Before the First Matter Opens: What Customer Due Diligence Now Demands of Australian Law Firms

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) has applied to legal practitioners for four months. Customer due diligence (CDD) is no longer a planning exercise. It is a daily operational test. Obligations for the so-called “tranche 2” professions commenced on 1 July 2026, and the enrolment window with AUSTRAC (the Australian Transaction Reports and Analysis Centre, the national AML/CTF regulator) closed on 29 July 2026. For firms that provide a designated service, the practical question is now whether the CDD process is working matter by matter.

This article steps back to the fundamentals. According to AUSTRAC’s published guidance, CDD is the mechanism through which a firm identifies and mitigates money laundering, terrorism financing and proliferation financing (ML/TF/PF) risk from the start of a client relationship.

Three layers, not one

AUSTRAC’s obligations factsheet for tranche 2 reporting entities describes CDD in three parts. Initial CDD means establishing certain information about a customer, on reasonable grounds, before the designated service begins “in most cases”. Ongoing CDD runs for the life of the relationship and covers monitoring transactions and behaviour for suspicious activity, updating the customer’s risk profile when triggers arise, and reviewing and re-verifying information as needed. Enhanced CDD must be applied where the ML/TF/PF risk is high.

For a law firm, the timing point matters most. The factsheet’s default is that initial CDD comes first, which sits uneasily with the commercial pressure to open a matter quickly. Firms that treat CDD as a back-office check, rather than part of intake, will feel that tension most.

The risk assessment drives everything

CDD is not a uniform checklist. The Law Society of New South Wales describes the risk assessment as the cornerstone of the AML/CTF framework and part of the AML/CTF program. It says firms should assess ML/TF/PF risk across four elements: customer types (including politically exposed persons, or PEPs), the designated services provided from July 2026, the delivery method (face to face or online), and the foreign countries involved, including where clients and counterparties are based.

The level of CDD applied to a given client should trace back to that assessment. A firm that cannot explain why a client was treated as lower or higher risk will struggle to show the regulator that its program is operating as designed. The Law Society’s practical advice is to build on existing risk management frameworks, document the workings, and keep the assessment dynamic, with review triggers such as emerging risks, AUSTRAC alerts or significant changes to clients, services or countries.

Governance and record-keeping sit behind the process

AUSTRAC’s guidance states that a fit and proper AML/CTF compliance officer must oversee day-to-day implementation, a senior manager must approve the documented program, and an independent evaluation is required at least once every three years. CDD decisions are only defensible if they are recorded. Under AUSTRAC’s record-keeping guidance, CDD records (section 111 of the AML/CTF Act) must capture the customer information collected, the steps taken to verify it, and the analysis that set the level of CDD. Firms must keep them for seven years after the business relationship ends or an occasional transaction completes.

Existing clients and reporting triggers

The factsheet also addresses clients who pre-date the regime. Initial or ongoing CDD is not required for pre-commencement customers until either a suspicious matter report must be filed about them, or a significant change in the nature and purpose of the relationship results in a medium or high ML/TF/PF risk rating. Firms should have a clear way of spotting that second trigger, because it is easy to miss in a long-running relationship. Suspicious matter reports are due within 24 hours of forming a suspicion for terrorism financing, or within three business days for other matters.

Technology can reduce the manual load here. Legl, for example, supports law firms with digital client onboarding and risk-assessment workflows, though the obligation itself rests with the firm whichever tools it uses.

Key takeaways for compliance officers

• Put initial CDD at the front of intake, so it is complete before a designated service begins.
• Tie each client’s CDD level to the documented risk assessment, covering customer type, service, delivery channel and geography.
• Define review triggers for ongoing CDD, including the change-in-relationship trigger for pre-commencement clients.
• Record the information collected, the verification steps and the reasoning, and retain them for seven years.
• Confirm senior manager approval of the program and diarise the independent evaluation.

Looking ahead

Watch for further AUSTRAC guidance and supervisory activity directed at the legal sector as the first reporting cycles come in, and for updates from the Law Council of Australia and state law societies. The Law Council’s January 2026 submission asked for clarity on what “customer” means and on the scope of the professional services in Table 6 of section 6. How those points are resolved will shape how CDD applies to day-to-day legal work. Compliance officers should check AUSTRAC’s website and their law society’s AML/CTF hub regularly, and should not treat this article as legal advice.

Sources

• AUSTRAC — Summary of AML/CTF obligations for tranche 2 entities
• AUSTRAC — AML/CTF obligations factsheet for tranche 2 reporting entities (July 2025)
• AUSTRAC — Record keeping overview
• Law Society of NSW — Top five tips to prepare for AML reforms
• Law Council of Australia — Proposed 2026 amendments to the AML/CTF Act (submission, 27 January 2026)