Enhanced customer due diligence (ECDD) — when and how
When standard CDD is not enough, and what additional measures the AML/CTF Rules 2025 require.
In short
ECDD is mandatory when one of six statutory triggers applies (foreign PEP, SMR filed, high-risk customer, nested-services relationship, unusual/large/complex transaction, FATF Call for Action jurisdiction). It is not just additional checks — it requires senior-manager approval to commence or continue the relationship, source-of-funds and source-of-wealth evidence, and intensified ongoing monitoring.
Standard CDD identifies who the customer is. Enhanced customer due diligence (ECDD) goes further: it requires you to understand the customer's wealth and funds, escalate the decision to a senior manager, and watch the relationship more closely. It applies whenever the AML/CTF Act 2006 (Cth) and the AML/CTF Rules 2025 say it must.
The six statutory triggers (Act s 32; Rules s 6-20).
- The customer or a beneficial owner is a foreign PEP.
- A suspicious matter report is required for the customer (whether or not yet filed).
- The transaction is unusual, large, or complex without a clear economic rationale.
- The relationship involves nested designated services — a customer providing designated services to its own customers using your services.
- The customer is from, or operating in, a FATF Call for Action jurisdiction (Iran, DPRK, Myanmar as at the February 2026 plenary).
- Your own risk assessment rates the customer high-risk.
Domestic PEPs and international-organisation PEPs are not automatic triggers. They only trigger ECDD if they are also rated high-risk on your assessment.
What ECDD actually requires.
- Additional identification information — beyond name, date of birth and address: occupation, employer, nature of business activity, the rationale for the transaction.
- Source of funds — the immediate origin of money used in this transaction: sale of another asset, business income, inheritance, drawdown from a named lender.
- Source of wealth — the broader origin of the customer's overall wealth: career history, business ownership, family inheritance.
- Intensified ongoing monitoring — closer scrutiny of transactions and behaviours through the life of the relationship.
- Senior-manager approval — under Rules s 5-5(1), the decision to commence or continue the relationship must be approved by a senior manager, and the approval must be documented.
The senior-manager approval is the element most often missed. ECDD is not "do more checks" — it is "escalate the decision." A high-risk customer onboarded by a junior agent without principal sign-off is a programme failure even if every other step was done.
Documentation. Each ECDD file records the trigger, the additional information collected, the source-of-funds and source-of-wealth evidence, the senior-manager approving the relationship, and the date of approval. Records are retained for seven years from the end of the customer relationship (Act ss 107, 108, 111, 114, 116).
ECDD files are the records AUSTRAC asks for first in any inspection. They are also the records that demonstrate, in a dispute or enforcement matter, that your agency treated the elevated risk seriously.
Frequently asked questions
- Do domestic PEPs always trigger ECDD?
- No. Foreign PEPs always trigger ECDD. Domestic PEPs and international-organisation PEPs only trigger ECDD if your own risk assessment rates them high-risk.
- Is FATF grey-listed jurisdiction exposure enough to trigger ECDD?
- Not on its own. The statutory trigger is a FATF Call for Action jurisdiction (currently Iran, DPRK and Myanmar). Grey-list exposure feeds into your risk assessment but is not, by itself, a mandatory ECDD trigger.
- Who has to approve an ECDD relationship?
- A senior manager — in most small agencies, the principal or the AML/CTF Compliance Officer. The approval must be documented before you commence or continue the designated service.