Look at how the service works
A delivery channel is the way your business provides the service and receives information or instructions. It can include direct contact, remote systems and the involvement of another person. The risk question is what that arrangement allows you to know, and where uncertainty or misuse can enter the process.
The Act requires delivery channels to be considered in both the business assessment and initial customer risk assessment for services through an Australian permanent establishment. New technology can change the channel. Calling a process digital or face to face does not complete the assessment.
Connect the channel to a specific concern
A remote process may make it harder to connect the person giving an instruction with the identity information supplied. An intermediary may create uncertainty about whose instructions are being passed on. Those concerns call for different checks. The legal requirement to collect and verify information appropriate to customer risk still applies.
A meeting does not automatically resolve every question. It may help establish who is present while leaving ownership, authority or purpose unclear. Treat each source of confidence separately. The channel assessment should explain which uncertainty remains and why the chosen method addresses it.
- Remote instruction
Who is giving the instruction?
- Intermediary
Whose instruction is being passed on?
- Meeting in person
What remains unknown about authority, ownership or purpose?
Three different evidence gaps
Read this visual with the source conditions and explanation in this section.
Separate evidence questions. An answer to one does not settle the others.
Worked example: instructions through a representative
A customer sends all instructions through a representative. The representative knows the file well and responds promptly. Those facts can help the work progress, but they do not establish the representative's authority or the identity of the customer behind the instructions.
The business maps who supplies information, who approves decisions and who can change instructions. It then checks the relevant identity and authority information. If a later request arrives from a different address, the process can show why that change needs attention. This is a fictional process example, not a statement that representatives are generally suspicious.
Check the authority behind an instruction
A useful exercise is to follow one instruction from receipt to action. Mark where a staff member assumes that a sender is authorised, a document is genuine or a message has not changed. Ask what evidence supports each assumption and who resolves a failed check.
Avoid adding checks that answer a different question. A reliable identity result does not prove the commercial purpose of the instruction. A familiar email address does not establish beneficial ownership. This method keeps channel controls tied to the actual service. It also helps identify what a technology supplier can establish and what remains a business decision.