Client verification Current
Verifying an existing client's details are still current
A practical approach to ongoing, risk-based re-verification.
Client details verified at onboarding don't stay current forever. This guide sets out a practical, risk-based approach to deciding when to review and re-verify an existing client's details. It is general information, not legal or compliance advice.
Action plan
1 Set a review frequency proportional to risk AUSTRAC expects review frequency to match the client's risk, not a single fixed interval for everyone.
AUSTRAC's guidance is that customer information must be reviewed, and where appropriate updated and reverified, at a frequency appropriate to the customer's risk. This means a single fixed review interval for every client isn't the expectation; your firm's own risk assessment should drive how often each client is reviewed.
- Set review frequency according to each client's own assessed risk, not one interval for every client
- Document the basis for the frequency chosen in your firm's AML/CTF policies
- Review higher-risk clients more frequently than lower-risk ones
Done when: A risk-based review frequency has been set and documented for the client
AUSTRAC: reviewing and updating customers' risk and KYC information2 Watch for triggers that call for an out-of-cycle review Certain changes should prompt a review regardless of where the client sits in their normal cycle.
Beyond the scheduled cycle, AUSTRAC's guidance points to specific triggers that should prompt a review: doubts about whether previously collected information is still adequate or true, the client seeking a new service or product with a higher ML/TF risk, a sudden and unexplained increase in transaction volumes, a change to the client's corporate structure or beneficial owners, or a change in how services are delivered to the client, such as the involvement of an agent.
- Review out of cycle if you doubt the adequacy or accuracy of information already held
- Review if the client seeks a new service or product carrying a higher ML/TF risk, or if the client's corporate structure, beneficial owners, or service delivery channel changes
- Review if there's a sudden, unexplained increase in the client's transaction volumes
Done when: A trigger-based review has been carried out where any of the relevant circumstances occurred
AUSTRAC: reviewing and updating customers' risk and KYC information3 Reverify and record what changed A review that finds a change should lead to reverification and an updated record, not just a note.
Where a review, scheduled or trigger-based, finds that a client's details have changed, reverify the updated information using the same evidence standard you'd apply to a new client, and record what changed and when.
- Reverify updated details using the same evidence standard as initial verification
- Record what changed, when, and how it was reverified
- Update the client's ongoing risk rating if the change affects it
Done when: Any change found during a review has been reverified and recorded