You must monitor your customers to appropriately identify, assess, manage and mitigate the risks of money laundering, terrorism financing and proliferation financing (we refer to these as ML/TF risks) that you may reasonably face while providing designated services. 

This includes monitoring your customers for unusual transactions and behaviours, and behaviour that may require you to submit a suspicious matter report (SMR) to us.

If you have a business relationship with a customer, you must also both:

• review and, if appropriate, update your identification and assessment of the customer’s ML/TF risk
• review and, if appropriate, update and reverify know your customer (KYC) information relating to the customer.

Learn about: 

• your ongoing CDD obligations for pre-commencement customers
• when you need to apply enhanced CDD measures in ongoing CDD.

AML/CTF policies and ongoing CDD

Your anti-money laundering and counter-terrorism financing (AML/CTF) policies (which includes your systems, controls and procedures) must deal with ongoing CDD. 

The way you conduct ongoing CDD must be appropriate to manage and mitigate the ML/TF risks you reasonably face in providing your designated services.

What’s appropriate depends on all of the following:

• your ML/TF risk assessment in your AML/CTF program
• your customer’s ML/TF risks that you identify during initial CDD
• any changes to the customer’s ML/TF risk that you identify as they use your services.

Your AML/CTF policies must set out how you’ll do all of the following:

• monitor for unusual transactions and behaviours and criminal activity
• review and, where appropriate, update and reverify your customers’ KYC information
• review and, where appropriate, update your assessment of the customer’s ML/TF risk
• respond to unusual transactions and behaviours and additional ML/TF risks you identify during ongoing CDD
• ensure your ongoing monitoring is working effectively
• keep records that demonstrate how you complied with your ongoing CDD obligations.

Simplified CDD during ongoing CDD

You may apply simplified ongoing CDD measures if all of the following are satisfied:

• the customer’s ML/TF risk is low
• you aren’t required to apply enhanced CDD
• your AML/CTF policies deal with applying simplified CDD measures.

You must still meet your ongoing CDD obligations, but you may be satisfied that you can do this: 

• through less intensive monitoring activities
• by updating and reverifying KYC information less frequently. 

What you must monitor for

You must monitor your customers to appropriately identify, assess, manage and mitigate the ML/TF risks you may face when providing designated services. 

This includes monitoring your customers for any unusual transactions and behaviour that may require you to submit an SMR to us. Learn more about SMRs. 

You must also monitor transactions and behaviour for information that:

• suggests the customer or their agent isn’t who they claim they are
• would be useful in an enforcement matter relating to the proceeds of crime
• may be relevant to an investigation or prosecution of certain Commonwealth, state, or territory offences.

This applies to customers that you have a business relationship with, and those who only occasionally use your services. 

Failure to monitor transactions and behaviour can have serious flow-on effects to other AML/CTF obligations.

Learn more about:

• what you must monitor for
• how to monitor your customers

Responding to unusual transactions and behaviour

You must take appropriate steps to manage and mitigate ML/TF risks when you identify unusual transactions and behaviour.

Customers may have unusual transactions or behaviour, but this doesn’t mean they’re doing something illegal. 

When you identify unusual transactions or behaviour, determine if both: 

• there’s a legitimate explanation
• you need to take further action, such as conducting enhanced CDD to better understand the ML/TF risks or submitting an SMR to us.

Learn about responding to unusual transactions and behaviour.

Review and update information and customer ML/TF risk

As part of ongoing CDD, you must both: 

• review and, where appropriate, update your identification and assessment of the customer’s ML/TF risk
• review and, where appropriate, update and reverify KYC information relating to the customer.

These obligations only apply where you have a business relationship with your customer. 

Learn more about reviewing and updating KYC information and customer ML/TF risk.

Check your ongoing CDD

You must regularly check the effectiveness of your ongoing CDD. This helps you make sure it’s operating as intended to appropriately identify, assess, mitigate and manage the ML/TF risks you may face.

If you identify any problems during your checks, we expect you to address them promptly. If you don’t, you may fail to meet your obligations.

We expect your AML/CTF policies include how you’ll do all of the following:

• review your ongoing CDD measures to make sure they’re appropriate. This includes following changes to your customers’ KYC information or ML/TF risk
• monitor the effectiveness of your ongoing CDD measures
• prioritise addressing any issues you identify with your ongoing CDD
• update your AML/CTF policies relating to ongoing CDD.

Nested services relationships

You have additional ongoing CDD obligations if you provide designated services as part of a nested services relationship. 

Learn more in section 6–26 of the Rules.

Record keeping

You must keep records that show how you complied with your ongoing CDD obligations in relation to a customer. This includes all of the following:

• keeping records of the customer’s transactions
• your identification, analysis, and assessment of the customer’s ML/TF risk
• any decisions your business makes about how you conduct ongoing CDD on the customer.

Learn more about record keeping. 

Related pages

• What you must monitor for
• How to monitor your customers
• Responding to unusual transactions and behaviours
• Reviewing and updating KYC information and customer ML/TF risk
• Transitioning existing customers
• Enhanced customer due diligence
• Politically exposed persons
• Suspicious matter reporting