AML/CTF Tranche 2 is live in Australia: the customer due diligence you now owe

On 1 July 2026 the second tranche of Australia's AML/CTF reforms took effect. Roughly 90,000 businesses that had never touched anti-money-laundering law woke up as reporting entities. If you run a law firm, a conveyancing practice, an accounting firm, a real estate agency, a property development business, a trust or company service provider, or you deal in precious metals and stones, the obligations are already yours — enrolment with AUSTRAC opened on 31 March 2026, and you must apply to enrol no later than 28 days after the day you start providing a designated service.

Most of the guidance written about this explains the law. Very little of it explains what you actually have to build. This post covers the second part.

Key takeaways

• Tranche 2 obligations commenced 1 July 2026. Enrolment with AUSTRAC opened 31 March 2026, and you must apply within 28 days of first providing a designated service.
• The newly captured sectors are legal practitioners, conveyancers, accountants, real estate agents and property developers, trust and company service providers, and dealers in precious metals and stones.
• Customer due diligence is the operational core: identify the customer, verify that identity from reliable and independent sources, identify beneficial owners for a company or trust, and screen everyone against sanctions and politically exposed person lists.
• Verification is not a one-off. You owe ongoing customer due diligence, which means re-screening your existing book as lists change, not just at onboarding.
• None of this requires a compliance department. A verification run costs $0.33 for the identity bundle plus $0.20 for the AML screen, and ongoing monitoring is $0.07 per customer per year.

What "customer due diligence" means in practice

The AML/CTF Act asks you to know four things before you provide a designated service. Written as engineering requirements rather than legal ones, they are:

1. Who is this person. Collect the customer's full name, date of birth, and residential address.

2. Is the person real, and are they who they claim to be. This is where a document check and a biometric check do the work. You read the identity document, confirm it is a genuine document rather than a photograph of a screen or a printed copy, and confirm that the person presenting it is physically present and is the person in the photograph.

3. If the customer is a company or a trust, who is behind it. Beneficial ownership is the part most new reporting entities underestimate. A conveyancer acting for a company buyer, or a TCSP incorporating a structure, needs the directors, the shareholders, and the individuals who ultimately own or control the entity — and then needs to identify those individuals too.

4. Is anyone in that picture sanctioned or politically exposed. Screening against sanctions lists, politically exposed person lists, and adverse media, for the customer and for each beneficial owner.

Then you keep records, and you keep watching.

Why the trust and company service provider case is the hardest

A single trust deed or company registration can involve four or five natural persons: the directors, the trustee, the settlor, the beneficial owners. Under Tranche 2 each of them needs identifying, and the entity itself needs verifying against the register.

Doing this by email — sending every director their own verification link and chasing them — is the failure mode that makes firms give up and go back to photocopying passports. The alternative is to run the company check and the individual checks as one linked flow, so that verifying the entity automatically produces the list of people who need verifying, and each of those checks hangs off the same case file.

Technical details

The identity half of a Tranche 2 check is a single session. You create it server-side, send the customer to the returned URL or mount the SDK, and receive the decision on a webhook.

curl -X POST https://verification.didit.me/v3/session/ \
  -H "x-api-key: $DIDIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "workflow_id": "your-tranche-2-workflow",
    "vendor_data": "matter-2026-0417",
    "callback": "https://yourfirm.com.au/webhooks/didit"
  }'

The workflow behind it chains the checks you need, in the order you need them:

Step	What it proves	Price
ID Verification	The document is genuine and the data is read correctly	$0.15
Passive Liveness	A real person is present, not a photo or a deepfake	$0.10
Face Match 1:1	The person present is the person on the document	$0.05
IP Analysis	Where the session actually originated	$0.03
AML Screening	Sanctions, PEP and adverse media across 1,300+ lists	$0.20
Ongoing AML Monitoring	Continuous re-screening as lists change	$0.07 / customer / year
Business Verification (KYB)	Registry record, directors, beneficial owners	From $2.00

The first four together are the $0.33 identity bundle. The first 500 verifications each month are free, per feature, which for a small practice is frequently the entire monthly volume.

For Australian customers, Didit reads the eight state and territory driver licence templates, the Australian passport, the Medicare card, the ImmiCard, citizenship certificates, visas, and birth, marriage and change-of-name certificates.

Ongoing due diligence is the part people forget

Screening a client once, on the day you onboard them, satisfies nobody. Sanctions lists change weekly. A client who was clean in July can appear on a list in November, and the obligation to notice is yours.

Ongoing AML Monitoring re-screens your entire customer book against the same 1,300+ lists and fires a webhook when someone's status changes. At $0.07 per customer per year, a practice with 2,000 active clients pays $140 annually to never have to think about it again.

Use cases

Law firms and conveyancers. Verification at engagement, tied to the matter number through vendor_data, so the compliance record and the matter file are the same record.

Accountants. Identity plus AML at client onboarding, with the company check attached when the client is an entity rather than an individual.

Real estate agencies and property developers. Purchaser verification before the designated service, run from a link the agent sends, with the branding of the agency rather than a third party.

Trust and company service providers. Entity verification that produces the beneficial owner list, with a linked identity check for each person on it.

How to integrate with Didit

1. Create a free account and take the 500 free verifications per month.
2. Build the workflow in the visual builder — drag in ID Verification, Liveness, Face Match, and AML Screening, then add Business Verification if you act for entities.
3. Point it at your matter or client reference with vendor_data.
4. Subscribe to the session.status.updated webhook and write the decision into your practice management system.
5. Turn on Ongoing AML Monitoring for every verified client.

Integration is typically a single afternoon. There is no minimum commitment, no annual contract requirement, and credits do not expire.

Frequently asked questions

Do I have to enrol with AUSTRAC even if I have not provided a designated service yet?

Enrolment opened on 31 March 2026, and the application must be made no later than 28 days after the day you start providing a designated service. If you are already providing one, the clock has started.

Is a scanned passport enough?

No. The whole point of the reform is verification from reliable and independent sources. A photograph of a document proves nothing about whether the person sending it is the person in it. That is what the liveness and face match steps are for, and it is why they cost $0.15 combined rather than nothing.

Can I verify a company's beneficial owners without making each of them do a full identity check?

You can screen them against sanctions and PEP lists from the data you already hold. Whether that is sufficient depends on the risk rating you assign under your AML/CTF program — that is a judgement for your compliance officer, not for a vendor.

What does this cost for a small practice?

Below 500 verifications a month, per feature, nothing. Above that, $0.33 for the identity bundle plus $0.20 for AML screening per client, and $0.07 per client per year for ongoing monitoring.

Is Didit an Australian company?

Didit is headquartered in San Francisco with engineering in Barcelona and serves customers in 220+ countries. Data is processed in the EU by default, and retention is configurable from one month to unlimited, with a delete endpoint if you need to hold nothing at all.

Ready to get started?

Read the AML Screening documentation for the API surface, look at what Didit covers in Australia, check the pricing, and then start free with 500 verifications a month.