Draw the customer and representative relationship
Start with the service and its customer definition. Record the legal person receiving the service, the individual communicating with the practice and the role they claim. Do not assume the invoice recipient, shareholder, bookkeeper and customer are interchangeable. Where one person acts for several entities, keep a separate authority link for each relevant entity and matter. This is especially useful when a group uses one shared accounts email address.
Record the scope and basis of authority
AUSTRAC's individual-customer guidance addresses both a representative's identity and authority, including applicable simplified-verification conditions. Apply the customer-type rules and your risk-based policies rather than inventing a universal document list. In practical terms, note what the person can instruct, the document or independent information supporting that power, any expiry or limits, and who checked it. Escalate conflicting instructions instead of selecting the most convenient signatory.
Distinguish ordinary administration from a new decision
For example, a long-standing payroll contact may be authorised to send employee changes but not to direct a company restructure or dispose of a business asset. Before acting on the new instruction, ask the customer through an established channel to confirm the authority and its extent. Do not use a new phone number supplied in the disputed instruction as the only confirmation source. Record the response and remaining concerns.
Keep authority current at material changes
A departed director, revoked power or replaced trustee can make an old authority record unsafe. Include changed representatives and unexpected instructions in review triggers. Keep the identity and authority conclusions separately visible, with the evidence supporting each. Tell the team what work is paused while authority is unresolved, and record who may approve resumption. This avoids a completed KYC badge being mistaken for an unrestricted right to instruct.
Official sources
Use these primary sources to confirm the current rules and apply them to your circumstances.
Sources checked .
Frequently asked questions
Is an email from the customer's domain enough?
It may be relevant information, but a domain alone does not establish the person's role, authority or the extent of the instruction.
Must every representative supply the same documents?
No. Apply the relevant customer-type provisions, any available conditions for simplified verification and your documented risk-based procedure.
Can a professional adviser confirm their own authority?
Treat self-asserted authority as a claim to assess. Obtain appropriate supporting information and consider independence when selecting corroboration.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.