This document is for independent AML/CTF auditors (for example, those conducting independent evaluations under section 26F(4)(f) of the AML/CTF Act) or AUSTRAC staff carrying out a compliance assessment, reviewing a Firm's use of the duely platform. It explains how duely lets a reviewer check that an Evidence Pack is the same file the Platform generated.

1. The Challenge of Digital Evidence

In an AML/CTF context, a Reporting Entity must keep records that show how it carried out customer due diligence (AML/CTF Act section 111), and a reviewer will want to know that a record of the evidence relied on (for example, a scanned passport or a PEP screening result) has not been altered since it was produced.

duely addresses this through cryptographic hashing and append-only audit logs.

2. What is Cryptographic Hashing? (Plain-English summary)

A cryptographic hash acts as a digital fingerprint for a file.

When the Firm generates an Evidence Pack, duely records in a single PDF document, called an Evidence Pack, the screening results, risk assessments and other records it then holds for that engagement, with images of the identity documents relied on. Other uploaded documents are listed in the pack, not reproduced in it. The Hash shows the pack is unchanged since it was generated; it says nothing about the records before that time.
duely runs the generated Evidence Pack through a mathematical algorithm called SHA-256.
The algorithm produces a 64-character string of letters and numbers (the "Hash").
Even the smallest change to the Evidence Pack (for example, altering a single pixel on a scanned ID or changing a date from "2024" to "2025") will produce a different Hash.

3. How the Hash Shows a Pack Is Unchanged

The Hash is logged. When the Evidence Pack is created, its SHA-256 Hash is recorded in duely's append-only audit log with the time of creation and, for a pack generated in the portal, the user who generated it.
The document is locked. The Evidence Pack PDF is read-only within the Platform.
Independent verification. If an auditor downloads an Evidence Pack at a later date, the auditor can run that PDF file through any standard SHA-256 hashing tool, such as the one built into modern operating systems. Running the check on the auditor's own computer avoids uploading the pack, which contains personal information, to a third-party website.
The result. If the Hash the auditor generates matches the Hash duely recorded for that pack, the file is the one the Platform generated. A matching Hash shows the file is unchanged. It does not show that its content is accurate: the pack records what the Firm entered and what third-party providers returned. duely does not independently verify third-party results (MSA clause 2), and the Firm is responsible for the accuracy of what it enters. The recorded Hash and its time are held in duely's own systems.

duely does not warrant the validity of evidence outside its own chain of custody, including evidence handled, copied, or altered after export from the Platform.

4. Append-only Audit Logging

Alongside Evidence Packs, duely maintains an append-only event stream for every matter.

"Append-only" means new events (for example, "User Jane Doe assigned Risk Rating High at 2:04pm") are only added to the end of the log.
Existing events cannot be edited or deleted through the application, including by users with the AMLCO role. duely restricts direct database access and does not edit or delete audit events.
The log is a record of actions taken in relation to a specific customer. The Hash recorded for each Evidence Pack is what makes the pack itself tamper-evident.
The log is held while the Firm subscribes. After a subscription ends the Firm keeps read-only access and can resume, and duely emails the Firm's administrator at least 30 days before the Firm's data, including the log, is deleted. duely does not supply copies of the log on request. The Firm must keep its AML/CTF records for 7 years.

5. Summary for Independent Reviewers

When reviewing a Firm that uses duely, you can run an independent SHA-256 check against the Hash duely shows for that pack (also recorded in its audit log) to confirm that an Evidence Pack is the same file the Platform generated. SHA-256 is designed so that any change to a file produces a different Hash. Whether the procedures it records were adequate, and whether the information in it was accurate, remain matters for your review.

This Statement is informational only and does not form part of the Master Subscription Agreement. It is not a warranty by duely as to the legal sufficiency of the Firm's underlying compliance program.

6. Version History

2.2 (19 October 2026): sections 1 to 5 updated.
2.1 (15 October 2026): introduction updated.
2.0 (19 May 2026): first published version.