Simplified customer due diligence lets you do less work on a customer whose money laundering and terrorism financing risk you have assessed as low. Less collecting. Less verifying. Less frequent checking afterwards.
It is the third setting on the same dial that carries standard customer due diligence and enhanced due diligence on it. Every customer sits somewhere on that dial, and where they sit is decided by your risk assessment, not by how long you have known them.
AUSTRAC is direct about what it is not. Simplified CDD is not an exemption from your initial or ongoing CDD obligations. You still collect all the required KYC information. You are turning the intensity down, not switching the obligation off.
Three conditions, and all 3 have to hold
For ongoing CDD, section 31 of the AML/CTF Act sets out when you may apply simplified measures. AUSTRAC’s guidance lists them:
- the customer’s ML/TF risk is low
- you are not required to apply enhanced CDD
- your AML/CTF policies deal with applying simplified CDD measures
The third one is where small firms come unstuck.
A partner can be entirely correct that a 20 year client running a suburban newsagency through a single company is low risk. That judgement does not give you access to simplified CDD if your AML/CTF program never says what simplified CDD looks like in your firm, when it applies, and who signs off on it. The availability of the concession is a property of your documented policies, not of the customer.
Which means the practical order is backwards from how people assume. You write the policy first. Then you can use it.
What you actually get
On the ongoing side, AUSTRAC describes it as still meeting your obligations through less intensive monitoring activities, and by updating and reverifying KYC information less frequently.
On the initial side, simplified CDD lets you streamline identification and verification for certain low risk customers. AUSTRAC’s initial CDD guidance treats it as a step in the sequence: identify the customer’s ML/TF risk, work out whether enhanced CDD is required, then work out whether simplified CDD or a deemed compliance provision is available.
What it does not get you is a shorter list of things you need to know. You still establish who the customer is, whether they are acting for somebody else, who the beneficial owners are, and that there is no legal barrier to providing the service. You still form a view about ML/TF risk. You still keep records.
It does not survive contact with an SMR
If you submit a suspicious matter report about a customer and keep providing them with designated services, you must apply enhanced CDD. Simplified is gone for that relationship.
There is a wrinkle worth knowing. Where you have an SMR obligation and reasonably believe that carrying out an ongoing CDD step would tip the customer off to your suspicion, you do not have to carry out that step. You still do as much ongoing CDD as you can without alerting them. That is a narrower carve out than it sounds and it is not a relative of simplified CDD, it is a tipping off provision.
The transitional relief everyone is quoting is probably not yours
There is a 3 year transitional period running from 31 March 2026 to 31 March 2029 that lets some businesses keep using the old applicable customer identification procedures instead of the new initial CDD obligations. It gets mentioned constantly and it is being widely misread.
Read the condition. You can only use it if you were enrolled as a reporting entity on 30 March 2026, and you maintain policies requiring you to use ACIP that complied with the Rules in force on that date.
An accounting or law firm that became a reporting entity because table 6 commenced on 1 July 2026 was not enrolled on 30 March 2026. The transition is not available. Tranche 2 firms go straight into the new initial CDD framework with no old procedure to fall back on, which is the opposite of the impression a lot of the commentary leaves.
The compliance officer notification timing did get extended for newly regulated businesses, to the later of 14 days after enrolment or 29 July 2026. That is a different provision and it is genuinely available.
Choosing simplified CDD creates its own paperwork
This is the part that surprises people who think of simplified as the lighter option.
Under sections 107 and 111 you must keep records showing how you complied with your ongoing CDD obligations, including your identification, analysis and assessment of the customer’s ML/TF risk, and any decisions your business makes about how you conduct ongoing CDD on that customer.
A decision to apply simplified measures is exactly that kind of decision. So the file needs the risk assessment that produced the low rating, the reasoning, and the record of the decision itself. Compared against a standard file you have swapped verification work for documentation work. It is usually still less effort, but not by as much as the name suggests, and a file that just contains less material without explaining why is the worst of both.
What low risk looks like, and what quietly kills it
Low risk in an accounting practice tends to look like a long standing domestic customer with a simple structure, transparent business activity you understand, no cash of any consequence, no overseas connections and no reason for anyone to be obscuring anything.
The disqualifiers are the ones already written into the regime. A politically exposed person connection anywhere in the ownership or control chain. A customer or beneficial owner in a higher risk jurisdiction. A structure whose complexity has no commercial explanation. Anything that has already produced an SMR.
The one people miss is the service itself. Risk is not only a property of the customer. A trustworthy client of 15 years asking you to do something that sits in a higher risk part of your designated service range has changed the risk picture, and your ML/TF risk assessment should already tell you which of your services those are.
A short checklist
- Confirm your AML/CTF policies actually describe simplified CDD. If they do not, you cannot use it, whatever the customer looks like.
- Make sure your firm level ML/TF risk assessment exists and is current, because every customer rating hangs off it.
- Decide who in the firm can assign a low rating, and write it down.
- Define what simplified means concretely in your practice: which verification steps, what monitoring, what review interval.
- Build the record. Rating, reasoning, decision, date, person.
- Set a trigger list that pulls a customer back up to standard or enhanced, and make sure someone owns it.
Holding all 6 of those in a spreadsheet works until the day someone has to prove the decision trail. HP-KYC keeps the rating, the reasoning and the review interval attached to the customer record.
Frequently asked questions
Is simplified due diligence the same as no due diligence?
No. AUSTRAC states that simplified CDD is not an exemption from your initial or ongoing CDD obligations, and that you must still collect all the required KYC information. It reduces how much you verify and how often you recheck, not what you are obliged to establish about the customer.
Can I apply simplified CDD to a long standing client?
Only if their ML/TF risk is low, enhanced CDD is not required, and your AML/CTF policies deal with applying simplified measures. Length of relationship is evidence you can weigh in the risk assessment, not a basis on its own. A client of 20 years who asks you to do something in a higher risk service category can move above the low rating.
Do I need to write simplified CDD into my AML/CTF program before using it?
Yes. Having policies that deal with applying simplified CDD measures is one of the 3 statutory conditions, so a firm whose program is silent on the point does not have the option available at all. This is the condition small practices most often overlook.
Can Tranche 2 firms use the 3 year transitional period for initial CDD?
Generally no. The transition is only open to businesses that were enrolled as a reporting entity on 30 March 2026 and that maintained compliant ACIP policies at that date. Firms newly regulated because table 6 commenced on 1 July 2026 do not meet that condition and move straight to the new initial CDD framework.
What happens to simplified CDD if I lodge a suspicious matter report?
It stops. Where you submit an SMR about a customer and continue providing designated services to them, enhanced CDD applies. You also need to conduct as much ongoing CDD as you can without alerting the customer to your suspicion.
Does simplified CDD reduce my record keeping?
Not really. You still have to keep records of your identification, analysis and assessment of the customer’s ML/TF risk and of decisions about how you conduct ongoing CDD, and the decision to apply simplified measures is itself one of those decisions. The verification work shrinks while the documentation work stays or grows.
The technical detail
Simplified ongoing CDD. Section 31, Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Available where all of the following are satisfied: the customer’s ML/TF risk is low; enhanced CDD is not required; and the reporting entity’s AML/CTF policies deal with applying simplified CDD measures. Permits less intensive monitoring and less frequent updating and reverification of KYC information, without displacing the underlying ongoing CDD obligation.
Ongoing CDD generally. Sections 30, 32 and 39D. AML/CTF policies and ongoing CDD, sections 26F and 30. Monitoring obligations, sections 30 and 41 and Rules section 6-35. Nested services relationships, Rules section 6-26.
Initial CDD. Sections 28 and 136 to 141. Must be completed before a designated service starts, by establishing the required matters on reasonable grounds. Delayed initial CDD, sections 28(2) and 111 and Rules sections 6-21 and 6-23.
Enhanced CDD override. Where an SMR obligation arises and designated services continue, enhanced CDD applies. Where complying with an ongoing CDD requirement would or could reasonably be expected to alert the customer to the suspicion, that requirement need not be carried out, and as much ongoing CDD as possible must still be done.
Record keeping. Sections 107 and 111. Records must cover the customer’s transactions, the identification, analysis and assessment of the customer’s ML/TF risk, and decisions about how ongoing CDD is conducted.
Initial CDD transition. Part 3, AML/CTF Transitional Rules 2026. Runs 31 March 2026 to 31 March 2029. Conditional on having been enrolled as a reporting entity on 30 March 2026 and maintaining policies requiring ACIP compliant with the Rules in force on that date. Transitional policies listing customer classes and end dates were required by 1 July 2026. Applies to initial CDD only; new ongoing CDD obligations apply from 31 March 2026 regardless.
Compliance officer notification. Part 8, AML/CTF Transitional Rules 2026. Entities enrolled on 30 March 2026, by 30 May 2026. Newly regulated businesses, the later of 14 days after enrolment or 29 July 2026.
First independent evaluation for newly regulated businesses. Part 7, AML/CTF Transitional Rules 2026. Staggered by the last 2 digits of the AUSTRAC account number: 30 June 2029 where both are odd; 31 December 2029 where the second last is odd and the last is even; 30 June 2030 where both are even; 31 December 2030 where the second last is even and the last is odd.
Commencement. Reformed obligations from 31 March 2026 for existing reporting entities and 1 July 2026 for table 6 professional services. Penalty unit $364 from 1 July 2026.
