merely by adding the word verified to a file. Identify what was checked, what evidence was used and how it relates to the matter being established. Apply the relevant customer-type requirements as well as the risk-based obligations. Do not assume every fact always needs the same evidence or method.

Worked example: a company chart

A customer supplies a chart showing two individual owners. The chart is collected information. A staff member compares it with other suitable records and finds that one holding passes through another company. The staff member asks about that link and examines the relevant information before recording a conclusion.

This example is not a compulsory sequence for every company. It illustrates why a customer-prepared chart and a checked ownership conclusion are different records. If the source is incomplete or outdated, the note should say so. Copying the chart into a second system does not create independent verification.

Make exceptions visible

A practical file can distinguish collected, checked, unresolved and not applicable matters. Those labels are useful only if their meaning is clear. For example, not applicable should have a reason tied to the customer's circumstances or an applicable provision. It should not be used to conceal missing evidence.

When a normal method fails, determine whether another appropriate method or a specific legal provision applies. Do not invent a successful result to keep the workflow moving. The aim is sufficient confidence in the relevant facts, supported by an explanation another reviewer can follow. More documents alone do not provide that confidence.

Sources and scope

Sources checked on 2026-09-06. This page is not continuously updated. Check the linked legislation and AUSTRAC guidance for current requirements.

This page does not cover: Identity vendor comparison; Document retention periods; Ongoing CDD procedures.

Common AML/CTF terms