Enhanced customer due diligence (ECDD) is the escalated form of customer due diligence under the AML/CTF Act 2006 (Cth), and it changes how you treat a customer, not just what you collect from them. It applies from the point a trigger is identified, and it stays on for the life of the relationship.
Your firm is a reporting entity: a business that must comply with the Act because it provides a designated service, a service the Act lists as capturing you, such as the professional services in Table 6 of the Act. Tranche 2 firms became reporting entities on 1 July 2026. Most customers will need nothing beyond the baseline customer due diligence covered in the customer due diligence guide. A minority will need more, and this page is about how you tell the difference and what you do when the answer is more.
What puts a customer into enhanced due diligence
Three things push a customer into ECDD: they are a politically exposed person, they match a name on a sanctions list, or your risk assessment finds high-risk factors. Each is a finding you reach from evidence, and none of them settles the question of what you do next. The rules state these triggers somewhere in the Act or the AML/CTF Rules (2025); the exact location is flagged for verification at the end of this page.
A politically exposed person (PEP) is someone entrusted with a prominent public function: a head of state, a minister, a senior public official, or their equivalent in another country, plus their family and close associates. Their position makes them more vulnerable to bribery and corruption, which is why the rules treat them as higher risk. The precise definition, and how far it reaches into family and associates, is flagged for verification.
Sanctions exposure is a customer, or someone connected to the transaction, matching a person or entity on a sanctions list. A match is a reason to stop and establish what it means: whether it is the same person or a namesake, what the list prohibits, and whether the service can lawfully be provided.
The third trigger is the one you reach through judgement. Your risk assessment finds factors that make the customer or the transaction higher risk: an ownership structure built to be hard to follow, a jurisdiction with weak anti-money laundering controls, a transaction pattern that does not fit the customer, a customer who cannot or will not explain what the money is for. The rules do not hand you an exhaustive list; they expect you to recognise the pattern.
| Trigger | What ECDD adds | When it applies |
|---|---|---|
| Customer is a PEP, or connected to one | Verify the source of funds and source of wealth, and take extra steps to understand the relationship | From the point the status is known, and for the life of the relationship |
| Customer matches a sanctions list | Establish whether the match is real, what the list prohibits, and whether you can provide the service | Immediately on the screening hit, before you proceed |
| High-risk factors from your risk assessment | Investigate the purpose of the transaction, verify the two sources, monitor more closely | From the point the factor is identified, until you can show it has gone |
The provisions behind each row, and the timing rules in the right-hand column, sit in the Act or the AML/CTF Rules (2025) and are flagged for verification.
What enhanced due diligence adds
ECDD extends your baseline checks in two directions: deeper questions and closer monitoring. Baseline customer due diligence establishes who the customer is and verifies it, and the customer due diligence guide covers what counts as verified. ECDD adds why: where the money comes from, and how the customer came to have it.
Source of funds is about the transaction. Where did the money for this deal come from: a savings account, a loan, the sale of an asset, wages? You trace it and keep the evidence: the loan agreement, the sale contract, the account statement. Source of wealth is about the customer. How did they accumulate the wealth that makes this transaction possible: a business they built, an inheritance, a property sold years ago? The two questions are distinct, and AUSTRAC guidance treats them that way.
Where the customer is a company or a trust, the enhanced checks reach the individuals behind it: the beneficial owners, the people who ultimately own or control the customer. The beneficial ownership guide covers when you can stop that digging.
ECDD also reaches forward into monitoring. The assessment is not a snapshot; you re-check the triggers as circumstances change and keep the enhanced checks current for the life of the relationship. Ongoing customer due diligence is the point of ECDD, not an add-on.
The information you gather has a second life as the raw material for a suspicion decision. When a suspicion forms, a suspicious matter report (SMR) is due within three business days of the suspicion forming, under s41(2) of the Act. ECDD that is still in progress does not pause that clock.
What catches people out
Three mistakes recur in firms doing ECDD for the first time.
The two money questions answer different things: the source of funds is where this transaction’s money came from, and the source of wealth is how the customer built the money behind it. Answering one leaves the other open. A file that documents a loan as the source of funds but never asks how the lender came to hold that amount has answered half the question. The consequence: a reviewer or AUSTRAC sees the gap, and the customer gets a follow-up at the worst moment.
A sanctions or PEP hit starts an assessment, it does not end one. The match has to be established: same person or namesake, what the list prohibits, whether the service can be provided. Some hits end in refusal, some in a cleared file, and the file has to show which and why. Refuse on a false positive and you have turned down a legitimate customer on a namesake. Wave through a real hit and you have provided a designated service to someone you should have stopped. There is a third risk: you cannot brief the customer on the finding. Section 123 makes it an offence to disclose anything that would, or could reasonably be expected to, prejudice an investigation, and it does not matter whether an investigation has started. Explaining a screening flag while a report is being considered is the kind of disclosure that test catches.
ECDD is ongoing, not a one-off. The trigger is assessed when you take the customer on, and then again when the world changes: a customer takes public office, a new jurisdiction appears in the transaction chain, a pattern of activity shifts. Treat it as a one-off and the customer drifts back to baseline treatment while the risk has moved, and the file will not show that anyone noticed. The record of when you re-checked, and what you found, is the only thing that proves the difference.
What is still unsettled
Two things about ECDD are still settling. The first is where the triggers sit. The pre-2024 framework kept most of ECDD in the AML/CTF Rules; the 2024 amendments and the remade AML/CTF Rules (2025) have moved the pieces around. Whether a given trigger is a direct statutory requirement or a rule requirement affects how you document it, and the split is still being worked out in practice.
The second is how AUSTRAC expects the triggers applied. ECDD turns on a risk-based judgement: which factors count, how much verification is enough, how often to re-check. AUSTRAC’s guidance carries the detail, and how that guidance lands under the new framework has not fully settled. Build your procedure as version one and expect to revise it.
Where to start
Three steps get ECDD working before the first enhanced file lands.
- Screen before you take them on: put PEP and sanctions screening at the front of onboarding, and treat any hit as the start of an assessment, not the end of one.
- Capture the two questions separately: make source of funds and source of wealth separate questions with separate evidence in your file, so a completed file shows both answered and the distinction was made.
- Name who reviews, and when: point to the person who reviews enhanced files, your AML/CTF compliance officer (AMLCO) or a partner, and set the moments it happens: at onboarding, when a trigger changes, and at a set interval.
How duely handles this
ECDD opens by itself rather than waiting to be remembered. A high risk rating or a sanctions hit auto-opens a case, source of funds and source of wealth are captured as structured fields rather than a note, and matter approval stays blocked until someone senior signs the outcome off. The case follows the starter kit’s format: an identity and risk block per relevant party, typed actions, and a structured outcome.