Enhanced customer due diligence (ECDD) — when and how

Enhanced customer due diligence applies on top of standard CDD whenever the risk of money laundering or terrorism financing is materially elevated. The AML/CTF Rules 2025 set out the mandatory triggers:

• The customer or beneficial owner is a foreign PEP, or a domestic or international PEP assessed as high-risk
• The customer is from, or operating in, a high-risk foreign jurisdiction (FATF grey or black list, sanctions-adjacent jurisdictions)
• The designated service is being provided in circumstances that suggest higher ML/TF risk (unusually complex transaction, no apparent economic rationale, structuring patterns)
• A suspicious matter report has been filed in connection with the customer
• Source of funds or source of wealth cannot be readily explained, or is inconsistent with the customer's profile
• Your own risk assessment categorises the customer as high-risk

When ECDD is triggered, you must take additional measures, which include:

• Obtaining additional identification information — beyond the standard name/DOB/address, such as occupation, employer, nature of business activities
• Verifying source of funds — the immediate origin of the money used in the transaction (sale of another property, business income, inheritance, loan from a named bank)
• Verifying source of wealth — the broader origin of the customer's overall wealth (career history, business ownership, inheritance)
• More intensive ongoing monitoring — closer scrutiny of transactions and behaviours
• Senior manager approval — the decision to commence or continue the relationship must be approved by a senior officer of the agency, typically the principal or AML/CTF Compliance Officer, and the approval must be documented

The senior-manager approval requirement is the most-often missed element. ECDD is not just "do more checks" — it is "escalate the decision."

ECDD records must be retained for seven years and presented in any AUSTRAC inspection. They are also the records that demonstrate, in a dispute or enforcement action, that your agency took the situation seriously.

Every high-risk customer triggers a separate ECDD file with documented source-of-funds verification, senior-manager approval, and ongoing monitoring evidence — accumulating for the life of the customer relationship.

What to do next: Define your ECDD trigger list in writing as part of your programme, and nominate the senior officer who will approve high-risk relationships.