Compliance guidance
Know what to ask for. Know what to do next.
Practical guidance for professionals who need to request, verify and handle client information.
Guidance
Request information
24 guides
What to ask for, when to ask for it, and how to make the request clear for your client.
- Requesting identity documents from an individual client A practical checklist for what identity documents to ask an individual client for before starting a matter, and why. Read guide
- Requesting formation documents from a new company client What company formation documents to request when onboarding a corporate client, and how to check them against the public register. Read guide
- Requesting trust deed and trustee details from a trust client A practical checklist for the trust documentation to request before acting for a trust client. Read guide
- Requesting bank account details securely from a client Practical steps for collecting a client's bank account details in a way that resists common fraud and interception risks. Read guide
- Requesting source-of-funds information for a higher-risk matter How to ask a client where the funds for a matter came from in a higher-risk situation, without the request feeling intrusive. Read guide
- Requesting signed authority to act before starting a new engagement When to put a signed letter of engagement in place before starting work, and what it generally covers. Read guide
- Requesting updated contact details from an existing client How often to ask existing clients to confirm their contact details are current, and what can trigger an earlier check. Read guide
- Requesting supporting documents for a property settlement matter A practical checklist of the documents and authorisations a conveyancer generally needs before a property settlement can proceed. Read guide
- Requesting beneficial ownership information from a corporate client A practical approach to asking a corporate client who ultimately owns or controls the business. Read guide
- Requesting missing information without delaying a time-sensitive matter A practical approach for chasing missing client information when a matter is time-sensitive. Read guide
- Requesting identity documents from an individual client A practical guide to which identity documents to request from an individual client, and when to request them, under the UK CDD standard. Read guide
- Requesting beneficial ownership information from a corporate client How to work out who a company client's people with significant control actually are, and what details to request from them. Read guide
- Requesting identity documents from an individual client in New Zealand A practical checklist for requesting identity documents from an individual client under New Zealand's AML/CFT Act CDD standard. Read guide
- Requesting beneficial ownership information from a corporate client A practical approach to asking a New Zealand corporate client who owns and controls it, under the AML/CFT Act's CDD requirement. Read guide
- Requesting identity documents from an individual client in Canada A practical approach to asking an individual client for the identity evidence FINTRAC's methods actually accept. Read guide
- Requesting beneficial ownership information from a corporate client A practical way to ask a Canadian corporate client for the individuals-with-significant-control details you need. Read guide
- Requesting identity documents from an individual client in the US What to actually ask a US individual client for, since there is no single federal identity-document standard for accounting firms. Read guide
- Requesting beneficial ownership information from a corporate client A practical guide to asking a company client for FinCEN beneficial ownership details, once you know it actually applies. Read guide
- Requesting identity documents from an individual client in the EU When EU customer due diligence rules require you to request identity documents from an individual client, and what to ask for. Read guide
- Requesting beneficial ownership information from a corporate client in the EU What EU rules require you to request about the individuals who actually own or control a corporate client. Read guide
- Requesting identity documents from an individual client Which identity document to ask a Singapore client for, and why the right choice depends on their residency status. Read guide
- Requesting beneficial ownership information from a corporate client What to ask a Singapore-incorporated corporate client for when identifying who actually owns or controls it. Read guide
- Requesting identity documents from an individual client in Hong Kong What to ask an individual client for, a Hong Kong identity card or a passport, and why, under Hong Kong's CDD framework. Read guide
- Requesting beneficial ownership information from a corporate client Why you need to ask a Hong Kong corporate client directly for significant controller details, grounded in the SCR requirement. Read guide
Verify information and documents
24 guides
Practical checks to confirm information is reliable, current and provided by the right person.
- Verifying a client's identity documents against a reliable source A practical approach to checking that an individual client's identity documents are independent and reliable evidence. Read guide
- Verifying a company's registration details A practical approach to confirming a company's registration and officeholder details are correct against the public register. Read guide
- Verifying a trust's structure and trustees A practical approach to confirming the trustees and structure of a trust client are correctly documented and current. Read guide
- Verifying beneficial ownership evidence for a company or trust client A practical approach to checking beneficial ownership evidence a client gave you is accurate. Read guide
- Verifying a document is genuine and has not been altered Practical, non-technical things to look for when checking a submitted document hasn't been tampered with. Read guide
- Verifying a client's source-of-funds explanation is consistent with the matter A practical approach to checking a client's stated source of funds actually makes sense for what it's funding. Read guide
- Verifying a client's identity remotely A practical approach to verifying identity for a client you never meet in person, without lowering the standard. Read guide
- Verifying an existing client's details are still current A practical approach to deciding when and how to re-verify an existing client's information. Read guide
- Verifying a document meets your record-keeping requirements before filing it A practical pre-filing check to confirm a verification record is complete before it becomes your compliance evidence. Read guide
- Verifying a client's authority to instruct on behalf of an entity A practical checklist for confirming the person instructing you actually has authority to act for the entity. Read guide
- Verifying identity documents from a reliable, independent source What makes a source reliable and independent for identity verification under the UK Money Laundering Regulations, in practice. Read guide
- Verifying a company client's registration details How to cross-check a company client's registration details against the Companies House public register. Read guide
- Verifying an individual client's identity documents against a reliable source A practical approach to checking that a New Zealand client's identity documents are genuinely independent and reliable evidence. Read guide
- Verifying a company client's registration details against the Companies Register How to check a New Zealand company client's registration details against the official Companies Register before relying on them. Read guide
- Verifying an identity document came from a reliable, independent source What FINTRAC's dual-process method means by a reliable source, and why the same source can't be used twice. Read guide
- Verifying a client company's registration details in Canada How to cross-check a company client against the federal register, and what it doesn't cover. Read guide
- Verifying identity information actually came from a reliable source Practical checks for confirming an identity document or beneficial ownership detail is genuinely reliable before you rely on it. Read guide
- Verifying a client company's registration details against the state record How to cross-check what a US company client tells you against the state registry that actually governs it. Read guide
- Verifying an identity document came from a reliable, independent source How the EU customer due diligence standard expects you to verify an individual's identity document. Read guide
- Cross-checking beneficial ownership claims against a member state's register How to verify a corporate client's declared beneficial owners against the register that actually holds the record. Read guide
- Verifying identity documents against a reliable, independent source How to check that a client's identity document, and not just the client's claim, actually came from a reliable source. Read guide
- Verifying a client company's registration details against BizFile How to cross-check a Singapore corporate client's stated details against ACRA's own business registry. Read guide
- Verifying an identity document came from a reliable, independent source How to check that a client's identity document actually meets Hong Kong's reliable, independent source CDD standard. Read guide
- Cross-checking a client company's registration details How to check a corporate client's registration details against the Companies Registry's own records. Read guide
Handle and retain information
24 guides
How to protect, organise, retain and dispose of client information appropriately.
- Storing client identity evidence securely A practical approach to storing the identity documents and evidence a client gives you. Read guide
- Controlling who can access sensitive client records A practical approach to deciding and reviewing who in your firm should be able to see sensitive compliance records. Read guide
- Setting a record-retention schedule for compliance evidence How long AML/CTF and client compliance records generally need to be kept, and how to set a retention schedule. Read guide
- Redacting or masking sensitive information like TFNs in client records A practical approach to keeping tax file numbers and similar identifiers out of normal working files. Read guide
- Keeping an audit trail of who reviewed and approved a record What a practical audit trail for a compliance record should actually capture. Read guide
- Securely disposing of client records once retention periods expire A practical approach to destroying or de-identifying client records once your firm no longer needs to keep them. Read guide
- Handling a client's request to access or correct their information A practical process for responding when a client asks to see or correct the information you hold about them. Read guide
- Preparing an evidence package for an audit or regulator request A practical checklist for what a complete compliance evidence package should include. Read guide
- Handling sensitive documents shared by email safely A practical approach to accepting and handling sensitive client attachments received by email. Read guide
- Keeping evidence organised across a multi-year client relationship A practical approach to keeping years of compliance evidence for one client findable and current. Read guide
- Storing client identity evidence securely A practical approach to keeping client identity evidence under regulation 40 and the UK GDPR's security expectations together. Read guide
- Setting a record retention schedule under the Money Laundering Regulations The five-year minimum retention period regulation 40 sets, what starts the clock, and the ten-year ceiling that applies alongside it. Read guide
- Storing client identity evidence securely in New Zealand Practical steps for storing client identity evidence securely, grounded in the AML/CFT Act's record-keeping rule and Privacy Act principle 5. Read guide
- Setting a record retention schedule under New Zealand's AML/CFT Act How long the AML/CFT Act requires client records to be kept, and what 'end of the business relationship' means for the clock. Read guide
- Storing client identity evidence securely in Canada Keeping identity evidence retrievable for FINTRAC while protecting it the way PIPEDA's safeguards principle expects. Read guide
- Setting a client record retention schedule in Canada FINTRAC's five year retention period for accountants, and why the start date depends on the record type. Read guide
- Storing client identity evidence securely What US tax and accounting practice actually requires for safeguarding client identity data, and where to start. Read guide
- Setting a record retention schedule for IRS tax records The IRS's own retention periods for tax records, and how they differ from your state bar's trust-account retention rule. Read guide
- Storing client identity evidence securely under GDPR Article 32 What GDPR's security of processing obligation expects when you're storing KYC and due diligence evidence. Read guide
- Setting a record retention schedule: the EU AML floor and GDPR minimisation How to reconcile the EU AML framework's retention floor with GDPR's rule against keeping data longer than necessary. Read guide
- Storing client identity evidence securely under the PDPA What the PDPA's Protection Obligation practically expects a firm to do with client identity evidence it holds. Read guide
- Setting a record-retention schedule for compliance evidence Reconciling the AML record-keeping minimum with the PDPA's separate limit on how long personal data can be kept. Read guide
- Storing client identity evidence securely Practical steps to secure identity evidence you hold, grounded in the Personal Data (Privacy) Ordinance's DPP4. Read guide
- Setting a record-retention schedule for CDD evidence How long to keep customer due diligence records under AMLO, and how that interacts with PDPO's retention-limitation principle. Read guide
Regulatory requirements
30 guides
Understand the obligations that may apply to your firm and the actions they require.
- AUSTRAC Tranche 2: what your firm needs to have in place What AUSTRAC Tranche 2 means for accountants, lawyers, conveyancers and other newly regulated firms: designated services, enrolment, and record keeping. Read guide
- How to enrol your firm with AUSTRAC How and when accountants, lawyers, conveyancers and other newly regulated firms enrol with AUSTRAC under Tranche 2, including the 29 July 2026 deadline. Read guide
- Appointing an AML/CTF compliance officer Who newly regulated firms generally appoint as their AML/CTF compliance officer under Tranche 2, and what the role oversees day to day. Read guide
- Building your firm's AML/CTF program How newly regulated firms generally put an AML/CTF program in place under Tranche 2: risk assessment, policies, controls and oversight. Read guide
- Running customer due diligence under Tranche 2 How newly regulated firms generally collect, verify and refresh client identity, beneficial ownership and source-of-funds evidence. Read guide
- Reporting and record-keeping under Tranche 2 What newly regulated firms generally need to report to AUSTRAC and how long AML/CTF records generally need to be kept. Read guide
- Privacy Act notices for client information requests What the Privacy Act actually requires you to tell a client when you collect their personal information. Read guide
- TPB client record-keeping standard for tax practitioners What the TPB's obligation to keep proper client records actually expects a tax practitioner's records to contain. Read guide
- Cyber incident and ransomware reporting obligations What your firm needs to do if it experiences a cyber incident or makes a ransomware payment involving client data. Read guide
- UK Money Laundering Regulations client due diligence overview When and why the UK Money Laundering Regulations require your firm to carry out customer due diligence. Read guide
- UK GDPR data subject access requests for client information How your firm should respond to a UK GDPR subject access request from a client, and within what timeframe. Read guide
- Companies House identity verification for company clients What UK company law now requires when you act for a company client's directors and people with significant control. Read guide
- New Zealand AML/CFT Act client due diligence overview A practical overview of what the AML/CFT Act requires when establishing and verifying a New Zealand client relationship. Read guide
- New Zealand Privacy Act 2020 client information requests What Information Privacy Principle 3 requires you to tell a client when you collect their information directly. Read guide
- New Zealand Companies Office identity verification for company clients Why the Companies Register alone doesn't satisfy your identity-verification obligations for a company client. Read guide
- Canada FINTRAC client identification requirements overview The methods FINTRAC accepts for verifying an individual client's identity, and this program's first Canadian guide. Read guide
- PIPEDA client privacy requests: how and when to respond What PIPEDA requires when a client asks what personal information your firm holds about them. Read guide
- Canada beneficial ownership registry requirements for company clients What Canada's individuals-with-significant-control registry requires for a company client. Read guide
- US Corporate Transparency Act beneficial ownership reporting, current status The current, significantly narrowed scope of Corporate Transparency Act beneficial ownership reporting. Read guide
- Client trust account recordkeeping: the ABA Model Rule baseline The ABA Model Rule baseline for client trust account records, and why your state bar's own rule governs. Read guide
- IRS Form W-9 and W-8 collection for tax reporting clients When to collect Form W-9 versus Form W-8 from a client, and what each form is used for. Read guide
- GDPR data controller obligations for client personal data The core GDPR obligations that apply when your firm handles a client's personal data as data controller. Read guide
- Which professional-services firms are obliged entities under EU AML rules Whether auditors, accountants, and tax advisers are obliged entities under EU anti-money laundering rules, and what that means. Read guide
- What's EU-wide and what your member state sets independently Which EU compliance rules apply uniformly across all 27 member states, and which are set separately by each one. Read guide
- PDPA obligations when collecting client personal data An overview of the PDPA's Consent, Purpose Limitation, and Notification Obligations for a firm collecting client data. Read guide
- ACRA's register of registrable controllers requirement explained An overview of who must keep a register of registrable controllers, who counts, and what the lodgment deadlines are. Read guide
- CDD obligations for corporate service providers under the CSP Act 2024 What being a registered corporate service provider in Singapore requires for customer due diligence. Read guide
- PDPO principles for collecting and using client data An overview of the Personal Data (Privacy) Ordinance's collection and use principles for a professional-services firm. Read guide
- Significant Controllers Register requirements overview An overview of the Companies Ordinance's Significant Controllers Register duty, and what it means for verifying ownership. Read guide
- TCSP licensing and AML/CFT obligations overview An overview of Hong Kong's Trust or Company Service Provider licensing regime and who actually needs a licence. Read guide
Guidance for your profession
12 guides
Practical guidance shaped around the work performed by your profession.
- AML/CTF operating playbook for accounting firms How AUSTRAC's Tranche 2 obligations apply to the specific services an accounting firm provides. Read guide
- AML/CTF operating playbook for legal professionals How AUSTRAC's Tranche 2 obligations apply to the specific legal services that trigger them. Read guide
- AML/CTF and property settlement playbook for conveyancers How AUSTRAC's Tranche 2 obligations sit alongside ARNECC's existing settlement identity rules. Read guide
- AML/CTF operating playbook for real estate professionals How AUSTRAC's Tranche 2 obligations apply to the specific real estate services that trigger them. Read guide
- AML/CTF operating playbook for trust and company service providers How AUSTRAC's Tranche 2 obligations apply to the specific trust and company services that trigger them. Read guide
- AML operating playbook for UK accounting firms How UK accountancy service providers register for money laundering supervision, and what running a compliant practice involves day to day. Read guide
- AML/CFT operating playbook for New Zealand accounting firms A practical operating playbook for running an AML/CFT-compliant accounting practice in New Zealand as a Phase 2 reporting entity. Read guide
- AML/CTF operating playbook for Canadian accounting firms How FINTRAC's compliance program, due diligence, and record-keeping rules fit together for an accounting practice. Read guide
- Operating playbook for US accounting firms: what genuinely applies today An honest playbook for what actually applies to US accounting firms today, since no single federal AML regime covers them. Read guide
- GDPR and AML operating playbook for EU accounting and audit firms How an EU accounting or audit firm's dual GDPR and AML obligations fit together in practice. Read guide
- Operating playbook for Singapore accounting and corporate-secretarial firms How ACRA oversight, PDPA data handling, and CDD obligations combine for a Singapore accounting firm's day-to-day work. Read guide
- Operating playbook for Hong Kong accounting firms How HKICPA supervision, PDPO obligations, and AMLO/TCSP CDD duties apply together to a Hong Kong accounting firm. Read guide
Guidance for this country is not available yet.