Customer Onboarding Kyc: What Must Happen First?

Customer onboarding KYC must happen before the firm provides a designated service. First identify whether the proposed work is covered, then complete the checks your approved AML/CTF program requires for that client's risk. The commencement date comes from Queensland Law Society; the timing and risk-based approach are explained by MinterEllison.

Updated 3 October 2026. This is general information, not legal advice. Use AUSTRAC as the regulatory source of truth, alongside your professional body and your own lawyer.

Which Accounting, Legal and Real Estate Services Need Onboarding Kyc?

The starting point is the work you provide. A professional title alone does not tell your receptionist which engagements need checks.

KKI Lawyers identifies accounting activities such as establishing companies or trusts and assisting with business acquisitions, disposals or restructures. It distinguishes advice or commentary from actively implementing or facilitating a transaction, and identifies real estate agents assisting with planning or executing property transactions.

I'd have the firm's compliance adviser map the actual services offered to the designated-service rules. That gives intake staff a usable starting point instead of asking them to interpret legislation while opening a file.

What Does Initial Customer Due Diligence Actually Require?

KYC is the identification and verification work within customer due diligence. QLS describes initial CDD as using reliable, independent information appropriate to the client's risk. MinterEllison also identifies ownership structures and the nature and purpose of the relationship.

The table draws on the QLS and MinterEllison guidance linked above. QLS says enhanced CDD typically includes detailed source-of-wealth and source-of-funds information for foreign PEPs and high-risk domestic or international PEPs. MinterEllison says simplified CDD is permitted only for low-risk customers without red flags.

So I'd avoid a universal document list. Start with the approved checklist for that client type, then let the responsible person decide whether the risk calls for more.

When Must Kyc Be Finished Before a Designated Service?

MinterEllison states that initial CDD must be completed at the commencement of the customer relationship and before any designated service is provided. In intake terms, I would build a clear approval point before staff begin the covered work.

1. Record the proposed engagement and identify the designated service.
2. Request the information required by the firm's approved program.
3. Have the responsible person complete the risk assessment, verification and any escalation.
4. Record clearance before releasing the matter for the designated service.

Limited delayed-CDD rules exist for some property transactions. Check AUSTRAC's current guidance before relying on an exception. I would never build a default delay into intake because a client is in a hurry.

Do Existing Clients Need to Be Re-Verified?

Not automatically. QLS says clients existing as at 1 July 2026 do not require initial or ongoing CDD unless a suspicious matter report must be filed or a significant change increases the client's risk.

That does not promise an existing client will never receive another document request. Pitcher Partners explains that information may be requested despite an existing relationship, for example where the service involves a new entity.

A firm may choose to refresh older files. I'd document that as a practice choice and explain the reason to clients, rather than describe blanket re-verification as the legal minimum.

Can You Rely on Another Firm's Kyc or Outsource the Work?

There are conditions. For real estate professionals, Holding Redlich explains that reliance can involve a reporting entity or a qualifying foreign equivalent regulated under FATF-aligned laws. Responsibilities must be set out explicitly, and Holding Redlich says access to the verification data should be immediate, such as through an IT system, or as soon as possible after a request.

That is more than accepting an email saying somebody else checked the client. Ask your adviser whether the arrangement qualifies and how your firm will obtain the supporting records.

QLS is clear: outsourcing AML/CTF functions does not remove your compliance responsibility. Its FAQ also explains that a solicitor's CDD obligation applies to the solicitor's own client.

What Should New Clients Know Before Onboarding?

Explain the request before sending a form. REIA's consumer guidance explains identity checks for buyers and sellers and warns that additional information may be needed.

I would adapt this wording to the firm's approved process:

Before we begin the covered work, we need information to complete our client checks. Depending on your circumstances, we may request identity documents, details of anyone acting for you, and information about ownership. Please use the document channel we provide. We will explain any further requests.

Keep the request specific. My guide to what a client intake form should include helps organise the questions; your AML/CTF program determines the compliance requirements.

What Are the Red Flags in an Onboarding Kyc Process?

• Covered work starts before recorded clearance, despite MinterEllison's initial CDD timing guidance.
• A real estate firm accepts an email saying KYC is done without the qualifying arrangement and verification-data access Holding Redlich describes.
• Blanket re-verification is called the legal minimum, contrary to QLS's existing-client position.

Where Can Automation Help, and Which Decisions Stay with a Person?

For a small Australian accounting, legal or real estate firm that wants the intake admin around its approved AML/CTF program designed, built and then run for it, with a person making every risk rating, verification and escalation decision, Truespeak is built for exactly that.

I spent 20+ years in commercial roles, including at Optus, Samsung and Nikon, and I've built 25 working productivity systems.

A proposed intake automation workflow can request documents, chase missing items and organise the file for review. Truespeak does not give legal advice or perform identity verification. Where a tool has no usable connection, the step stays manual.

I'd scope the document checklist, approval gate and exception owner before choosing tools. Truespeak quotes after a discovery call, so ask for separate scopes for compliance advice, verification and intake administration.

For the fuller administration design, read my Tranche 2 compliance workflow article. My human approval guide explains how to keep sensitive decisions with the responsible person.