Know your customer (KYC) requirements in Australia help establish who a customer is and assess financial-crime risk. On a mortgage file, the broker follows the identification procedure assigned by the lender or licensee. The brokerage’s own legal obligations depend on the services it provides.
Start by naming who owns the check. Then collect the required information, verify it through the accepted method and record the outcome. An unresolved identity mismatch needs an escalation decision before you mark the check complete.
Identify Who Requires the KYC Check
Identify whether your brokerage performs the check for a lender or has its own obligations as a reporting entity. A request to collect identity documents does not, by itself, establish that the brokerage is a reporting entity.
The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 applies to designated services with the required geographical link to Australia. AUSTRAC’s regulated-services tool assesses activities, including those outside a business’s main industry. A job title alone cannot settle coverage.
When you carry out outsourced customer due diligence (CDD), use the reporting entity’s documented instructions. AUSTRAC explains that the reporting entity remains liable under an outsourcing arrangement. Your appointment defines the work you perform and where concerns go.
Existing reporting entities can use transitional identification arrangements for eligible customer classes. Follow the procedure assigned to that customer class under the entity’s programme. AUSTRAC’s transition guidance explains the conditions. Do not combine parts of the old and new procedures yourself.
Record the responsible entity, procedure version and escalation contact before collecting documents. Wider credit obligations sit within your mortgage broker compliance programme.
Collect the Customer Information the File Needs
Collect information for the customer’s legal identity and the role they hold in the application. Collection captures what the customer tells you. Verification tests that information against the evidence accepted by the responsible entity.
For an individual, the procedure commonly asks for their full name, date of birth and residential address. Other names or an identification number can help distinguish customers with similar details. Explain the purpose of collection and provide the approved secure submission channel.
For a company or trust, identify the legal customer before requesting personal documents. The file can also need registration details, people authorised to act and the individuals who ultimately own or control the customer. AUSTRAC’s ownership and control guidance explains why an entity name alone is insufficient.
A lender can require further information about the proposed relationship or where funds came from. For example, NAB’s customer due diligence guidance covers source of funds and wealth alongside identity details. Treat that as the lender’s requirements, not a universal document list for every mortgage file.
Verify Identity and Resolve Inconsistencies
Verify the required details using the document or digital method accepted for that file. A customer’s completed form or uploaded photograph does not automatically establish that verification succeeded.
AUSTRAC’s individual customer guidance describes evidence options and ways to establish that the customer is the person claimed. The responsible entity’s procedure determines which options you use.
- Compare the application details with the accepted evidence. Check names and dates, and complete the required link between the person and their identity.
- Read the verification result. A digital request that was submitted successfully can still return an unsuccessful or incomplete identity check.
- Resolve differences through the exception procedure. A former surname can need accepted change-of-name evidence. Missing standard documents need an approved alternative method.
- Escalate unresolved discrepancies to the named contact. Record the outstanding issue and hold the check at its actual status until the authorised decision arrives.
For example, a genuine customer can fail a digital check because their application uses a married name and their evidence uses a former name. Record the mismatch, obtain the accepted linking evidence and repeat the required check. A failed match alone does not prove fraud.
Land-title verification follows a separate process. Use the verification of identity guide when the transaction also requires that check.
Record the Check and Control Access
Keep a record that shows why the check occurred, how it was performed and who was responsible. Another authorised staff member must be able to distinguish an accepted result from an unresolved exception.
A practical file record contains the following details.
- The customer and file reference, responsible entity and applicable procedure.
- The information verified, accepted evidence details and verification method.
- The result and time of the check, with the staff member or provider reference.
- Any discrepancy, escalation decision and required follow-up.
AUSTRAC’s record-keeping guidance requires evidence of CDD compliance. It distinguishes recording relevant identity details from keeping full document copies.
The Office of the Australian Information Commissioner (OAIC) gives privacy guidance for reporting entities and their agents. Keep document copies only while an applicable purpose or retention obligation requires them. Older records can have different retention requirements. Apply the brokerage’s approved retention schedule to each record category before deleting anything.
Limit access to staff who need the information. Keep the accepted record in the approved system and avoid extra copies in inboxes or shared folders. Where the Australian Privacy Principles apply, reasonable security measures and destruction or de-identification obligations also apply.
Ongoing CDD belongs to the reporting entity’s duties. NAB, for example, describes refreshing existing customer information. When your work reveals changed ownership, conflicting identity details or unusual conduct, record the facts and use the assigned escalation channel. The responsible entity assesses further CDD and reporting obligations. A broker’s internal escalation is not itself an AUSTRAC report.
Identification in the Lender AML Program
Anti-money laundering and counter-terrorism financing (AML/CTF) compliance means meeting the legal duties that apply when a business provides a designated service. The reporting entity assesses its risks and sets policies and responsibilities to manage them. The AUSTRAC guidance covers customer due diligence, ongoing monitoring, record keeping and reporting. The entity must train relevant staff and review how well its controls work.
If a bank asks for AML information on a mortgage file, identify what it needs and who it has authorised to collect or verify it. The bank might request identity evidence, details of who controls a company or evidence of where a deposit came from. Send the requested evidence through the bank’s approved channel and refer discrepancies to the named contact. The bank retains its reporting duties, and the brokerage’s own duties depend on the services it provides.
- Establish authority before collecting evidence. Record the lender or licensee instructions that authorise your role. Confirm whether you collect documents only or also complete verification. A client’s permission to assist with a loan does not itself authorise you to perform every lender check.
- Explain the information handling. Give the applicable collection notice and obtain permission required for the selected verification method. Identify who receives the information and use the approved secure channel.
- Use the evidence the lender accepts for that customer and method. Complete only the checks assigned to you and retain the required result. If a provider returns an incomplete match, keep that status visible.
- Hand discrepancies to the named lender or licensee contact. Send the file reference, the conflicting details and the evidence already checked through the approved channel. Record who owns the next decision and what remains outstanding. Do not mark identification complete until the required exception decision and verification steps are recorded.
Client permission requirements depend on the method and the applicable law. OAIC guidance requires express consent and an alternative verification method before identity matching through a credit reporting body. Sensitive information usually needs consent unless an exception applies. An AML/CTF purpose does not create blanket permission to collect or reuse unrelated information.
AUSTRAC distinguishes outsourced identification work from reliance on another reporting entity’s customer due diligence. Under outsourcing, the reporting entity remains liable for breaches of its customer due diligence and record-keeping obligations. Broker collection or verification authority must come from the actual arrangement. A client consent form cannot replace it.
If an identity discrepancy raises a financial-crime concern, record the facts and follow the confidential escalation process. The reporting entity decides what further investigation or reporting its obligations require. Avoid telling the client about a suspected report where doing so could prejudice an investigation.
