CDD and beneficial ownership for Australian VASPs

Identify the customer for the designated service

Start with the customer definition attached to the service. For item 50A, the customer is the person whose money or virtual asset is exchanged; for item 50B, the person whose virtual asset is exchanged; for safekeeping, the customer of that service; and for transfer services, the payer or payee relevant to the institution's role. Keep the account user, funder, wallet controller, representative and legal customer separate where they are different.

Record whether the relationship is ongoing or an occasional transaction and what the customer wants to achieve. Establish expected assets, chains, fiat methods, transfer directions, value, frequency, counterparties and jurisdictions. This information supports the service-scope decision, customer-risk assessment and later identification of activity that does not fit the stated purpose.

Establish individuals, representatives and authority

Collect and verify KYC information appropriate to the individual and assessed risk using reliable and independent material. Resolve name, date-of-birth, address and identity inconsistencies rather than treating a technical verification score as the final decision. A non-face-to-face channel, reused device, third-party funding or synthetic-identity indicator may require additional measures.

For a person acting for a customer, establish both identity and authority. A director, employee, trustee, adviser, agent or API operator should not gain control merely because they can access an email address or company document. Define account permissions, transaction approval rights and withdrawal controls, and retain the authority evidence and any limits.

Trace beneficial ownership and control

A beneficial owner is an individual who directly or indirectly ultimately owns 25% or more of the customer or otherwise controls it. There can be more than one beneficial owner, and control can exist without a qualifying shareholding. Trace each company, partnership, trust, nominee and foreign layer until the relevant individuals are established on reasonable grounds.

For companies, reconcile registers, extracts, constitutions, shareholder information and control arrangements. For trusts, review the trustee and relevant governance or control roles and continue through any corporate trustee. Record percentages, indirect paths, voting or appointment rights, source documents, dates and unresolved differences. A customer-supplied chart is useful but is not independent verification by itself.

Assess risk and apply the correct level of CDD

AUSTRAC states that a VASP must apply enhanced CDD when a customer deposits or receives physical currency in exchange for virtual assets, including through a crypto ATM. The VASP must collect and verify the customer's source of funds and hold source-of-wealth information through ongoing CDD. This is a specific trigger; it should be built into the channel and transaction workflow rather than left to discretionary manual review.

• Consider customer type, beneficial ownership, PEP and sanctions exposure, service, asset, chain, custody model, transaction purpose, delivery channel and relevant jurisdictions.
• Consider whether the customer uses mixers, higher-risk decentralised services, offshore or unregistered VASPs, crypto ATMs, over-the-counter brokers, self-hosted wallets or privacy-enhancing assets, without assuming one feature decides the rating.
• Apply enhanced CDD when a current statutory trigger is met, document the trigger and select measures that manage the identified risk.
• Update and reverify KYC and customer risk when transactions, ownership, control, purpose, behaviour or external information materially change.

Approve, monitor and retain the CDD record

Initial CDD is generally completed before the designated service, subject to the defined delayed-CDD framework. Commercial urgency, market volatility or a customer waiting to trade is not by itself permission to delay. If required matters cannot be established, follow the hold, escalation, rejection and reporting process in the AML/CTF policies.

Retain the information collected, verification source and result, ownership map, authority, purpose, expected activity, risk assessment, enhanced measures and approval. AUSTRAC says CDD records are generally kept for seven years after the business relationship ends or the relevant occasional transaction is complete. Avoid retaining unnecessary copies of identity documents when the required type-and-content record can demonstrate compliance with less privacy risk.