The short answer
Ongoing customer due diligence (CDD) is not a repeat of the identity check. AUSTRAC describes it as monitoring customers and, where there is a business relationship, doing two reviews: of the customer’s ML/TF risk, and of the know your customer (KYC) information held about them.
Re-verification sits inside the second review. AUSTRAC’s wording is that a business reviews and, where appropriate, updates and reverifies KYC information. A review can end without verifying anything again.
Source: AUSTRAC: Ongoing CDD obligations overview; Review and update information and customer ML/TF risk.
- Ongoing CDD
Monitoring customers, plus reviewing their ML/TF risk and KYC information where there is a business relationship.
- Re-verification
Verifying KYC information again where a review shows it is appropriate.
- What prompts it
The review frequency set for the customer’s risk, doubts about earlier information, becoming a foreign PEP (or another kind of PEP where risk is high), or a trigger in your policies.
- What does not, alone
An identity document passing its expiry date.
Ongoing CDD continues. Re-verification is prompted.
Based on AUSTRAC guidance on reviewing and updating KYC information. Your own policies may add triggers.
Separate evidence questions. An answer to one does not settle the others.
What prompts a review of KYC information
AUSTRAC gives two kinds of prompt. The first is time: KYC information is reviewed at a frequency appropriate to the customer’s ML/TF risk. The second is events. AUSTRAC lists doubts about whether information collected earlier is adequate or true, and a customer, beneficial owner or person the customer acts for becoming a foreign politically exposed person (PEP), or a domestic or international organisation PEP where the ML/TF risk is high.
The business’s own policies add to that list. AUSTRAC says policies set out how often different kinds of customers are reviewed and what else prompts further checks. Its examples include a request for a higher risk service, a sudden unexplained rise in transaction volumes, and changes to a customer’s corporate structure or beneficial owners.
Sources: AUSTRAC: When you must review and update KYC information; AUSTRAC: Introduction; When you must review and update KYC information.
Does an expired ID mean checking again?
Not for that reason alone. AUSTRAC says a business does not need to collect and reverify information about an individual’s identity because the verification data, such as an identity document, has expired. Expiry does not change who the customer is or their ML/TF risk.
A business may still choose a different practice in its policies. AUSTRAC’s guidance does not treat expiry as a prompt in its own right.
Source: AUSTRAC: How to review, reverify and update the customer’s ML/TF risk and KYC information.
Lower and higher risk customers
How often a review happens, and how much is checked, follows the customer’s risk. AUSTRAC says simplified ongoing CDD may apply where the customer’s risk is low, enhanced CDD is not required and the business’s policies deal with simplified measures. That can mean less intensive monitoring and updating and reverifying KYC information less often.
A business that only ever provides one-off services to a customer may have no business relationship with them. AUSTRAC says the two review duties apply only where there is one. Monitoring for unusual transactions and behaviour applies to occasional customers as well.
Sources: AUSTRAC: Simplified CDD during ongoing CDD; AUSTRAC: Ongoing CDD obligations overview; Review and update information and customer ML/TF risk.
Invented example: an expired licence and a new director
A fictional legal practice reviews a long-standing company client. The director’s driver licence on file expired last year. Separately, a company search shows a new director and a new majority shareholder.
The practice might record that the expired licence alone does not prompt re-verification, and treat the ownership change as a prompt to update the beneficial owner information and review the client’s risk rating. These are suggested steps for the example. They do not decide what this practice’s policies should say.
Source: AUSTRAC: How to review, reverify and update the customer’s ML/TF risk and KYC information.