Frequently Asked Questions

Enhanced customer due diligence is the heightened level of due diligence the AML/CTF Act and Rules require when a business relationship presents a high risk of money laundering, terrorism financing or proliferation financing. Reporting entities must apply it when the customer or a beneficial owner is a foreign politically exposed person (PEP), or a domestic or international organisation PEP assessed as high risk; when the customer is connected to a high-risk jurisdiction, including countries subject to an FATF call for action; when ownership or control structures are complex or opaque without a clear commercial rationale; when the source of wealth or funds cannot be readily established; and when you have formed a suspicion about the customer. Compared with standard due diligence, ECDD requires deeper investigation, a documented risk rationale, senior management approval where the Rules require it, and more frequent ongoing review. KYCopilot generates a structured, fully source-cited EDD report in under five minutes, covering adverse media, sanctions, PEP status, court records and country risk across 200+ jurisdictions.

The AML/CTF Act's risk-based approach requires reporting entities to calibrate the depth of their due diligence to the money laundering and terrorism financing risk a customer presents, which results in three tiers. Standard customer due diligence is the baseline: identifying the customer and verifying who they are, identifying beneficial owners and anyone acting on the customer's behalf, understanding the nature and purpose of the relationship, and monitoring it on an ongoing basis. Simplified due diligence may only be used where the customer's risk is genuinely low and the AML/CTF Rules permit it; it must be justified and documented, and it cannot be applied simply because a customer is familiar or long-standing. Enhanced customer due diligence is required, not merely recommended, when a relationship presents high-risk indicators such as foreign PEP status, connections to high-risk jurisdictions, opaque ownership, or wealth that cannot be explained. KYCopilot generates full EDD reports covering all of these risk dimensions in under five minutes, with complete source citations.

The FATF standards and the AML/CTF Act require reporting entities to take a risk-based approach, meaning compliance resources and scrutiny must be proportionate to the actual money laundering and terrorism financing risk each customer, product and channel presents. In practice you must identify and assess the risks of your business in a documented ML/TF risk assessment, covering your customers, the designated services you provide, your delivery channels and your geographic exposure, and then set AML/CTF policies that manage those risks. The risk assessment must be kept current and reviewed when your business or risk environment changes. KYCopilot's COMFORT Score™ gives every entity screened a structured, percentage-based risk rating with transparent, auditable reasoning, so your compliance team has a defensible score to anchor its customer risk documentation.

Every reporting entity must develop, implement and maintain an AML/CTF program. Following the 2024 reforms, the program is built around two parts: a documented ML/TF risk assessment of your business, and AML/CTF policies, procedures, systems and controls that manage and mitigate the risks you have identified. In practice the program should cover initial and ongoing customer due diligence, including simplified and enhanced measures; identifying and verifying beneficial owners and people acting on a customer's behalf; transaction monitoring and suspicious matter reporting; sanctions screening; record keeping; staff due diligence and training; the appointment of an AML/CTF compliance officer; oversight by senior management; and regular independent evaluation. AUSTRAC will usually ask for the program and the risk assessment first in a compliance assessment, and a missing or inadequate program has been a recurring feature of its enforcement actions.

The AML/CTF Act applies to reporting entities: businesses that provide a designated service listed in the Act. These include banks and other authorised deposit-taking institutions, lenders, remittance service providers, digital currency exchanges and other virtual asset service providers, life insurers, superannuation funds, securities and derivatives dealers, bullion dealers, and gambling providers such as casinos, wagering operators, and hotels and clubs with gaming machines. Since 1 July 2026, the Tranche 2 reforms have extended the regime to lawyers, conveyancers, accountants, real estate agents, trust and company service providers, and dealers in precious metals and precious stones when they provide designated services. Reporting entities must enrol with AUSTRAC, maintain an AML/CTF program, conduct customer due diligence, screen against sanctions, and report to AUSTRAC. HLBNGA's solutions support due diligence and screening across all of these sectors.

HLBNGA's sanctions data is refreshed every 60 minutes across 12+ lists, including Australia's DFAT Consolidated List, OFAC (US), UN Consolidated Sanctions, EU Sanctions, the UK Sanctions List, INTERPOL-UN Security Council Special Notices, the World Bank Debarred List, the Canadian Autonomous Sanctions List, SECO (Switzerland), the US DEA List and the US Denied Persons List. Refresh frequency matters because designations can happen without warning: a customer who was clear at onboarding may be listed within hours of a geopolitical event. Organisations relying on weekly or monthly updates carry an exposure window in which they may unknowingly deal with a newly designated person, and dealing with the assets of a designated person can be a criminal offence in Australia. Frequent refresh is the only defensible approach for ongoing due diligence.

Adverse media screening is the systematic review of global news and media sources for evidence of a customer's involvement in financial crime, corruption, terrorism, trafficking, fraud or other risk categories. The FATF standards, which Australia's AML/CTF framework implements, and AUSTRAC's guidance expect reporting entities to use relevant and reliable information when assessing customer risk, and adverse media is one of the most important sources of it. Relying only on sanctions lists and PEP databases leaves significant gaps in your understanding of a customer. HLBNGA screens across 22 adverse media categories, including corruption, financial crime, regulatory breaches, ESG controversies, cybersecurity incidents and court records, using AI-powered analysis. Our screening also surfaces probable absolution signals, so customers are not penalised for allegations that were later disproven or withdrawn.

Rule-based sanctions screening applies fixed logic: a name is checked against a designated list, and a match or no-match is returned based on string similarity thresholds. It is fast, predictable and well understood, and it is the minimum standard for sanctions compliance. Its limitation is that it works in isolation: it does not assess associations, context or the network of relationships around a subject. AI-powered risk assessment extends the analysis from list-matching to contextual intelligence. Rather than asking only whether a name appears on a list, it asks what is known about the entity across sanctions databases, adverse media, court records, regulatory actions and corporate relationships, and whether there are association risks, such as directors shared with sanctioned entities or suppliers with regulatory breaches, that list-matching would miss. Rule-based screening catches designated parties; AI-powered assessment catches the risk that surrounds them, which is often where the real exposure sits. HLBNGA combines both: sanctions screening across 12+ lists refreshed every 60 minutes, with AI-powered analysis across 22 risk categories, producing a single COMFORT Score™ that integrates every signal into a defensible, source-cited rating.

Yes, provided the AI system meets the evidentiary standards AUSTRAC and your auditors apply when reviewing compliance records. The AML/CTF Act does not mandate a particular format or tool for due diligence records. It requires that due diligence was carried out, that its depth was proportionate to the risk, that your reasoning is documented, and that records are kept for seven years. An AI-generated report meets these requirements where it names the databases and sources checked and when they were last updated, gives a traceable rationale for each risk conclusion rather than an opaque score, cites original source material an auditor can verify independently, and is kept in a retrievable format. The critical distinction is between systems that produce verified, source-cited outputs and those that produce summaries whose reasoning cannot be inspected; the latter create real compliance exposure however plausible they look. KYCopilot reports are built around these requirements: every finding links to its source, every database checked is named, and the COMFORT Score™ follows a transparent, auditable methodology.

A politically exposed person holds, or has held, a prominent public function. The AML/CTF framework recognises three types: domestic PEPs, who hold prominent positions in an Australian government body, including Commonwealth, state, territory and local government; foreign PEPs, who hold equivalent positions in another country; and international organisation PEPs, such as senior officers of UN agencies, multilateral development banks and other international bodies. Their immediate family members and close associates are covered too. Australia has no separate private-sector category equivalent to the prominent influential person (PIP) category used in some other jurisdictions. HLBNGA screens domestic, foreign and international organisation PEPs, with full role history and sub-category tagging.

Confirm the match, then apply enhanced customer due diligence in proportion to the risk. For foreign PEPs, and for domestic or international organisation PEPs assessed as high risk, this means obtaining senior management approval for the relationship, taking reasonable steps to establish the customer's source of wealth and source of funds, and applying enhanced ongoing monitoring. Record the decision and your reasoning, and make sure the process is set out in your AML/CTF program.

Yes. Australia's PEP requirements extend to a PEP's immediate family members and to known close associates, such as business partners or people with close personal ties. Corruption proceeds often move through these relationships rather than through the PEP directly, which is why good screening identifies associates as well as the office holder.

No. PEP status reflects the higher inherent risk attached to a prominent role, not any finding of wrongdoing. Most PEP relationships are legitimate. The AML/CTF Act's risk-based approach expects you to understand the risk and manage it with proportionate measures, not to turn PEPs away by default.

There is no single fixed period that suits every case. FATF guidance expects reporting entities to keep applying enhanced measures for as long as a former role still carries meaningful risk, judged on the seniority of the role, the jurisdiction and what has happened since. A former head of government warrants longer scrutiny than a recently retired local councillor. HLBNGA keeps inactive PEP profiles with clear end dates and status tags, so you can see a person's historical roles and document a risk-based decision.

KYB is the process of verifying the identity, ownership structure, legal standing and risk profile of a non-individual customer, such as a company, trust or partnership, before and throughout a business relationship. KYC applies to individuals: confirming a person's identity and assessing their personal risk. The distinction matters because entities add complexity that individual verification does not: layered ownership, nominee directors, several beneficial owners and subsidiaries in different jurisdictions. Under the AML/CTF Act, when your customer is not an individual you must identify and verify the entity itself, the people acting on its behalf, and the individuals who ultimately own or control it. A sound KYB process involves more than an ASIC register or ABN Lookup check: it requires beneficial ownership resolution, sanctions and adverse media screening on all connected people, and ongoing monitoring for material changes. HLBNGA supports KYB and KYC in the same workflow, resolving entity structures and scoring risk across every connected person and related entity in a single, source-cited report.

Under the AML/CTF framework, a beneficial owner is an individual who ultimately owns or controls a customer, directly or indirectly. Ownership means holding 25% or more of the customer, and control includes the ability to determine decisions about its financial and operating policies, for example through trusts, agreements or the power to appoint the board. The obligation does not stop at the first layer: if a customer is owned by a holding company, you must trace through the structure until you reach the individuals behind it. In practice that means resolving group structures, nominee arrangements and trusts to their ultimate controllers. Being unable to identify the beneficial owner is not a satisfactory conclusion; it is itself a risk indicator that may require enhanced due diligence or, in some cases, declining the relationship. HLBNGA's I2G™ intelligence tool maps directorship networks and related-entity relationships so compliance teams can resolve ownership chains systematically, with audit documentation at each step.

The AML/CTF Act generally requires reporting entities to keep customer due diligence records, transaction records and records of their AML/CTF program for seven years. For customer due diligence, the seven years run from the end of the business relationship; for transactions, from the date of the transaction. Records to keep include the information and documents collected at onboarding and during ongoing due diligence, such as identity verification, beneficial ownership and source of wealth evidence; transaction records; and any enhanced due diligence reports. Records must be kept in a form that can be retrieved promptly if AUSTRAC asks for them. HLBNGA reports are fully exportable as structured documents, making them straightforward to archive, retrieve and present to auditors against your record-keeping obligations.

The Privacy Act and the AML/CTF Act work together. The Australian Privacy Principles limit collection to information reasonably necessary for your functions, and allow personal information to be collected, used and disclosed where that is required or authorised by an Australian law, which includes the AML/CTF Act. Your customer due diligence obligations therefore give you a lawful basis to collect and hold the information the AML/CTF regime requires. Small businesses that would otherwise be exempt from the Privacy Act are covered for their AML/CTF activities once they become reporting entities. The key constraint is proportionality: collect what your AML/CTF obligations require, protect it, and destroy or de-identify it once it is no longer needed and the seven-year retention period has passed. HLBNGA's solutions process only the data needed to carry out your screening.

Yes. KYCopilot reports are structured to meet the documentary standards expected in an AUSTRAC compliance assessment or an independent evaluation of your AML/CTF program. Each report includes source citations linked to original material, a transparent rationale explaining how each risk score was derived, a named list of the screening databases checked, and a clear audit trail of the search. AUSTRAC does not mandate a particular tool or report format; it expects you to show that due diligence was carried out, that its depth was proportionate to the risk, and that records are kept for the required period. KYCopilot reports support all three, and they are fully exportable, so they are straightforward to archive and present to auditors or AUSTRAC on request.

The AML/CTF Act does not prescribe a fixed review interval. It requires ongoing customer due diligence and transaction monitoring proportionate to risk, which means your AML/CTF program should set review frequencies for each customer risk tier. A widely used framework is: high-risk customers, including PEPs and other ECDD relationships, reviewed at least annually or when a trigger event occurs; medium-risk customers every two to three years; and lower-risk customers every three to five years. Trigger-based reviews matter just as much: a relationship must be reassessed when its directors or beneficial owners change, a new sanctions designation or adverse media appears, transaction behaviour changes significantly, or the customer moves into a new business line or jurisdiction. AUSTRAC has been consistent that ongoing due diligence is a legal obligation, not best practice, and teams that rely only on onboarding checks are exposed to breach findings however thorough those checks were. HLBNGA's continuous monitoring flags changes to sanctions status, adverse media and directorships in real time, keeping records current between formal reviews.

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 is the most significant change to Australia's regime since 2006. For existing reporting entities, reforms that started on 31 March 2026 reshaped the AML/CTF program around a documented ML/TF risk assessment and outcomes-focused AML/CTF policies, restructured customer due diligence into initial and ongoing obligations, formalised the role of the AML/CTF compliance officer and senior management oversight, required regular independent evaluation, and broadened coverage of virtual asset services. From 1 July 2026, the Tranche 2 reforms brought lawyers, conveyancers, accountants, real estate agents, trust and company service providers, and dealers in precious metals and stones into the regime for the designated services they provide. For compliance teams, the practical message is to refresh your risk assessment, check that your policies map to the new obligations, and make sure your due diligence and screening evidence would stand up to an AUSTRAC review. HLBNGA's country risk data is updated in line with FATF evaluations, with current ratings across 200+ jurisdictions.

Digital currency exchanges have been regulated in Australia since 2018 and must register with AUSTRAC before providing services. The 2024 reforms broadened the regime to cover a wider range of virtual asset services, such as exchanges between different virtual assets, transfers on behalf of customers, and certain custody services. Providers must maintain an AML/CTF program, carry out customer due diligence at onboarding, including beneficial ownership for entity customers, apply enhanced due diligence to higher-risk customers such as foreign PEPs and those linked to high-risk jurisdictions, screen against sanctions before transacting, report suspicious matters and qualifying transactions to AUSTRAC, follow travel rule requirements for transfers, and keep records for seven years. HLBNGA's screening and EDD capabilities apply directly to virtual asset onboarding and ongoing monitoring workflows.

Part 9.4AAA of the Corporations Act 2001 protects eligible whistleblowers who report misconduct about a company, including protection of their identity and from detriment, and public companies, large proprietary companies and trustees of registrable superannuation entities must have a whistleblower policy. Separate protections apply to tax disclosures and to the public sector. Internationally, the EU Whistleblower Directive (2019/1937) and Sarbanes-Oxley §806 set similar expectations. A generic HR inbox or shared mailbox does not meet them well: it cannot guarantee confidentiality, offers no anonymous route, gives the reporter no way to track the outcome, and leaves no defensible record that the disclosure was received, assessed and acted on. A sound channel supports anonymous submission, secure evidence upload, confidential handling with role-based access, reference-code status tracking without an account, and a complete audit trail. HLBNGA's Compliance Logger provides this: an embeddable reporting portal that accepts named or anonymous disclosures, issues each reporter a reference code, and routes every report into a case-managed workflow with an immutable audit log, designed to support the confidentiality and feedback expectations of Australian whistleblower law and the EU Directive.

Regulators, boards and external auditors no longer accept the existence of policies as evidence of compliance; they expect an organisation to show that breaches are identified, logged, investigated and remediated, with a complete chronology. The AML/CTF Act imposes record-keeping obligations and requires suspicious matter reports to AUSTRAC, and directors carry personal duties of care and diligence under section 180 of the Corporations Act. Meeting these standards takes more than an email thread or a shared spreadsheet: when a regulator or auditor asks for the timeline of an incident, you must be able to produce a single, timestamped, attributed record of every action taken, from who reported it and how it was triaged to who investigated it and how it was resolved. A defensible approach captures every incident in one system of record with an immutable audit log, so the audit trail itself becomes the evidence pack. HLBNGA's Compliance Logger is built for this: its immutable audit log supports AML/CTF record-keeping and reporting, and external assurance under ASAE 3000, and it exports a self-contained incident report for board packs and regulator submissions in one click.

Yes, provided the AI is grounded in your organisation's actual policies rather than a generic vendor template, and its reasoning is explainable and auditable. HLBNGA's Compliance Logger lets you upload your own policies, such as your AML/CTF program, Code of Conduct, Sanctions Policy, privacy procedures, Anti-Bribery and Corruption policy and Whistleblower Policy, in PDF, Word or plain text. The system indexes and maps every clause, so that when a breach or anonymous disclosure is reported, the AI triages it against your policies as they stand today, before a human opens the case. Within seconds each incident is enriched with a severity rating and rationale, the policy clauses that apply, the regulatory provisions potentially triggered (for example, a flag that the matter may require a suspicious matter report to AUSTRAC within three business days), suggested investigative steps and recommended remediation. Human reviewers stay fully in control; they simply start each case with a defensible, policy-grounded first draft. Because every recommendation traces to a specific policy clause and regulation, the output reflects the emerging global consensus on AI accountability, including the EU AI Act and the US NIST AI Risk Management Framework: explainable AI, immutable audit trails and reproducible reasoning.