Collect information for an identified purpose
Identify the CDD matter and the evidence method before requesting a document. Record what information is necessary and where it will be stored. Avoid asking customers to send identity images to several staff members because each team has a separate checklist. Where a provider collects information, understand what the practice receives and can retrieve. Distinguish the required verification record from an assumption that a full image must always be copied into every system.
Make access follow the work
Separate ordinary client administration, detailed identity evidence and protected reporting material. Assign access according to the person's actual role and remove it when responsibilities end. Use an approved secure channel for requests and exchanges, and check the intended recipient before sharing. A client folder shared with an external bookkeeper should not silently expose unrelated beneficial-owner documents or internal suspicion records. Record significant access or disclosure decisions where appropriate.
Apply retention and security together
OAIC's APP 11 guidance addresses both security and destruction or de-identification when information is no longer needed, subject to legal retention exceptions. Apply the relevant AML retention period and any other lawful requirement to each record class. Keep necessary records protected and retrievable. Review temporary downloads, test copies and duplicated attachments separately; a seven-year obligation for a retained record is not a blanket instruction to keep every working copy forever.
Test the process with a common request
Suppose a customer asks for a correction or another adviser requests their file. Confirm authority, decide what can lawfully be shared and exclude material subject to disclosure restrictions. Use a controlled export rather than forwarding the entire folder. If information was sent to the wrong recipient, use the incident procedure and assess applicable notification duties. Periodically test retrieval and access removal so the policy reflects what people can actually do.
Official sources
Use these primary sources to confirm the current rules and apply them to your circumstances.
Sources checked .
Frequently asked questions
Can a small reporting entity ignore privacy duties?
No. AUSTRAC's record-keeping guidance expressly explains that reporting entities have Privacy Act obligations even when they are small businesses.
Must every identity document image be retained?
Do not assume that. Apply the relevant record-keeping and verification requirements and retain sufficient information about what was done, using an appropriate evidence method.
Does a customer's request authorise disclosure of an SMR?
No. Consider protected-information and other legal restrictions separately when handling access, correction or file-transfer requests.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.