Customer due diligence at auction — compressed timelines

At auction, the buyer may not be known until the hammer falls. The law allows for that, within firm limits.

When the buyer becomes your customer. Under s 6, table 5, item 1 of the AML/CTF Act 2006 (Cth), the customers of a brokering service are both the seller and the buyer. AUSTRAC's guidance is that a seller's agent starts providing the designated service to the buyer "when it's reasonably expected that the transaction will proceed". That is typically when the offer has been accepted and the contract signed. For auctions, AUSTRAC says it will often be appropriate to delay initial CDD, because the short time between the end of the auction and signing the contract is not enough to complete it.

The legal position. Section 28(1) says you must not start providing a designated service until you have established the s 28(2) matters on reasonable grounds. Section 29 is the exception. You may start before CDD is complete only if all of these apply:

• the Rules allow it: for a seller's agent, Rule 6-32(1) covers the buyer once you have started acting for the seller;
• you determine on reasonable grounds that starting first is essential to avoid interrupting the ordinary course of business;
• your policies provide for finishing CDD as soon as reasonably practicable, and within the period set by the Rules;
• you determine on reasonable grounds that the extra ML/TF risk of finishing later is low;
• you implement policies to manage that risk;
• you meet any other requirements in the Rules.

Rule 6-32(4), as amended by F2026L00353, sets the period. It ends at the earlier of 28 days after exchange of contracts and 3 days before the initially agreed settlement day. The clock runs from the contract dates, not from the hammer. Suppose contracts are exchanged on auction day and settlement is agreed for 30 days later. The deadline is then day 27, not day 28. The Rule counts days, not business days. AUSTRAC's guidance warns that civil penalties may apply if KYC information is not verified within the required timeframes.

The relief covers only the party you don't act for. AUSTRAC's guidance is that your own client, the seller, must be through initial CDD before you start acting for them. If you cannot reasonably conclude that the extra risk of delay is low, the s 29 exception is not available for that buyer.

On the day: practical steps. The Act does not prescribe any of these steps. They are how agencies keep to the deadline.

• At contract signing, collect the buyer's full name, date of birth and residential address. This is the baseline AUSTRAC suggests for individuals. Also record whether they are buying in their own name or through a company, trust or SMSF.
• Record who is paying the deposit, and how.
• Send the identity verification request the same day. Diarise the Rule 6-32(4) deadline as soon as the settlement date is known.
• If you register bidders before the auction, you can collect identity details at that point and cut the work afterwards.

Cash deposits. A payment of $10,000 or more in physical currency is a threshold transaction (Act s 5). You must report it to AUSTRAC within 10 business days after the day it takes place (s 43(2)). A deposit paid by electronic transfer is not physical currency. A large cash payment is also relevant to whether you can say the extra risk of delaying CDD is low.

Company, trust and SMSF buyers. The work is heavier, so start straight after the auction.

• Companies. You collect the details in Rule 6-2(2). These include evidence that the company exists, the powers that bind and govern it, and the names of the people with primary responsibility for its governance. You also collect information about its ownership and control structure (Rule 6-2(3)).
• Trusts. Rule 6-3 adds the kind of trust and the trustees. It also requires each beneficiary or, where that is not possible, a description of each class of beneficiary. You also collect the control structure and any settlor, appointor, guardian or protector.

Beneficial owners are individuals who own 25% or more of the entity, directly or indirectly, or who control it (s 5). How much you verify depends on the customer's risk (s 28(3)(d)).

You may be unable to identify a company's beneficial owners after taking all reasonable steps. If so, Rule 6-8(1) treats that matter as established once two things are done:

• you have recorded the steps you took and the difficulties you met;
• you have collected the identity of the chief executive officer or equivalent, and verified it as far as the risk requires.

That fallback covers bodies corporate, partnerships and unincorporated associations. It does not cover trusts.

If the buyer won't cooperate. A refusal does not automatically end the matter, but you must deal with it:

• Record the steps you took and the difficulties you met.
• Consider whether a suspicious matter report is required, and record that consideration. The buyer's failure to cooperate must be taken into account (Rule 9-4A). If you form a suspicion, the report is due within 3 business days, or 24 hours for terrorism financing (s 41(2)).
• If you act for the seller and have taken all reasonable steps, Rule 6-33(2) treats the buyer's CDD matters as established once those records exist.

What to do next. Write the auction workflow into your programme. It should cover who collects the buyer's details at signing, who sends the verification request, how the Rule 6-32(4) deadline is diarised, and who decides on escalation if a buyer does not cooperate. On each file, record why delaying CDD was essential and why the extra risk was low, because s 29 requires both determinations for each buyer.