You can accept customer due diligence (CDD), the identification and verification of who you are dealing with, when another reporting entity, or a firm regulated under equivalent foreign law, has already performed it. You do not have to repeat the checks. A reporting entity is a person or business that provides a designated service, a service the AML/CTF Act 2006 (Cth) lists as carrying AML/CTF obligations. Acceptance is conditional, and it covers only collecting and verifying the customer’s information, not your other obligations.
Accountants hit this question constantly. It usually surfaces three ways: a customer tells you another firm set them up, another firm refers a customer with the checks already done, or your practice inherits a client file from a predecessor. In each case the verification already exists, and the reliance provisions let you use it. The word to watch is “use”: the use is conditional, and the conditions are precise.
Accountants providing the listed services have been reporting entities since 31 March 2026, as have the other captured sectors, and their customer due diligence obligations have applied since 1 July 2026. The Act calls the person seeking the service the customer, a term that includes a prospective customer. Reliance lets you treat collection and verification performed by another regulated firm as satisfying that part of your own obligation, which means the work travels with the customer rather than being repeated at each firm. See customer due diligence for what the checks involve when you run them yourself.
What reliance lets you do
The point of the provisions is practical: clients move between firms, and re-running the same verification every time would be pointless. The provisions let the work travel, and where the conditions are met the law treats the collection and verification as yours. Reliance covers collecting and verifying KYC information, not your other obligations.
The reliance provisions sit inside the Act’s CDD framework. They were reformed by the AML/CTF Amendment Act 2024, and the detail that used to live in the old AML/CTF Rules now sits in the remade AML/CTF Rules 2025, with new numbering. Three routes sit side by side and are worth keeping apart: s37 covers agent arrangements, where another party carries out the procedure on your behalf; s37A and s37B cover reliance under an ongoing agreement or arrangement, with regular assessments of that arrangement; and s38 covers case-by-case reliance on collection or verification another person has already carried out for that customer.
The effect of a valid reliance is that the Act, other than its record-keeping Part 10, has effect as if you had collected and verified the KYC information yourself (s 37A(2), s 38). You obtain the customer’s identity information from the other party rather than running the checks again. What you keep is the record of the reliance itself: on the s37A route the agreement and your assessments of it, on the s38 route your documented reasons for relying (Rules 6-31(e)), and in both cases the evidence you can call up when asked.
None of this is automatic. The conditions differ by route, and each maps to something you can be asked to show:
| Requirement | Written agreement (s37A) | Case by case (s38) |
|---|---|---|
| Who you can rely on | A reporting entity, or a person regulated under foreign laws that give effect to the FATF Recommendations on CDD and record keeping, with measures in place to comply (Rules 6-29(1)(a), (ab)) | The same (Rules 6-31(a), (ab)) |
| Suited to your risk | The agreement suits the ML/TF risk you face, considering the other party’s business, customers and countries (Rules 6-29(1)(b), (2)); reasonable grounds at the start that the requirements are met (s37A(1)(b)) | Relying suits that risk, considering the same kinds of matters (Rules 6-31(b)), and you have reasonable grounds to believe relying is appropriate for the service (s38(d)) |
| The work itself | Collection and verification carried out by the other party under the agreement | The other person actually carried out the collection or verification for that customer (s38(b)) |
| KYC information | The agreement lets you obtain all the KYC information collected before you start the service, or within the delayed CDD period where s29 applies (Rules 6-29(1)(c)) | Reasonable grounds to believe you can obtain it in the same time (Rules 6-31(c)) |
| Verification data | The agreement lets you obtain copies immediately or as soon as practicable after you ask (Rules 6-29(1)(d)) | Reasonable grounds to believe you can (Rules 6-31(d)) |
| Paperwork | A written agreement or arrangement documenting each party’s responsibilities, including for record keeping (Rules 6-29(1)(e)), approved by a senior manager before you enter it (Rules 5-5(1)(f)) | No agreement, but you document your reasons for concluding the conditions are met (Rules 6-31(e)) |
| Review | Assessments at intervals suited to your risk and no more than two years apart, and after a significant change, each recorded in writing within 10 business days (s37B; Rules 6-30) | No scheduled review |
The counterpart condition does the first part of the work. You rely on a firm you can reasonably rely on: the assessment is yours, and it covers whether the firm is enrolled and regulated, and whether its verification meets the standard you would apply to your own customer. If you know a firm does not run proper checks and you use it anyway, that is not reliance, it is a gap in your program. Record the basis for the assessment: a reviewer who sees “we assumed they were fine” will treat the reliance as unexamined. The foreign question sits here as well, because customers often arrive through an overseas parent or affiliate. The Rules allow reliance on a person regulated by foreign laws that give effect to the FATF Recommendations on CDD and record keeping, if it has measures in place to comply with them, and the risk in the countries where it operates is part of your assessment (Rules 6-29, 6-31). Record how you satisfied yourself that the overseas regime qualifies.
On the s37A route the written agreement does the second part. It has to document each party’s responsibilities, including for record keeping (Rules 6-29(1)(e)), and in practice it also names the parties, the customers or classes of customers it covers, and what the other firm performs, so a reviewer can see the scope at a glance. On the s38 route there is no agreement, but there is a timing test: you need reasonable grounds to believe you can get the KYC information before you start the service (or within the delayed CDD period, where s29 lets you start first), and copies of the verification data immediately or as soon as practicable after you ask (Rules 6-31(c), (d)).
On the s37A route the review keeps the arrangement honest. The Rules set the outer limit: assess the arrangement at intervals suited to your risk and no more than two years apart, and again whenever a significant change may affect it (Rules 6-30), and record each assessment in writing within 10 business days (s37B). Annually is a sensible starting point for your own policy. The assessment asks whether the arrangement still meets the requirements, and whether the records access still works. If an assessment leaves you without reasonable grounds to believe the requirements are met, you cannot rely on the arrangement for later checks until you have those grounds again (s37A(3), (4)). The records condition makes the whole thing examinable: the access has to be real, so a request produces the underlying material, in a form you can read, immediately or as soon as practicable. If the other firm holds records it will not release, the access fails, and so does the reliance.
Reliance is also not outsourcing. The other firm is not your agent and does not act on your instructions: it performed its own CDD for its own purposes, and you are borrowing that work. When something goes wrong, that distinction matters. An agent under s37 does act for you, and the Act’s note to s37 makes you, not the agent, liable for its failures.
Reliance only helps where the other entity actually performed the checks. If the other firm has not done CDD, there is nothing to rely on, and no arrangement changes that. The first question to ask about any candidate arrangement is whether the verification actually exists.
What catches people out
Reliance protects you only while its conditions hold. Firms describe reliance as “they did the CDD, so it is their problem”. That is not how it works. When the conditions are met, the law treats you as having collected and verified the information, so the protection is real, but keeping it in place is your job. On the s38 route it depends on the other firm having actually done the work (s38(b)): if it verified the wrong person, or accepted a document without checking it, the condition fails and the gap is yours, because you are the reporting entity that provided the service. A referral is the classic case: the referring firm says it verified the customer, you relied on that, and a year later it emerges the identity documents were never checked against anything. On the s37A route the protection depends on the agreement, your assessments and the Rules requirements, and it stops for later checks once an assessment shows the requirements are not being met. Your other duties survive as well: if you later form a suspicion about the customer, you still lodge a suspicious matter report (SMR) within three business days, or 24 hours if it relates to terrorism financing, under s41(2). Reliance covers collecting and verifying KYC information, and nothing else: not record keeping, not ongoing monitoring of the customer, and not your reporting duties.
A handshake is not an arrangement. Ongoing reliance under s37A needs a written agreement or arrangement and regular assessments. Without the writing you cannot use s37A, and you are left with case-by-case reliance under s38, with its own conditions and documented reasons, or with doing the CDD yourself. Skip the assessments and you breach s37B, a civil penalty provision, and the protection under s37A(2) falls away, because it depends on your having complied with s37B. You also keep relying on a firm long after its circumstances changed, because it merged, or because it stopped providing the service that made it a reporting entity. Review on a cycle, and keep the review on record.
A confirmation is not the records. The condition is that you can obtain the KYC information the other firm collected and, on request, copies of the data it used to verify it. A letter that says “we performed the checks” is not the record: the identity documents and the source checks, with the dates they were done. When a reviewer asks, you hand over the underlying material, promptly. If the other firm will not release it, or has not kept it, the gap is yours, not theirs. Test the access before you need it, not while a review is already running. The record of your decision to rely, and the reasoning behind it, is your own record: it shows a reviewer that you checked the conditions before relying. Records are retained for seven years, and the record of a reliance decision sits inside that obligation. A written s37B assessment is kept for seven years after you prepare it (s114A): see record-keeping.
What is still unsettled
The reliance provisions were reformed by the AML/CTF Amendment Act 2024, and the rules carrying the detail were remade as the AML/CTF Rules 2025 with new numbering: the conditions now sit in Rules 6-29 to 6-31. The old rule numbers no longer exist, so guidance written before the reform cites provisions you cannot find. What the Rules do not spell out is how to judge whether an overseas regime gives effect to the FATF Recommendations, so expect AUSTRAC guidance to fill that in. If you already rely on another firm today, confirm that the arrangement satisfies the current requirements rather than assuming the old one carries over. When you read AUSTRAC guidance on reliance, check its publication date, because material written before the reform cites provisions that no longer exist.
Where to start
If you have customers whose checks were done elsewhere, start here:
- Find where reliance already happens: go through your live client relationships and mark the ones where another firm performed the verification: companies and trusts established elsewhere, and customers referred by other firms. Each one is a candidate arrangement.
- Pick the route for each: for an ongoing referral relationship, a written s37A agreement that covers each party’s responsibilities and the records access, approved by a senior manager before you enter it and assessed at least every two years; for a one-off case, s38 reliance with your reasons documented. Have your AML/CTF compliance officer (the AMLCO) check each against the conditions above.
- Test the records access: choose one customer and ask the other firm for the underlying CDD records. See how long it takes and what you actually receive. If you cannot get the material, do the CDD yourself.
How duely handles this
Reliance partners live in a registry rather than in a folder of PDFs. The agreement has a lifecycle with a generated document, periodic review and expiry jobs, and each engagement that relies on a partner’s work records the approval and the reasoning behind it. The s38 route has its own form for asking another reporting entity to verify, with the deadline and the signatures recorded, so the request and the response are both on file rather than in an inbox.