Enhanced customer due diligence (ECDD) is the escalated form of customer due diligence under the AML/CTF Act 2006 (Cth), and it changes how you treat a customer, not just what you collect from them. It applies from the point a trigger is identified, and it stays on for the life of the relationship.
Your firm is a reporting entity: a business that must comply with the Act because it provides a designated service, a service the Act lists as capturing you, such as the professional services in Table 6 of the Act. Tranche 2 firms have been reporting entities since 31 March 2026, and their customer due diligence obligations have applied since 1 July 2026. Most customers will need nothing beyond the baseline customer due diligence covered in the customer due diligence guide. A minority will need more, and this page is about how you tell the difference and what you do when the answer is more.
What puts a customer into enhanced due diligence
Section 32 of the Act lists the cases where you must apply enhanced customer due diligence measures appropriate to the customer’s ML/TF risk. Each is a finding you reach from evidence, and none of them settles the question of what you do next. The cases are:
- High risk: the ML/TF risk of the customer is high (s 32(a)).
- A suspicious matter, and you carry on: a suspicious matter reporting obligation arises for the customer, and you propose to keep providing designated services to them (s 32(b)).
- A foreign politically exposed person: the customer, a beneficial owner, a person on whose behalf the customer receives the service, or a person acting for the customer is a foreign PEP (s 32(c)).
- A FATF high-risk jurisdiction: any of those people is an individual physically present in, or a company or legal arrangement formed in, a jurisdiction for which the Financial Action Task Force has called for enhanced due diligence (s 32(d)).
- A nested services relationship: the service is provided as part of one (s 32(e)). That is a relationship between remitters, virtual asset service providers or financial institutions, so it rarely touches a Tranche 2 firm.
- An unusual request: the customer asks for a service that has no apparent economic or legal purpose, or that would involve unusually complex or large transactions or an unusual pattern of transactions (s 32(f) and Rules 6-20).
A politically exposed person (PEP) holds a prominent public office or position: a head of state, a minister, a member of a legislature, a senior judge, a senior official, or the like. Section 5 of the Act defines three kinds, domestic, foreign and international organisation PEPs, and each also covers the office holder’s family members and people known to share beneficial ownership or other close business relations with them. Their position makes them more vulnerable to bribery and corruption. Only a foreign PEP puts the customer into ECDD automatically. A domestic or international organisation PEP calls for the extra PEP steps (source of wealth and source of funds, and senior manager approval before you start) where the customer’s risk is high (Rules 6-23 and 5-5).
Sanctions are not on the s 32 list, but they are a separate and harder line. Your AML/CTF policies must deal with making sure you do not make assets available to, or deal with assets of, a person designated for targeted financial sanctions (Rules 5-3). A match against a sanctions list is a reason to stop and establish what it means: whether it is the same person or a namesake, what the list prohibits, and whether the service can lawfully be provided. A real match will usually also make the customer’s risk high, which brings s 32(a) in.
The high-risk case is the one you reach through judgement. Your risk assessment finds factors that make the customer or the transaction higher risk: an ownership structure built to be hard to follow, a jurisdiction with weak anti-money laundering controls, a transaction pattern that does not fit the customer, a customer who cannot or will not explain what the money is for. The rules do not hand you an exhaustive list; they expect you to recognise the pattern.
| Case | What the law specifically adds | Where it sits |
|---|---|---|
| High ML/TF risk | Source of wealth and source of funds, where relevant to the nature of the risk | s 32(a); Rules 6-21 |
| Suspicious matter reporting obligation, and you carry on | Source of wealth and source of funds, where relevant to the nature of the risk | s 32(b); Rules 6-21 |
| Foreign PEP | The PEP’s source of wealth and source of funds, and senior manager approval before you start | s 32(c); Rules 6-23, 5-5 |
| Domestic or international organisation PEP, where the risk is high | The same steps as for a foreign PEP | s 32(a); Rules 6-23, 5-5 |
| FATF call-for-EDD jurisdiction | Source of wealth and source of funds, where relevant to the nature of the risk | s 32(d); Rules 6-21 |
| Unusual request | Enhanced measures appropriate to the risk, starting with the purpose of what is asked | s 32(f); Rules 6-20 |
Beyond these specific steps, the measures have to be appropriate to the customer’s ML/TF risk (s 32), so how much further you go, and how closely you monitor, is a judgement your AML/CTF program sets.
What enhanced due diligence adds
ECDD extends your baseline checks in two directions: deeper questions and closer monitoring. Baseline customer due diligence establishes who the customer is and verifies it, and the customer due diligence guide covers what counts as verified. ECDD adds why: where the money comes from, and how the customer came to have it.
Source of funds is about the transaction. Where did the money for this deal come from: a savings account, a loan, the sale of an asset, wages? You trace it and keep the evidence: the loan agreement, the sale contract, the account statement. Source of wealth is about the customer. How did they accumulate the wealth that makes this transaction possible: a business they built, an inheritance, a property sold years ago? The two questions are distinct, and AUSTRAC guidance treats them that way.
Where the customer is a company or a trust, the enhanced checks reach the individuals behind it: the beneficial owners, the people who ultimately own or control the customer. The beneficial ownership guide covers when you can stop that digging.
ECDD also reaches forward into monitoring. The assessment is not a snapshot; you re-check the triggers as circumstances change and keep the enhanced checks current for the life of the relationship. Ongoing customer due diligence is the point of ECDD, not an add-on.
The information you gather has a second life as the raw material for a suspicion decision. When a suspicion forms, a suspicious matter report (SMR) is due within three business days of the suspicion forming, or 24 hours if it relates to terrorism financing, under s41(2) of the Act. ECDD that is still in progress does not pause that clock. And if you decide to keep acting for the customer once a suspicious matter reporting obligation has arisen, s 32(b) puts them into ECDD.
What catches people out
The two money questions answer different things: the source of funds is where this transaction’s money came from, and the source of wealth is how the customer built the money behind it. Answering one leaves the other open. A file that documents a loan as the source of funds but never asks how the lender came to hold that amount has answered half the question. A reviewer or AUSTRAC will see the gap, and the customer gets a follow-up at the worst moment.
A sanctions or PEP hit starts an assessment. It does not end one. The match has to be established: same person or namesake, what the list prohibits, whether the service can be provided. Some hits end in refusal, some in a cleared file, and the file has to show which and why. Refuse on a false positive and you have turned down a legitimate customer on a namesake. Wave through a real hit and you have provided a designated service to someone you should have stopped. There is a third risk: you cannot always brief the customer on the finding. Section 123 makes it an offence to disclose that a suspicious matter report has been given or is required to be given, or what it contains, where that would, or could reasonably be expected to, prejudice an investigation, and it does not matter whether an investigation has started. Explaining a screening flag in a way that points to a report is the kind of disclosure that test catches.
ECDD is ongoing, not a one-off. The trigger is assessed when you take the customer on, and then again when the world changes: a customer takes public office, a new jurisdiction appears in the transaction chain, a pattern of activity shifts. Treat it as a one-off and the customer drifts back to baseline treatment while the risk has moved, and the file will not show that anyone noticed. The record of when you re-checked, and what you found, is the only thing that proves the difference.
What is still unsettled
Where the triggers sit is settled: s 32 of the Act lists them, and Rules 6-20 adds the unusual-request case under s 32(f). The pre-2024 framework kept most of ECDD in the old AML/CTF Rules, so guidance that cites old rule numbers points at provisions that no longer exist.
What is still settling is how AUSTRAC expects the triggers applied. ECDD turns on a risk-based judgement: which factors count, how much verification is enough, how often to re-check. AUSTRAC’s guidance carries the detail, and how that guidance lands under the new framework has not fully settled. Build your procedure as version one and expect to revise it.
Where to start
Get ECDD working before the first enhanced file lands.
- Screen before you take them on: put PEP and sanctions screening at the front of onboarding, and treat any hit as the start of an assessment, not the end of one.
- Capture the two questions separately: make source of funds and source of wealth separate questions with separate evidence in your file, so a completed file shows both answered and the distinction was made.
- Name who reviews, and when: name the person who reviews enhanced files, your AML/CTF compliance officer (AMLCO) or a partner, and set the moments it happens: at onboarding, when a trigger changes, and at a set interval.
How duely handles this
ECDD opens by itself. A High risk rating, a PEP answer, a confirmed sanctions hit or a failed identity verification opens a case (the AMLCO can also open one manually). Some of those go further than s 32 requires: a domestic or international organisation PEP answer where the customer’s risk is not high, a confirmed sanctions hit, or a failed identity verification. Opening a case for those is duely’s own rule, set to be cautious. Source of funds and source of wealth are captured as structured fields rather than a note, and engagement approval stays blocked until the actions are complete and an approver signs the outcome off. The case follows the starter kit’s format: an identity and risk block per relevant party, typed actions, and a structured outcome.
