Start with the right customer
Confirm which company receives the designated service. A trading name, group brand or contact person's name may not identify the legal customer. Rules 6-2 applies to specified non-individual customers where the designated service is proposed through an Australian permanent establishment.
For a company within that scope, the Rules require minimum information about names, available identifiers, business or operational address, any registered office, existence and governing powers. They also address the individuals with primary governance and executive responsibility. These requirements sit within initial CDD; they are not the only matters the Act requires you to establish.
- AML/CTF Rules 2025: Section 6-2(1) to (4)
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006: Section 28(2) to (3)
- Which legal customer?
Separate the entity receiving the service from its group brand.
- Who can act?
Establish the authority of the person giving instructions.
- Who owns or controls it?
Identify the relevant ownership and control information.
- What is the business and purpose?
Understand the business and the nature and purpose of the relationship.
Four questions about a company customer
These are separate evidence questions. One company search does not necessarily answer them all. Apply the relevant Act and Rules requirements.
Separate evidence questions. An answer to one does not settle the others.
Separate four evidence questions
Company existence, authority to act, beneficial ownership and business purpose are different matters. Rules 6-2 requires ownership and control information and information about the nature of the business or operations. Section 28 also deals with relevant associated persons, authority, PEP and targeted financial sanctions status, and the relationship's nature and purpose.
A registry record can support some of this work. It should not be treated as a statement that the company is safe or that every instruction is authorised. Verification is risk appropriate. Check any specific deemed-compliance measure before deciding which enquiries are required.
Worked example: a group brand
A fictional customer introduces itself using a group brand. The draft engagement names one subsidiary, the bank details name another and the contact person signs for the parent. These differences may have an ordinary explanation, but the business needs to understand it.
The reviewer identifies the intended customer and the role of each other entity. The reviewer then checks the relevant authority and ownership information. This example does not mean all group arrangements are high risk. It shows why a familiar brand name is not a substitute for identifying the customer and the parties involved in the service.
Build a file that can be followed
As a practical method, organise the file around the questions being answered. Label evidence of existence separately from evidence of authority. Link the ownership conclusion to the supporting information. State what the customer says the service is for and how the business assessed that explanation.
If two records disagree, retain the reason for the final conclusion rather than silently replacing one with the other. If information is not applicable, explain why. This makes the file easier to review and helps staff see what remains unresolved. It is an organisational method, not a prescribed form or a confirmation of compliance.