Record what failed without changing its meaning
Identify the check type, customer reference, request time and technical outcome. Separate not submitted, awaiting result, technical failure, unsupported and an actual adverse result. Avoid putting sensitive documents or raw provider messages into a general incident log. Assign someone to determine whether the original request reached the provider before retrying. A successful payment or a created request identifier is not evidence that identity or screening was completed.
Decide the lawful service boundary
Identify which CDD matter depends on the unavailable result and whether it can be established using another permitted method. Apply the practice's policies and relevant customer-type requirements. If required matters remain unmet, restrict the affected work; a service outage does not itself create a delayed-CDD permission. Keep customer communication factual and helpful, explaining the outstanding step and available process without disclosing protected internal reporting material.
Use a real alternative rather than a manual pass
For example, a digital service may not support the customer's document. An authorised reviewer might assess other reliable, independent evidence under the applicable procedure. Record what was examined, the source, the reviewer and how the conclusion was reached. Do not tick verified simply because a staff member looked at an uploaded image. Identity, authority, beneficial ownership, sanctions and risk are separate matters; an alternative for one does not complete the others.
Reconcile the outstanding requests after recovery
Check for late results, duplicate submissions and charges, and connect every retained result to the correct customer and original request. Reconsider decisions if later information conflicts with an interim assessment. Record the incident's scope, controls used and any remediation, then review supplier arrangements and access to evidence. A restored status page should close the technical incident only after pending casework has been reconciled and ownership of unresolved files is clear.
Official sources
Use these primary sources to confirm the current rules and apply them to your circumstances.
Sources checked .
Frequently asked questions
Does provider unavailable mean customer failed?
No. It is a process outcome. Keep it distinct from a genuine verification failure or a supported adverse finding.
Can staff always replace a provider with a manual check?
No. The alternative must meet the applicable law and the practice's approved procedures, with appropriate evidence and authority.
Should every failed request be retried immediately?
First determine whether it was submitted and whether a result is pending. Uncontrolled retries can create duplicate casework or charges without resolving the original uncertainty.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.