Blogs
Delayed initial CDD explained: verifying customers after you start
In most cases, AUSTRAC expects you to complete customer due diligence (CDD) before providing a designated service, which makes sense because you should know who you’re dealing with before you begin.
However, there are limited situations where you can start providing a service first and complete verification shortly after, as long as you move quickly, manage the risk carefully, and stay within strict regulatory boundaries.
The core requirements
You can only delay CDD if you can reasonably justify two things:
- Delaying verification is necessary to avoid interrupting normal business operations
- The risk of money laundering or terrorism financing remains low.
If either of these conditions does not hold, delaying CDD is not appropriate.
Your AML/CTF program must also clearly outline when delayed CDD is permitted, how risks will be managed while a customer remains unverified, and how verification will be completed as soon as possible within AUSTRAC’s required timeframes. Missing those deadlines can expose you to penalties.
What delayed CDD actually involves
Delaying CDD does not mean skipping it; it means collecting customer information upfront and verifying it shortly afterwards.
In practice, this means you may begin the relationship with a customer, but you must still complete verification promptly and be able to demonstrate that you acted as quickly as reasonably possible.
When delayed CDD is allowed
General services in Australia
You can begin providing a service after collecting KYC information but before verifying it, provided that verification is completed within 20 business days and before the customer is able to move or use funds or assets. In practical terms, holding funds may be acceptable during this period, but allowing transactions is not.
Real estate transactions
For property transactions, you must verify your own client upfront, but you may delay verifying the other party. This verification must occur within 15 days of contract exchange or before settlement, whichever happens first, and applies to agents, lawyers, and conveyancers.
Overseas services
If you are operating in another jurisdiction, you may follow local regulatory requirements provided they align with international standards such as FATF. You are still required to collect and verify customer information and comply fully with the applicable local laws.
When you should not delay CDD
Delaying CDD is not appropriate if there is a reasonable chance that you will be unable to verify the customer later, or if delaying creates an opportunity for the customer to misuse your service before their identity is confirmed. This is particularly relevant in situations where funds or assets can be moved quickly or where the customer’s identity is critical from the outset.
Managing the risk
If you choose to delay CDD, your policies must address how to respond if a customer fails verification, including how funds will be returned safely, ideally to the original source rather than in cash. You also need to ensure that unverified accounts cannot be used in a way that gives them undue legitimacy, such as being relied on as identification elsewhere.
Importantly, in most cases, funds should not be returned until CDD has been completed, even if this creates operational challenges.
When delaying CDD makes sense
AUSTRAC provides practical examples where delayed CDD may be justified, including:
- Onboarding customers remotely where immediate verification is not possible
- Auctions where bidders cannot be verified in advance
- Emergency situations such as natural disasters or domestic violence cases
- Visa applicants needing to open accounts before approval
- Genuinely time-sensitive financial transactions where pricing changes rapidly
The common theme across these scenarios is that the delay is necessary and unavoidable, not simply a matter of convenience.
Key takeaway
Delayed CDD is not a shortcut, but a tightly controlled exception that allows you to begin a customer relationship while completing verification shortly afterwards. To use it correctly, you must still collect all required information upfront, complete verification within strict timeframes, limit what the customer can do in the meantime, and clearly document why the delay was justified.
In simple terms, you can start the relationship early, but you should not treat it as fully established until verification is complete.
