For accountants, CDD starts with one question: are you providing a designated service?
Not every accounting engagement is automatically regulated. When your practice provides a professional designated service, you need to identify the client, complete the required CDD, understand ownership and control where relevant, assess ML/TF risk, monitor the client while the service is being provided, respond to red flags and retain evidence of the decisions you make.
AML Guardian connects KYC, KYB, ownership structures, AML screening, Initial CDD, client risk, approvals, Service Case Management, ongoing monitoring and audit evidence in one workflow.
Not every accounting service is a designated service.
AUSTRAC regulates specific professional services. General advice or ordinary accounting work does not become regulated merely because an accountant provides it. The question is whether the actual work falls within a designated service and, for some services, whether your actions directly advance the relevant transaction or outcome.
Transactions
Assisting with the planning or execution of transactions involving real estate, a body corporate or legal arrangement, or certain equity/debt financing.
Structures
Creating or restructuring companies, trusts and other legal arrangements; selling shelf companies; or providing relevant nominee/officeholder services.
Property & addresses
Receiving, holding, controlling or managing property in connection with specified transactions, or providing a registered office/principal place of business address in the circumstances covered by the Act.
Build the designated-service decision into client onboarding.
Before deciding what CDD is required, identify the service being requested. For an accounting practice this is critical because the same long-term client may receive both regulated and non-regulated services at different times.
KYC is part of CDD. For accounting clients, entity and ownership information can be just as important.
Once the designated service and customer are identified, collect and verify the information required for that customer type, assess risk and decide whether the service can proceed. The process will differ for an individual, sole trader, company, partnership, trust or government body.
Identity verification, AML screening and CDD in one connected review.
For individual clients, AML Guardian can bring together identity and document verification, biometric verification, onboarding questions, PEP, sanctions, adverse media, country risk, fitness and probity indicators and the practice-side onboarding risk assessment.
For business and trust clients, KYB can connect the entity record to significant persons and associated individual or business profiles so ownership and control information can be reviewed alongside verification and risk.
Company and trust work can change who you need to understand.
When a practice helps create or restructure a company or legal arrangement, AUSTRAC's designated-service rules can make multiple people relevant to the customer relationship. For a company creation this can include the person receiving the service together with the proposed beneficial owners and directors. For creation of an express trust, relevant persons can include the trustee, settlor and beneficiaries.
That is why ownership and control should not be an isolated spreadsheet. AML Guardian can associate significant persons to client records, initiate KYC/KYB and show verification and risk status in the ownership structure.
The same service can present very different risks for different clients.
AUSTRAC's accounting-sector guidance identifies elevated risks around complex ownership, foreign PEPs, high-risk jurisdictions, unexplained wealth, unusual use of physical currency or virtual assets, remote delivery and structures that obscure beneficial ownership.
Client profile
Consider who the client is, their industry, wealth profile, PEP exposure, behaviour and whether the information they provide is consistent.
Entity & ownership
Complex, unusual or cross-border structures, nominee arrangements and unclear beneficial ownership can increase the level of risk.
Service & activity
Company/trust creation, property or business transactions, financing, managed property and unusual funding or transaction patterns may require closer review.
Initial CDD is not the end of the obligation.
Once the client is approved and the designated service begins, the practice must continue to monitor the client during the business relationship. AUSTRAC's accounting starter kit says ongoing CDD includes reviewing changes in behaviour or activity, responding to new triggers and updating information where required.
AML Guardian's Service Case Management module can connect the client to the actual regulated work so staff are not trying to monitor risk from a standalone KYC report.
From client request to the end of the regulated service
Determine whether the requested work is a professional designated service and when the practice starts providing it.
Confirm who receives the designated service and whether the CDD workflow is for an individual, sole trader, company, partnership, trust or other relevant person/entity.
Collect onboarding information, verify identity/entity information, understand ownership/control, complete PEP/sanctions and other risk checks, assess risk and record the onboarding decision.
Record the regulated service, relevant parties, purpose, case information and the activity being performed by the practice.
Review changing behaviour, ownership, transaction activity, instructions, funding, jurisdictions and other trigger events against your AML/CTF Program.
Apply Enhanced CDD, further verification, source of funds/source of wealth enquiries, Compliance Officer review, investigation or SMR assessment where required.
Where the business relationship continues, perform periodic and trigger-event reviews and keep KYC and client-risk information current in line with your AML/CTF Program.
When the designated service and business relationship end, stop ongoing monitoring as appropriate, close the matter and retain the required CDD, case and decision records.
Use the AUSTRAC logic without running the practice from Word forms.
AUSTRAC's accounting starter-kit library expressly says that if a practice integrates the forms into its existing systems during customisation, it can use those systems in place of the forms. AML Guardian is designed to operationalise the same client lifecycle in a connected compliance workflow.
| CDD activity | Manual / starter-kit approach | AML Guardian workflow |
|---|---|---|
| Designated-service decision | Staff judgement, checklist or matter note | Service selection / case context recorded against the client |
| Client onboarding | Separate onboarding form | Client record + onboarding compliance assessment |
| Identity / entity verification | Manual documents or separate provider | KYC/KYB workflow linked to the client |
| Ownership & control | ASIC/ABR searches, diagrams and spreadsheets | Significant Persons table/tree + linked KYC/KYB profiles |
| AML screening | Separate PEP, sanctions and adverse-media evidence | Screening results linked to the client risk profile |
| Client risk & approval | Risk form plus email/paper sign-off | Onboarding risk assessment + CDD checklist + approval |
| Designated service | Matter file separate from compliance file | Service Case Management connected to the client |
| Ongoing CDD | Diary notes, spreadsheets and staff memory | Case activity, trigger reviews, EDD, monitoring and investigations |
| Evidence | Multiple folders and systems | Client, service, documents, decisions and audit trail connected |
Accounting services can be exploited to give criminal activity an appearance of legitimacy.
AUSTRAC highlights risks involving complex legal structures, nominee arrangements, unclear beneficial ownership, offshore jurisdictions, unexplained wealth, unusual transaction instructions and attempts to avoid KYC/CDD.
A red flag is not automatically proof of criminal activity. It is a trigger to examine the circumstances, apply the controls in your AML/CTF Program and determine whether further CDD, escalation or reporting is required.
Examples of accounting-sector triggers
Be able to reconstruct the client decision and the service you actually provided.
A strong compliance record should show who the client was, which designated service triggered the obligation, what was verified, how ownership and control were understood, what risks were identified, what happened during the service and why the practice decided to proceed, escalate or stop.
Client evidence
KYC/KYB, onboarding responses, significant persons, screening, customer risk, CDD approval and review history.
Service evidence
Designated-service details, associated parties/entities, case activity, documents, transactions where relevant, notes, investigations and tasks.
Decision evidence
Escalations, EDD, source of funds/wealth enquiries, Compliance Officer and senior-manager decisions, reports and audit logs.
CDD for accountants — practical answers
Do we have to KYC every accounting client?
AML/CTF CDD obligations are triggered by designated services, not simply by being an accounting client. Your practice may choose broader internal verification controls, but the statutory trigger should be assessed against the actual service provided.
Does tax advice automatically trigger AML/CTF CDD?
Not automatically. AUSTRAC gives an example where tax advice about a possible company sale does not by itself directly advance a transaction. The position can change when the firm is instructed to act and directly advance the transaction.
Does company or trust formation require more than KYC of the person who called us?
Potentially yes. The designated-service rules for creating a company or express trust can make additional people relevant, including proposed directors, beneficial owners, trustees, settlors and beneficiaries depending on the service and structure.
Does the obligation end once Initial CDD is approved?
No. During an ongoing business relationship you must continue monitoring for changes in activity, behaviour and risk and update information where required. If the one-off service and business relationship genuinely end, ongoing CDD can cease, while record-keeping obligations continue.
From designated-service assessment to ongoing CDD — keep the compliance workflow connected.
KYC, KYB, ownership structures, AML screening, Initial CDD, client risk, approval, Service Case Management, EDD, monitoring, investigations and evidence — in one platform.