Hannah Deuk – Click Legal

AFSL Responsible Manager Training: A Guide to Compliance & Best Practice

Hannah Deuk — Sun, 12 Jul 2026 03:04:18 +0000

Introduction

For most responsible managers (RM), ongoing training feels like just another box to tick, but in 2026, it may serve as a shield against potential liability. The Australian Securities and Investments Commission (ASIC) expects an AFS licensee to comply with its organisational competence obligation under Section 912A(1) of the Corporations Act 2001 (Cth), and maintaining and updating RM knowledge and skills is a core part of the same.

This article explains the organisational competence obligation under Section 912A(1)(e) of the Corporations Act 2001 (Cth), ASIC’s RM-related expectations in Regulatory Guide (RG) 105, and suggests practical tips to help a licensee document its compliance measures.

Interactive Tool: Check If Your RM Training & Records Are Compliant

AFSL Responsible Manager Competence Checker

Quickly assess if your Responsible Managers meet ASIC’s ongoing competence and training requirements under the Corporations Act 2001 (Cth).

Are you an AFSL holder or a Responsible Manager (RM) seeking to check compliance with ASIC’s organisational competence obligations?

Has each RM demonstrated ongoing professional development and training relevant to the financial services and products your AFSL authorises?

Have you reviewed and updated your RM competence and conflicts management framework in light of the 2026 ASIC RG 181 update?

✅ You appear compliant with RM obligations

Your documented approach to Responsible Manager training and competence aligns with Section 912A(1)(e) of the Corporations Act 2001 (Cth) and ASIC’s expectations in RG 105. Maintain up-to-date records and regularly review your framework to ensure ongoing compliance, especially after regulatory changes such as the 2026 conflicts of interest update.

Legal References

Section 912A(1)(e) of the Corporations Act 2001 (Cth)
ASIC Regulatory Guide 105
ASIC Regulatory Guide 181
Schroeder and Australian Securities and Investments Commission [2021] AATA 3519
ASIC v Lanterne Fund Services Pty Ltd [2024] FCA 353

Book a Compliance Review with a Financial Services Lawyer

⚠️ Training or Documentation Gap Detected

ASIC expects AFSL holders to maintain ongoing, documented training for all Responsible Managers under Section 912A(1)(e) of the Corporations Act 2001 (Cth) and RG 105.10–RG 105.11. Gaps in your training register or documentation may expose your license to regulatory action or penalties. Immediate remedial action is recommended.

Legal References

Section 912A(1)(e) of the Corporations Act 2001 (Cth)
ASIC Regulatory Guide 105.10–105.11
ASIC v Lanterne Fund Services Pty Ltd [2024] FCA 353

Get Help Updating Your RM Training Register

⚠️ Framework Not Updated for 2026 Conflicts Changes

The 2026 update to ASIC Regulatory Guide 181 introduced new expectations for managing conflicts of interest. If your RM competence or conflicts management framework has not been reviewed and updated, you may be at risk of non-compliance with Section 912A(1)(aa) of the Corporations Act 2001 (Cth). Proactive review and targeted training are strongly advised.

Legal References

Section 912A(1)(aa) of the Corporations Act 2001 (Cth)
ASIC Regulatory Guide 181 (2026 update)
ASIC Regulatory Guide 105

Request a Conflicts Management Review

❌ This tool is for AFSL holders and Responsible Managers

This compliance tool is designed for AFSL holders and Responsible Managers. If you need assistance with other financial services compliance matters, please contact our team.

Speak to a Financial Services Lawyer

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

The Legal Foundations for Responsible Manager Training

Section 912A of the Corporations Act 2001 (Cth)

The legal basis for organisational competence stems from the Corporations Act 2001 (Cth). Under Section 912A(1)(e), holders of an AFSL have a legal duty to maintain the competence required to provide the financial services their licence authorises.

This core requirement requires licensees to:

Appoint RMs who possess the necessary knowledge and skills to effectively manage the financial services business; and
Uphold an ongoing duty to maintain this competence at all times, rather than treating it as a one-time assessment.

ASIC Regulatory Guide 105

ASIC assesses a licensee’s compliance with the organisational competence obligation through the framework detailed in RG 105. This guide explains that ASIC’s assessment focuses on the knowledge and skills of the people nominated to manage the financial services business, who are referred to as RMs.

RG 105 provides regulatory guidance on the competence and training requirements for these roles and outlines how ASIC applies the law. Consequently, ASIC expects licensees to have robust measures in place to maintain organisational competence, which includes:

regularly reviewing organisational competence and reviewing it whenever RMs or business activities change: RG 105.10(a);
maintaining and updating RM knowledge and skills: RG 105.10(b); and
keeping records of reviews and steps taken to maintain competence: RG 105.10(c)–RG 105.11.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Initial Training for New Responsible Managers

Navigating the Five Competency Pathways

To be nominated as an RM, an individual must demonstrate they have the appropriate knowledge and skills for the role. ASIC outlines five distinct pathways for this in RG 105. Each option requires a combination of qualifications or training (the knowledge component) and practical experience (the skills component).

A prospective RM must satisfy one of the following options:

Option 1: Industry or APRA Standard: This involves meeting a widely adopted and relevant industry standard or a standard set by the Australian Prudential Regulation Authority (APRA). This must be combined with at least three years of relevant experience gained over the past five years.
Option 2: Individual Assessment: This pathway requires an individual to be assessed by an authorised assessor as having knowledge equivalent to a diploma, along with five years of relevant experience over the past eight years. It is generally suited to experienced RMs without formal qualifications.
Option 3: University Degree and Short Industry Course: A candidate can rely on holding a university degree in a relevant discipline, such as commerce or economics, supplemented by a relevant short industry course. This must be paired with three years of relevant experience over the past five years.
Option 4: Industry-Specific Qualification: This option requires holding a relevant industry-specific or product-specific qualification that is equivalent to a diploma or higher, such as a Diploma of Financial Services. The candidate must also have three years of relevant experience over the past five years. The required qualification must be relevant to the RM’s actual role and the financial services or products for which the licensee relies on that RM.
Option 5: Other Demonstration of Knowledge and Skills: If the other options are not suitable, a written submission can be made to ASIC. This submission must detail the RM’s qualifications, credentials, and relevant experience over the past 10 years to argue why they possess the appropriate knowledge and skills for the role.

Tailoring Education for Licence Authorisations

The qualifications and experience of your nominated RMs must be directly relevant to the financial services and products your AFSL authorises. Therefore, your RMs must, collectively, have the appropriate knowledge and skills to cover every financial service and product covered by the AFSL.

This requirement ensures genuine organisational competence across all business activities. For instance, if a licensee is authorised to provide advice on both life insurance and general insurance products, it could meet this obligation by having the following:

One RM with expertise in life insurance and another with expertise in general insurance.
A single RM competent in advising on both product types, while another covers the dealing aspects of the business.

For businesses that operate a registered managed investment scheme or a corporate collective investment vehicle (CCIV), there are specific requirements. RG 105.41 requires the nominated RMs’ collective knowledge and skills to cover both the operation of the scheme or CCIV and the relevant kind of scheme or type of CCIV assets. RG 105.74–RG 105.77 gives further guidance on relevant asset-specialist knowledge and qualifications. This supports oversight of both the financial service and the underlying assets.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Ongoing Training & CPD Requirements

Overcoming the Set & Forget Mentality

Achieving the status of an RM is not the final step in the compliance journey; it is the beginning. As established under Section 912A(1)(e), the core obligation for an AFSL holder is to maintain organisational competence at all times, not just establish it once. Therefore, this requires a continuous commitment to training and development.

As detailed in RG 105.10, ASIC expects the licensee’s compliance measures to maintain and update its RMs’ knowledge and skills. It also expects regular reviews and reviews whenever the RMs or business activities change. Training should be tailored to the RM’s role, the authorisations for which the licensee relies on that RM, identified knowledge gaps and regulatory change. This commitment to continuous professional development (CPD) is a fundamental part of demonstrating organisational competency.

Appropriate development activities can include:

structured training sessions;
documented briefings on relevant legislative or regulatory changes;
workshops or scenario testing tied to the licensee’s services and products;
supervised review of incidents, complaints, or breaches; and
relevant webinars, conferences or technical reading.

Navigating the 2026 Conflicts of Interest Update

The evolving regulatory landscape provides a clear example of why a “set and forget” approach is risky. ASIC issued the updated RG 181 on 16 December 2025, which introduced critical updates to guidance concerning conflicts of interest and changed the expectations for how RMs must oversee this core obligation.

Section 912A(1)(aa) of the Corporations Act 2001 (Cth) requires an AFS licensee to have adequate arrangements for managing conflicts of interest that may arise in relation to activities undertaken by the licensee or its representatives in providing financial services as part of their financial services businesses. It does not require all conflicts to be eliminated, but that conflicts must be adequately and effectively managed.

A licensee should, therefore, assess the updated guide, document whether its conflicts framework or RM knowledge needs to change, and provide targeted training where a genuine gap is identified. This scenario highlights how quickly an RM’s knowledge can become outdated. Relying on qualifications or training completed before such a significant regulatory shift creates a compliance gap.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Building a Training Plan & Evidence Register

Creating an Evidence Register Aligned with ASIC’s Expectations

To demonstrate compliance, documentation matters. Section 912A(1)(e) of the Corporation Act 2001 (Cth) does not expressly mandate an RM training register. However, RG 105.10(c) states that ASIC expects licensees to keep records showing that they have reviewed organisational competence and the steps taken to maintain it, while RG 105.11 explains that documentation helps show compliance.

A central evidence register is therefore a practical method of meeting ASIC’s evidentiary expectation. It may capture:

RM name;
date of activity;
training provider or facilitator;
topic or course title;
type of activity;
duration, where useful;
evidence of completion or participation;
relevance to the RM’s role and the licensee’s authorisations;
knowledge gap or regulatory change addressed;
outcome, action item or policy/process change; and
date for follow-up review.

As a best practice, the register should not be limited to attendance certificates. It should also record competence-mapping reviews, changes to authorisations or business activities, changes in RM responsibilities, identified gaps, and the steps taken in response.

Using Records During an ASIC Audit

A well-maintained training plan and evidence register are indispensable tools during an ASIC audit or surveillance visit. RG 105.14 states that, if ASIC conducts a surveillance visit, it may check ongoing compliance with the organisational competence obligation, including the licensee’s measures for ensuring compliance. ASIC may also require information or assistance under Section 912C of the Corporations Act 2001 (Cth).

These records can show that the board and senior management treat organisational competence as an active governance responsibility rather than an afterthought. They can also demonstrate that:

RM coverage has been mapped to each authorised service and product;
competence was reviewed when the business or RMs changed;
relevant knowledge gaps were identified and addressed; and
the licensee retained evidence of the review and remedial steps.

This systematic approach helps protect the firm by showing a culture of compliance and provides evidence of organisational competence.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Penalties & Consequences for Non-Compliance

Regulatory Risks & The Cost of Stagnation

Failing to maintain organisational competence through ongoing training can expose an AFSL holder and its RMs to severe regulatory consequences. Violation of Section 912A(1)(e) is a civil penalty provision by operation of Section 912A(5A) of the Corporations Act 2001 (Cth). Further, a court may impose a pecuniary penalty under Section 1317G.

ASIC may also:

impose, vary or revoke licence conditions under Section 914A(1) of the Corporations Act 2001 (Cth); and
after offering the licensee an opportunity to appear or be represented at a hearing, suspend or cancel the AFS licence.

Further, ASIC may also issue a personal banning order against an RM if it finds that the RM is:

not fit and proper;
not adequately trained or competent to provide financial services;
has not complied with financial services law;
is likely to contravene financial services law; or
was involved in another person’s contravention.

Beyond direct regulatory action, a failure to invest in training can harm business operations and reputation. Untrained RMs may struggle to oversee financial services effectively. As a result, this can lead to operational inefficiencies, an increased risk of compliance breaches, and a loss of trust with clients and stakeholders.

Lessons from the Schroeder & Lanterne Cases

Two ASIC enforcement actions, as seen in Schroeder and Australian Securities and Investments Commission [2021] AATA 3519 and ASIC v Lanterne Fund Services Pty Ltd [2024] FCA 353, illustrate the consequences of a poor compliance culture.

In Schroeder [2021] AATA 3519, the Administrative Appeals Tribunal found that Mr Schroeder was not fit and proper, had been involved in contraventions of financial services laws, was not adequately trained or competent to manage the provision of financial services. Further, he was likely to be involved in future contraventions. The Tribunal criticised a culture that prioritised business growth over compliance.

ASIC v Lanterne involved a “licensee for hire” model with hundreds of authorised representatives but only one full-time RM. The Federal Court found several contraventions including:

Failure to maintain organisational competence, including by having an inadequate number of RMs, inadequate RM expertise and time commitment, and inadequate processes for ensuring that RMs were appropriately qualified; and
Failure to ensure that its representatives were adequately trained and competent.

Both cases demonstrate that when a firm’s culture neglects compliance and training, ASIC may impose serious penalties.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

Maintaining organisational competence through continuous, documented training is a non-negotiable legal duty for AFSL holders under the Corporations Act 2001 (Cth). A proactive approach to professional development, including keeping up with regulatory changes like the 2026 conflicts of interest update and maintaining a detailed evidence register, is the most effective shield against severe penalties such as lifetime bans.

To ensure your RMs are equipped to meet these ongoing obligations, it is vital to have expert guidance. The AFSL lawyers at Click Legal deliver high-level institutional expertise on a fixed-fee basis, helping you build and maintain an AFSL compliance framework. Contact us today to learn how our ongoing support can protect your AFS licensee and its RMs from liability.

Frequently Asked Questions

What is an AFSL responsible manager?

An AFSL RM is a person nominated by a licensee to demonstrate to ASIC that the organisation has the competence to provide its financial services. Under Section 912A(1)(e) of the Corporations Act 2001 (Cth), RMs are appointed to oversee the day-to-day provision of the financial services the AFSL authorises.

How many CPD hours are required annually?

ASIC does not mandate a specific number of annual CPD hours for an AFSL RM under the Corporations Act 2001 (Cth). Licensees are, however, expected to ensure their RMs undertake regular professional development to maintain their knowledge, skills, and overall organisational competence.

Can I be a responsible manager on multiple licences?

Yes, it is possible to be an RM on multiple licences, but ASIC assesses these arrangements carefully. Where a person is already an RM for another AFS licensee, the nominating licensee must be able to demonstrate that the person can devote sufficient time to the role and that conflicts of interest will be managed.

What happens if a key person leaves?

If an RM designated as a ‘key person’ on your AFSL leaves the business, you must notify ASIC within five business days, or the time specified in your licence conditions, and find a suitable replacement promptly. Failing to do so can put your AFSL at risk of suspension or cancellation, as it may mean you no longer meet the organisational competence obligation.

Does ASIC provide RM training courses?

No, ASIC does not provide RM training courses. It is the AFSL holder’s responsibility to determine how its RMs maintain their knowledge and skills and to source appropriate training from external providers or conduct it in-house.

What are the consequences of non-compliance?

Failing to maintain organisational competence can lead to severe consequences under the Corporations Act 2001 (Cth). ASIC may suspend or cancel your AFSL, and it can impose personal banning orders on the RMs involved.

What is the difference between Option 1 & Option 5?

The main difference is that Option 1 is a standardised pathway while Option 5 is a flexible, submission-based assessment for demonstrating competence under ASIC’s RG 105. Under Option 1, a person meets a recognised industry standard and has three years of relevant experience in the past five years. Option 5 requires a detailed written submission to convince ASIC of a person’s competence based on their experience over the past 10 years when they do not meet the specific criteria for other options.

What to Do After an AFSL Application Refusal by ASIC

Hannah Deuk — Sun, 12 Jul 2026 02:59:15 +0000

Introduction

Obtaining an Australian financial services licence (AFSL) is a mandatory requirement for businesses wanting to provide financial services. Under the Section 913B of the Corporations Act 2001 (Cth), the Australian Securities and Investments Commission (ASIC) must refuse an application if it believes the applicant cannot meet their general obligations, lacks adequate financial resources, fails the fit and proper person test, or submits a materially false or misleading application.

For applicants facing a potential or formal refusal, understanding the available legal and administrative options helps keep their proposed financial services business viable. This article explains the reasons ASIC rejects applications and the immediate steps to take after a refusal for founders and compliance officers so you can manage the review process or successfully reapply.

Interactive Tool: Find Your Best Next Step After an AFSL Refusal & Warning

AFSL Refusal Response Checker

Find out your best next step if your Australian Financial Services Licence (AFSL) application has been refused or is at risk.

What stage are you at in the AFSL application process?

Do you want to challenge ASIC’s decision or focus on reapplying?

⚖️ Request an Administrative Hearing

If you have received a notice of intention to refuse, you have the right to request a private administrative hearing before ASIC makes a final decision. This is your opportunity to present new evidence or clarify issues directly to an independent ASIC delegate.

Act quickly: You must respond within the timeframe specified in the notice.

Relevant law: Section 913B(5) of the Corporations Act 2001 (Cth).

Get Representation for Your ASIC Hearing

⚖️ Apply for a Merits Review at the ART

If ASIC has formally refused your AFSL application, you may apply for a merits review at the Administrative Review Tribunal (ART). This process allows a fresh review of all facts and law and is not limited to the original evidence.

Time limit: 28 days from notice of refusal or receipt of reasons.

Relevant law: Section 1317B of the Corporations Act 2001 (Cth); Sections 52–54 of the Administrative Review Tribunal Act 2024 (Cth).

Start Your ART Review Application

⚖️ Consider Judicial Review in the Federal Court

If you believe ASIC or the ART made a legal error in refusing your AFSL application, you may seek judicial review in the Federal Court. This process examines whether the decision was made lawfully, not the merits of your application.

Time limit: 28 days from notification of the decision or receipt of reasons.

Relevant law: Section 5 of the Administrative Decisions (Judicial Review) Act 1977 (Cth).

Speak to a Financial Services Litigation Lawyer

✅ Strengthen and Reapply for Your AFSL

If you plan to reapply, address the deficiencies that led to refusal. Ensure your responsible managers meet the requirements in ASIC’s RG 105, and provide evidence of financial resources and compliance frameworks tailored to your business.

Relevant law: Section 912A(1)(d) of the Corporations Act 2001 (Cth); Section 912A(1)(e) of the Corporations Act 2001 (Cth); Section 913BA of the Corporations Act 2001 (Cth); ASIC RG 105 & RG 166.

Get AFSL Application Support

⚠️ Operate as a Corporate Authorised Representative (CAR)

If you cannot obtain your own AFSL immediately, consider operating as a Corporate Authorised Representative (CAR) of an existing licensee. This allows you to legally provide financial services under another licensee’s supervision.

Relevant law: Section 916A(1) of the Corporations Act 2001 (Cth).

Discuss CAR Pathways with a Lawyer

✅ Application Withdrawn – No Permanent Refusal Recorded

Withdrawing your application before a formal refusal prevents a permanent ‘refused licence’ mark on your regulatory record. You can address deficiencies and reapply without the negative history.

Relevant law: Section 913B(4B) of the Corporations Act 2001 (Cth).

Plan Your Next AFSL Application

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Common Reasons for an AFSL Application Refusal

Failing the Fit & Proper Person Test

Under Section 913B(1)(c) of the Corporations Act 2001 (Cth), ASIC must not grant an AFSL unless the fit and proper person requirement in Section 913BA is satisfied. Section 913BA requires ASIC to be satisfied that there is no reason to believe that the applicant or any other person specified in Section 913BA(1) is not fit and proper for the relevant statutory purpose. A failure to meet this standard is a common reason for an AFSL application to be refused. Ultimately, this test assesses a person’s competence, character, and financial soundness.

The statutory test applies to:

the applicant;
an officer of a body corporate applicant;
the partners or trustees, and senior managers, of an applicant that is a partnership or multiple-trustee entity;
a person who controls the applicant; and
specified officers, partners, trustees and senior managers of a controller.

When assessing if a person is fit and proper, ASIC considers several factors. According to Section 913BB(2) of the Corporations Act 2001 (Cth), these include:

Whether the person has been convicted of an offence in the last 10 years;
Whether they have had a licence suspended or cancelled;
Whether they have been subject to a banning or disqualification order;
Any links to a failure to comply with a determination by the Australian Financial Complaints Authority (AFCA);
Any involvement in an insolvency event; and
Any involvement in other matter ASIC considers relevant.

Inadequate Organisational Competence & Responsible Managers

Under Section 912A(1)(e) of the Corporations Act 2001 (Cth), an AFS licensee must maintain the competence to provide the financial services covered by its licence. At the application stage, Section 913B(1)(b) requires ASIC to consider whether there is reason to believe that the applicant is likely to contravene that obligation if the licence is granted.

ASIC ordinarily assesses organisational competence by examining the knowledge and skills of the people nominated as responsible managers. As outlined in ASIC’s Regulatory Guide (RG) 105, responsible managers are expected to:

have direct responsibility for significant day-to-day decisions concerning the financial services business;
collectively have appropriate knowledge and skills covering all financial services and financial products for which authorisation is sought; and
individually satisfy one of the five knowledge-and-skills options described in RG 105.

For example, if an applicant seeks authorisation to advise on derivatives, but its responsible managers only have experience with general insurance products, ASIC is likely to find that organisational competence has not been demonstrated. That evidentiary gap may give ASIC reason to believe that the applicant is likely to contravene provisions of the Corporations Act 2001 (Cth).

Insufficient Financial Resources & Compliance Frameworks

An AFSL application may be refused if the applicant fails to demonstrate it has adequate resources and a robust compliance framework. Section 912A(1)(d) of the Corporations Act 2001 (Cth) requires a licensee to have sufficient financial, technological, and human resources to provide its financial services and carry out supervisory arrangements.

In addition, ASIC’s RG 166 explains the financial requirements ASIC ordinarily imposes through licence conditions or statutory modifications, depending upon the financial services and products covered by the licence. They may include solvency and positive net asset requirements, cash-needs requirements, audit requirements and additional or tailored requirements for particular categories of licensee.

Beyond financial stability, ASIC must have no reason to believe the applicant is likely to contravene its general obligations under Section 912A of the Corporations Act 2001 (Cth). To ensure this, ASIC may examine your arrangements for:

providing financial services efficiently, honestly and fairly;
managing conflicts of interest;
taking reasonable steps to ensure representatives comply with financial services laws;
ensuring representatives are adequately trained and competent;
maintaining compliant internal dispute-resolution procedures and AFCA membership where services are provided to retail clients; and
maintaining compensation arrangements, where required.

The Tribunal in Superannuation Warehouse Australia Pty Ltd and Australian Securities and Investments Commission [2019] AATA 88 considered whether there was “reason to believe” an applicant would fail to comply with their future obligations. The refusal was upheld due to the applicant’s history of using misleading business names and previous non-compliance. This highlights that ASIC’s gatekeeper role is designed to prevent foreseeable breaches of the Corporations Act 2001 (Cth) before a licence is granted.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Navigating the ‘Intention to Refuse’ Stage

Requesting an Administrative Hearing with an ASIC Delegate

ASIC cannot formally refuse an AFSL application without first giving the applicant a chance to respond. Under Section 913B(5) of the Corporations Act 2001 (Cth), an applicant has the right to be heard before a final decision is made. This process typically begins when the assessing delegate identifies serious issues with the AFSL application and issues a notice of intention to refuse.

Upon receiving this notice, you can request a private administrative hearing. This provides an opportunity to present your case directly to an independent ASIC decision-maker who was not involved in the initial assessment. The hearing is an informal, inquisitorial process where you can:

Present new evidence or clarify complex aspects of your financial services business.
Make verbal or written submissions to counter ASIC’s concerns.
Provide further evidence concerning organisational competence, financial resources, governance, compliance arrangements or the persons assessed.

You may choose to have legal representation at the hearing. Ultimately, the objective is to demonstrate that the statutory conditions for granting the licence are satisfied and that any concern about false, misleading or materially incomplete information has been resolved.

Strategically Withdrawing the Application

Instead of proceeding to a hearing, you may decide that voluntarily withdrawing the AFSL application is a better strategic option. This may be appropriate where the applicant cannot remedy material deficiencies within the current assessment process and intends to restructure the business or supporting evidence before reapplying. The primary benefit of withdrawing is that it prevents a formal refusal from being recorded on your regulatory history.

Furthermore, an application is also considered withdrawn if you fail to respond to an information request from ASIC within a specified timeframe. Under Section 913B(4B) of the Corporations Act 2001 (Cth), this is called a deemed withdrawal.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Immediate Steps After a Formal ASIC Rejection

Requesting a Written Statement of Reasons

If ASIC has formally refused your AFSL application, you are entitled to understand the specific grounds for the decision. Section 1317D of the Corporations Act 2001 (Cth) requires ASIC to take reasonable steps to give an affected person notice of a reviewable decision and the person’s review rights.

Further, you may also request a written statement of reasons under Section 268 of the Administrative Review Tribunal Act 2024 (Cth), which should be typically provided to you within 28 days of ASIC receiving the request. The statement of reasons will outline why ASIC believes you did not meet the requirements. This document is essential for identifying the exact deficiencies in your AFSL application and planning your next steps.

Seeking Documents Using Freedom of Information Legislation

Beyond the formal statement of reasons, you may seek access to a broader range of documents related to ASIC’s assessment of your AFSL application. This can be done by making a request under Section 11 of the Freedom of Information Act 1982 (Cth) (FOI Act). This provision gives a person a legally enforceable right to obtain access to an agency document, subject to the FOI Act.

An application for these documents must be made in writing and should clearly state which documents you wish to obtain. Furthermore, you can send your application by email to ASIC’s FOI Team.

This process can provide deeper insight into ASIC’s assessment of your application. However, it does not guarantee access to all internal notes, legal advice or deliberative material. Access may be refused or redacted under the exemptions and conditional exemptions in Part IV of the FOI Act (Cth), including provisions concerning law enforcement, legal professional privilege, deliberative processes and agency operations.

Further, it is important to be aware that charges may be imposed for the time spent searching for, retrieving, and preparing the documents for release.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Formal Appeal & Review Options

Applying for a Merits Review at the Administrative Review Tribunal

If ASIC formally refuses your AFSL application after a hearing, you have the right to seek an independent merits review. This right is provided under Section 1317B of the Corporations Act 2001 (Cth). The review is conducted by the Administrative Review Tribunal (ART), which has taken over this function from the former Administrative Appeals Tribunal (AAT).

Under Sections 52–54 of the Administrative Review Tribunal Act 2024 (Cth) (ART Act), the ART is not bound by the rules of evidence, controls the scope of the review and may exercise the powers and discretions of ASIC as the original decision-maker. This means the ART can take a fresh look at all the facts, law, and policy related to your AFSL application. It is not limited to the information you originally provided to ASIC and you can present new evidence to support your case.

To initiate a review, you must follow a strict process:

Time limit: Under Section 18 of the ART Act (Cth) and Rule 5 of the Administrative Review Tribunal Rules 2024 (Cth) (ART Rules), the ordinary period is 28 days after the applicant is given written notice of the decision or, where reasons are later given, 28 days after the reasons are given. Under Section 19, the ART may extend that period where it considers an extension reasonable in all the circumstances.
Application: The application must be made in writing, and a standard fee of $1,195 is payable, though a reduced fee of $100 may apply in specified concessional circumstances.
Process: The ART process may involve preliminary conferences and conciliation before proceeding to a formal hearing.

The ART has the power to take several actions, as follows:

affirm ASIC’s refusal;
vary the decision;
set aside the refusal and substitute another decision;
set the decision aside and send it back to ASIC with directions; or
grant the AFSL itself.

Ultimately, this process can be lengthy, often taking between six and 12 months, and may require legal representation.

Pursuing Judicial Review or an Appeal on a Question of Law

A judicial review is a different process from a merits review at the ART. It does not involve a re-examination of the facts of your AFSL application. Instead, it is a legal challenge to the way the decision was made and on any question of law involved in the matter, conducted in the Federal Court of Australia. As a result, you can seek a judicial review of a decision made by either ASIC or the ART.

This type of review is typically pursued under the Administrative Decisions (Judicial Review) Act 1977 (Cth) (ADJR Act). Under Section 5 of this Act, an applicant may challenge an ASIC decision on grounds including:

denial of procedural fairness;
failure to follow legally required procedures;error of law;
taking an irrelevant consideration into account;
failing to consider a relevant consideration;
improper exercise of power; or
a decision otherwise contrary to law.

Importantly, the Federal Court cannot grant you an AFSL. If your judicial review is successful, the court can only set aside the flawed decision and send it back to the original decision-maker (either ASIC or the ART) to be reconsidered according to the law.

Pursuing a judicial review is generally more technical, expensive, and time-consuming than a merits review. Under Section 11 of the ADJR Act (Cth), an application is ordinarily filed within 28 days after notification of the decision or receipt of reasons, whichever occurs later. The Federal Court may extend time under Rule 31.02 of the Federal Court Rules 2011 (Cth).

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Fixing Deficiencies & Reapplying for an AFSL

Strengthening Responsible Manager Profiles & Competence

An AFSL application may be refused if the nominated responsible managers do not provide sufficient evidence that the applicant will maintain organisational competence under Section 912A(1)(e) of the Corporations Act 2001 (Cth). If your initial application was unsuccessful due to such issues, you must address these deficiencies before reapplying.

To strengthen your application, ensure your responsible managers meet the standards set out in ASIC’s RG 105. This involves demonstrating that each responsible manager:

Has direct responsibility for significant day-to-day decisions;
Satisfies the fit and proper person test under Section 913BA of the Corporations Act 2001 (Cth);
Meets one of the five options for demonstrating knowledge and skills; and
Collectively with the other responsible managers covers every financial service and product authorisation sought.

A common reason for refusal is a mismatch in experience, where a responsible manager’s background does not align with the specific financial services or product authorisations sought in the AFSL application. Where there are material coverage gaps, the applicant may need to appoint an additional responsible manager, narrow the authorisations sought or provide further evidence demonstrating relevant knowledge and practical experience.

Bolstering Financial Resources & Compliance Documentation

Failing to demonstrate adequate financial resources or a robust compliance framework is another frequent cause of an AFSL application refusal.

When reapplying, you must provide clear evidence that you meet the resource requirements of Section 912A(1)(d), the risk-management obligation in Section 912A(1)(h) and ASIC’s predictive assessment under Section 913B(1)(b) of the Corporations Act 2001 (Cth). Depending on the applicant, this may require financial statements, cash-needs calculations, projections, audit material, solvency and positive-net-asset evidence, or additional requirements applying to a specific class of licensee. The required projection period and calculation method is dependent on the applicable RG 166 requirement or proposed licence condition.

ASIC also requires a tailored compliance framework that is specific to your business, rather than being based on generic templates. Your reapplication should include detailed, practical documentation showing how your business will meet its general obligations, including:

Your business’s risk management systems.
Procedures for managing conflicts of interest.
Internal and external dispute resolution processes, including membership with AFCA.
Arrangements for supervising and training representatives.
Specific compensation and insurance arrangements, such as professional indemnity insurance.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Alternative Licensing Pathways

Operating as a Corporate Authorised Representative

If obtaining your own AFSL is not immediately feasible after a refusal, you can operate legally by becoming a Corporate Authorised Representative (CAR). Under Section 916A(1) of the Corporations Act 2001 (Cth), the licensee must give the representative written notice authorising you to provide specified financial services on the licensee’s behalf. This arrangement allows you to begin or continue operating your financial services business without holding your own licence.

The principal AFS licensee retains ultimate legal responsibility for the financial services provided under its licence. This means they are responsible for the regulatory infrastructure, including:

Governance arrangements;
Compliance oversight and monitoring;
Supervision of representatives; and
Professional indemnity insurance.

Because the licensee assumes the regulatory risk for your activities, they will conduct rigorous due diligence on your business and personnel. In exchange for this hosting arrangement, you will typically pay a fee or a share of your revenue. This pathway is often suitable for start-ups, single-adviser practices, and firms that only require a narrow suite of authorisations. Furthermore, operating as a CAR allows you to build a successful operational track record, which can strengthen a future AFSL application.

Limiting Activities to Unlicensed Exemptions

Another alternative is to restructure your business model to focus only on activities that do not require an AFSL. This can be a temporary strategy to allow your business to operate while you strengthen your capabilities to reapply for a licence in the future. However, this approach requires a careful review of your proposed services to ensure they fall outside the regulatory regime.

Certain activities may not require a full AFSL, with examples including:

Acting solely as a referrer;
Providing advice on basic deposit products;
Distributing general insurance under a binder;
Offering services covered by a specific exemption in an ASIC instrument; or
Structuring advice limited to areas sitting entirely outside the definitions of financial product advice in Chapter 7 of the Corporations Act 2001 (Cth).

This pathway demands extreme caution. Therefore, it is important to obtain legal sign-off from a specialist compliance lawyer to ensure your restructured business model does not inadvertently provide unlicensed financial services.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

An AFSL application refusal by ASIC often stems from failing the fit and proper person test, lacking organisational competence, or having insufficient financial resources. Successfully navigating this setback involves understanding the entire process, from administrative hearings and appeals to strengthening your application or exploring alternative licensing pathways.

Navigating these regulatory challenges requires specialised legal support to ensure your next steps are effective. Our experts provide clear, fixed-fee guidance on financial services regulation and can help you manage the review process, so contact our AFSL application lawyers at Click Legal today to prepare a successful reapplication.

Frequently Asked Questions

How long do I have to request a written statement of reasons from ASIC?

You must write to the decision-maker to request a written statement of reasons within 28 days of being notified of the refusal decision. This formal document is essential for understanding the specific grounds for the refusal, which will inform any appeal or reapplication.

What is the deadline to apply for a review at the Administrative Review Tribunal?

You generally have a limit of 28 days to lodge an application with the ART. This period starts the day after you receive either the formal refusal decision or the written statement of reasons from ASIC. ART may extend this deadline where an extension is reasonable in all the circumstances.

Can I operate my financial services business while my appeal is pending?

Lodging an ART application does not grant an AFSL. You must stop any regulated activity that requires an AFSL. You may be able to continue operating legally by becoming a CAR of an existing licensee or by limiting your activities to those that fall under unlicensed exemptions.

Will a withdrawn application appear on my permanent regulatory record?

Voluntarily withdrawing your application before a formal refusal is issued prevents a permanent “refused licence” mark on your regulatory record. This is beneficial, as future applications will ask if you have ever had a licence refused.

What happens if I fail to respond to an ASIC information request on time?

If you do not provide the requested information within the specified timeframe, your application is deemed to be withdrawn under Section 913B(4B) of the Corporations Act 2001 (Cth).

How much does it cost to apply for an Administrative Review Tribunal review?

The standard application fee for a review at the ART is $1,195. A reduced fee of $100 may apply in specified concessional circumstances.

Can I use template compliance policies when reapplying for my licence?

The Corporations Act 2001 (Cth) does not prohibit the use of templates. But relying on generic, off-the-shelf compliance templates that do not reflect the applicant’s actual services, products, risks, personnel, and controls may be given little weight. Your compliance manuals and procedures should be tailored specifically to your actual business model and operations.

Does ASIC conduct a hearing before formally refusing an application?

Yes, under subsection 913B(5) of the Corporations Act 2001 (Cth), ASIC cannot formally refuse an application without first giving you a notice of intention to refuse. This notice provides you with the opportunity to appear at a private hearing or make written submissions to an ASIC delegate.

What role does the Commonwealth Ombudsman play in the refusal process?

If you believe the decision-making process was mishandled or unfair, you can complain to the Commonwealth Ombudsman. While the Ombudsman cannot overturn the refusal, they can investigate claims of maladministration and recommend actions such as apologies or process reconsiderations.

Top 5 AFSL Application Mistakes & How to Avoid Delays

Hannah Deuk — Sun, 12 Jul 2026 02:54:23 +0000

Introduction

Obtaining an Australian financial services licence (AFSL) is a major step for businesses operating in the financial services industry in New South Wales and across the country. Following process change that took effect on 16 June 2025, applicants must use a new digital ASIC Regulatory Portal to demonstrate their organisational competence and meet strict compliance obligations under the Corporations Act 2001 (Cth).

Because the licence application process is highly complex, easily avoidable errors can lead to delays, requests for further information, a modified or conditional licence outcome, withdrawal, or refusal, which is why many businesses seek advice from AFSL application lawyers. This article explains the top mistakes in the AFSL application process for financial services businesses so you can secure timely approval.

Interactive Tool: Check Your Risk of AFSL Application Delay & Refusal

AFSL Application Risk Checker

Avoid critical mistakes in your AFSL application—quickly check your risk of delay or refusal.

Have you prepared and uploaded all required People Proofs for every director and Responsible Manager?

Do your nominated Responsible Managers have recent, specialised experience covering all financial products/services in your application?

Are your compliance documents and policies tailored to your actual business model and authorisations?

✅ Low Risk of AFSL Application Delay

Your application preparation aligns with ASIC requirements. You have addressed the main compliance risks under Section 913A of the Corporations Act 2001 (Cth), Section 913B of the Corporations Act 2001 (Cth), Section 913BA of the Corporations Act 2001 (Cth), and Section 912A of the Corporations Act 2001 (Cth), and your Responsible Managers meet the standards set out in RG 105. Ensure you maintain this standard and respond promptly to any ASIC requests.

Section 913A of the Corporations Act 2001 (Cth)
Section 913B of the Corporations Act 2001 (Cth)
Section 913BA of the Corporations Act 2001 (Cth)
Section 912A of the Corporations Act 2001 (Cth)

Book an AFSL Application Review

⚠️ Moderate Risk: Application May Be Delayed

There are some gaps in your AFSL application preparation. ASIC may request further information or clarification, especially regarding Responsible Manager experience or tailored compliance documentation. Address these issues before submitting to avoid delays under Section 913B of the Corporations Act 2001 (Cth).

Section 913B of the Corporations Act 2001 (Cth)
RG 105 (ASIC Regulatory Guide 105)

Speak to an AFSL Application Lawyer

❌ High Risk: Application Likely to Be Refused or Withdrawn

Your AFSL application is missing critical elements. ASIC is likely to refuse or deem your application withdrawn under Section 913B of the Corporations Act 2001 (Cth) and Section 913BA of the Corporations Act 2001 (Cth). In Global Financial Markets Pty Ltd and Australian Securities and Investments Commission [2017] AATA 1397, the AAT upheld ASIC’s refusal due to unsuitable Responsible Manager nomination. Immediate legal advice is strongly recommended.

Section 913B of the Corporations Act 2001 (Cth)
Section 913BA of the Corporations Act 2001 (Cth)
Global Financial Markets Pty Ltd and Australian Securities and Investments Commission [2017] AATA 1397

Get Urgent AFSL Application Help

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Mistake 1: Incomplete Applications & Missing People Proofs

The Impact of Unanswered Fields & Missing Documents

Submitting an incomplete application can delay assessment or prevent the Australian Securities and Investments Commission (ASIC) from granting an AFSL. Sections 913A and 913B of the Corporations Act 2001 (Cth) state that an application must be filed in the prescribed format and with all necessary information and documents, and should not contain anything that is materially false or misleading or omits an important matter. If the applicant does not comply with this, ASIC must refuse the application.

Administrative error most frequently involves the failure to provide a complete set of “People Proofs” for all fit-and-proper persons, such as directors and any nominated responsible manager. This leads to non-compliance with Section 913BA of the Corporations Act 2001 (Cth).

As per ASIC’s Regulatory Guide (RG) 1, required documents typically include:

A complete Statement of Personal Information for each relevant person.
A national criminal history check that is less than 12 months old.
A current bankruptcy check.
Copies of all relevant qualification certificates and transcripts.

These documents are essential for ASIC to assess the character and competence of the individuals who will oversee the financial services business.

How to Use the ASIC Regulatory Portal Checklist Effectively

To prevent these administrative errors, applicants should strictly follow the checklist provided within the ASIC Regulatory Portal. The updated digital application process requires all supporting documents to be uploaded directly. ASIC no longer describes documents as “core” and “non-core” proofs; it refers to People Proofs and application-specific supporting information.

As a best practice, it is important to label every uploaded document distinctly and cross-reference it correctly within the application. For example, a file named “JSmith_Criminal_History_Check_May2026.pdf” is much more effective than a generic “scan_123.pdf”. Clear labelling allows the ASIC analyst to easily match each proof to the relevant section of your submission, streamlining their review.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Mistake 2: Nominating Unsuitable Responsible Managers

Understanding Organisational Competence & RG 105 Requirements

A primary reason for delays in the AFSL application process is failing the organisational competence test. Section 912A(1)(e) of the Corporations Act 2001 (Cth) requires a licensee to maintain the competence to provide the financial services covered by its licence. ASIC must not grant an AFSL if it has reason to believe that the applicant is likely to contravene that obligation, as stated in Section 913B(1)(b). Further, RG 105 explains how ASIC generally assesses that statutory requirement, including through the knowledge, skills, and experience of nominated Responsible Managers.

A critical error is nominating an RM with a strong general background but without specialised experience in the specific financial products or services your licence will cover. While there is no statutory rule that each Responsible Manager must personally cover every authorisation, however, RG 105.39–RG 105.48 expects the nominated Responsible Managers’ combined knowledge and skills to cover all proposed financial services and products. ASIC is likely to reject a nomination if there is a mismatch between the RM’s expertise and the authorisations sought.

Common competence gaps that may stall your application include:

Experience Mismatches: Appointing an RM with decades of general banking experience for a licence that involves complex derivatives or managed investment schemes.
Coverage Gaps: The combined experience of your RMs does not extend to all financial products and services listed in your application.
Outdated Knowledge: An RM’s experience is not recent, with ASIC typically looking for three to five years of relevant experience for appointment Options 1 to 4. Option 5 is flexible and does not prescribe a minimum period, but comes with its own set of requirements.
Unrecognised Qualifications: RG 105.87–RG 105.93 allows ASIC to recognise comparable overseas qualifications, but applicants must demonstrate their relevance to the Responsible Manager’s proposed role and Australian licensing context.

The risks of nominating an unsuitable Responsible Manager are demonstrated in Global Financial Markets Pty Ltd and Australian Securities and Investments Commission [2017] AATA 1397. In Global Financial Markets, the Administrative Appeals Tribunal (AAT) upheld ASIC’s decision to refuse an AFSL application because the nominated RM could not demonstrate the specialised knowledge and skills required under RG 105 for the specific products sought. This case confirms that general financial experience is insufficient if it does not directly align with the licence authorisations.

Ensuring Direct Involvement in Day-to-Day Decisions

RG 105.22–RG 105.27 states that a nominated RM should have direct responsibility for significant day-to-day decisions about the ongoing provision of financial services. RG 105.28–RG 105.35 recognises a limited exception for some RM in small-scale, heavily automated businesses. Nominating a “trophy” Responsible Manager who is a consultant or well-known name but has no genuine operational role may therefore undermine the application.

In addition to possessing the right skills, each nominated RM must pass the “fit and proper” person test. ASIC must be satisfied that there is no reason to believe the applicant, relevant officers, partners, trustees, senior managers and controllers are not fit and proper for the purposes specified in Section 913BA(1) of the Corporations Act 2001 (Cth).

ASIC considers several statutory matters under Section 913BB(2) of the Corporations Act 2001 (Cth), including whether a relevant person has:

had an AFSL or Australian credit licence suspended or cancelled;
been subject to a banning order, disqualification order or corporate-management disqualification;
been linked to a refusal or failure to give effect to an AFCA determination;
been insolvent under administration or otherwise subject to insolvency matters;
been convicted of an offence within the previous 10 years; or
any other matter ASIC may consider relevant.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Mistake 3: Relying on Generic Compliance Documentation

The Danger of Off-the-Shelf Policy Templates

Submitting generic, off-the-shelf compliance documentation and policies that are not tailored to your specific business is a critical error that signals a lack of operational readiness. Furthermore, these theoretical frameworks often fail to align with the proposed business model or the authorisations being sought.

RG 1.188–RG 1.192 explains that ASIC may assess an applicant’s systems, compliance arrangements, representative supervision, financial resources, dispute-resolution arrangements and risk-management procedures. A polished but generic policy suite that does not reflect the proposed business may therefore provide weak evidence of operational readiness. Therefore, templates should be tailored and implemented, rather than treated as a substitute for actual systems and governance.

Demonstrating Operational Readiness & Governance Structures

Your AFSL application must include a compliance framework that reflects your actual business processes. Every policy, from risk management to dispute resolution, should be customised to your products, distribution channels, and operational structure. This demonstrates to ASIC that compliance is an integral part of your business from the outset, rather than a task to be addressed after the licence is granted.

To prove your systems are ready for operation, you must provide concrete evidence beyond policy documents as best practice, including:

Practical Tools: Furnish examples of compliance registers, incident logs, and breach reporting workflows that you will use.
Governance Evidence: Include meeting minutes from compliance or risk committees and clear diagrams of reporting lines.
Procedural Outlines: Detail your processes for internal controls, customer dispute resolution, and ongoing staff training.
Supervision Plans: Show how you will monitor representatives, review the quality of advice, and manage conflicts of interest.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Mistake 4: Providing a Vague Description of Financial Services

Distinguishing Between Retail & Wholesale Clients

Your AFSL application must be precise about the clients you intend to serve. A common error is submitting a business description that is ambiguous about whether you will provide services to:

retail clients;
wholesale clients; or
both.

Client classification is determined by Corporations Act 2001 (Cth), Section 761G and, where relevant, Section 761GA. The lack of clarity in this matter signals to ASIC that you may not fully understand your regulatory obligations.

The compliance requirements for servicing retail clients are significantly more extensive than for wholesale clients. For example, licensees dealing with retail clients must have appropriate dispute resolution systems, including membership with the Australian Financial Complaints Authority (AFCA). Failing to clearly define your client base can cause ASIC to question your readiness to meet the specific obligations attached to each client type.

Accurately Categorising Products Under the Corporations Act

It is critical to explicitly define each financial service and product your business will offer. Your AFSL application must demonstrate a firm understanding of how your products are legally categorised under Sections 761A, 763A, 764A and 766A of the Corporations Act 2001 (Cth). A misunderstanding in this area can undermine ASIC’s confidence in your organisational competence.

Some financial products can be complex to classify, for instance, a warrant fall within the securities, derivatives or miscellaneous financial facility authorisation categories.

Each category may require different authorisation selections and different supporting evidence. The practical implication of this is that the application, business description, website, and pitch materials should consistently describe the actual products and services proposed.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Mistake 5: Inadequate Demonstration of Financial Resources

Navigating the Requirements Stage for Financial Statements

The recent portal updates also altered when financial statements must be provided. Previously submitted upfront as “core proofs”, these documents are now requested later during what is typically called the “requirements stage”.

This change has created a common and critical misunderstanding, as some applicants mistakenly believe that proof of financial resources is no longer a primary concern for their initial submission. However, the fact is that ASIC may request additional information, an audit report or a statement of material changes by written notice under Section 913B(3) of the Corporations Act 2001 (Cth).

If the applicant does not comply with such a notice by the specified deadline, the application is taken to have been withdrawn. A requirements letter may be issued after ASIC makes an in-principle licence offer, but ASIC may also seek supporting information earlier in its assessment. Therefore, being unprepared to provide them immediately may cause significant delays and can jeopardise the entire application.

Proving Solvency & Documenting Resource Management Policies

Section 912A(1)(d) of the Corporations Act 2001 (Cth) requires a licensee to have available adequate financial, technological and human resources to provide the financial services covered by its licence and supervise its representatives. The exact financial evidence required will depend on the business model, authorisations and applicable financial requirements.

As a best practice, before lodging your application, you should prepare financial assumptions, cash-flow forecasts and resource-management documentation that are appropriate to the proposed business. This may include:

a balance sheet;
a profit and loss statement; and
detailed cash flow projections, etc.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

Avoiding common mistakes such as submitting incomplete applications, nominating unsuitable responsible managers, and relying on generic compliance frameworks is essential for a successful AFSL application. Meticulous preparation, tailored documentation, and a clear demonstration of financial resources are critical to prevent delays and secure timely approval from ASIC.

Navigating the complexities of the AFSL application process requires proactive risk management and specialised legal support. To ensure your submission meets ASIC’s stringent requirements and avoids costly errors, contact our AFSL application lawyers at Click Legal for guidance on your application.

Frequently Asked Questions

What are People Proofs in an AFSL application?

People Proofs are mandatory documents ASIC requires to assess the fitness and propriety of key people, such as directors and RMs. These documents include a Statement of Personal Information, a national criminal history check that is less than 12 months old, a bankruptcy check, and copies of relevant qualifications. Submitting an incomplete set of People Proofs is a primary reason that applications are immediately rejected for lodgement.

How long does the AFSL application process take?

ASIC’s service charter aims to decide 70% of complete applications within 150 days and 90% within 240 days. However, these are ASIC service targets, not statutory decision deadlines or guarantees. The duration depends on the quality and complexity of the application, the proposed business, and how promptly the applicant responds to ASIC requests.

Can I use template compliance policies for my AFSL application?

Yes, but not without proper tailoring and implementation. There is no statutory ban on template policies. The relevant question is whether ASIC has reason to believe the applicant is likely to contravene its licence obligations. ASIC may assess whether the applicant has appropriate systems and processes for its actual business.

Are financial statements required upfront in the new digital portal?

No, financial statements are no longer required when you first submit your application through the ASIC Regulatory Portal. This change took effect on 16 June 2025. ASIC now typically requests these documents at the “requirements stage” later in the assessment process, usually when it is considering offering you a draft licence.

What happens if I miss the deadline to respond to an ASIC requisition?

If you fail to respond to a request for information within the timeframe specified in ASIC’s written notice, which is often 10 business days, your application may be deemed withdrawn by law. That said, ASIC may extend the deadline before it expires under Section 913B(4A) of the Corporations Act 2001 (Cth).

Do I need a separate financial services licence to operate in NSW?

No, a separate licence is not required to operate in New South Wales. The AFSL requirement is a Commonwealth licensing regime under Section 911A of the Corporations Act 2001 (Cth). The requirements and application process are the same across all Australian states and territories, with no state-specific variations.

What is the organisational competence test for Responsible Managers?

The organisational competence test is how ASIC assesses whether your business has the necessary expertise to provide the financial services you are applying for. As detailed in RG 105, ASIC reviews the collective knowledge, skills, and experience of your nominated RMs. The regulator must be satisfied that their combined expertise covers every single authorisation sought in your licence application.

Can I nominate a Responsible Manager who only acts as a consultant?

No, you cannot nominate a Responsible Manager who is not genuinely involved in the business. ASIC requires that all RMs be directly involved in the significant day-to-day decisions and oversight of the financial services provided under the licence. Nominating a “trophy” manager who is not part of the business’s operations is a major red flag that will lead to their rejection.

The AFSL Application Process & Timeline: A Guide for Australian Businesses

Hannah Deuk — Sun, 12 Jul 2026 02:45:50 +0000

Introduction

Founders are often told that getting an Australian Financial Services Licence (AFSL) takes a few months, but actual processing times are much longer for complex business models. In the 2026 regulatory environment, the Australian Securities and Investments Commission (ASIC) acts as a strict gatekeeper rather than a simple processor. The application does not start when you decide to apply for an AFSL; it only begins when your licence application and supporting documents are complete enough for ASIC to assess.

For successfully building a financial services business in Australia, understanding this timeline makes all the difference. If your submission is missing a single mandatory proof, ASIC may refuse to receive the application for lodgement, or may require the application to be amended, completed, replaced or supplemented. This article explains the end-to-end AFS licence application process for financial services businesses so you can meet your compliance requirements effectively.

Interactive Tool: Estimate Your AFSL Application Timeline & Risk of Rejection

AFSL Application Timeline Checker

Quickly estimate your AFSL application timeline and identify key compliance risks before you lodge.

What type of clients will your financial services business serve?

Does your business model involve digital assets, crypto, or managed investment schemes?

Are all your Responsible Manager (RM) ‘People Proofs’ and compliance documents up to date and tailored to your business?

✅ Ready for Lodgement: Fastest Timeline

Your business model and documentation are well-prepared.

ASIC typically assesses wholesale-only, standard financial services applications with complete, tailored documentation in 6–8 months.

Be sure to maintain up-to-date ‘People Proofs’ (no older than 12 months) and ensure all compliance documents are specific to your business.

Under Section 913A and Section 913B(3) of the Corporations Act 2001 (Cth), ASIC may still request further information, but your risk of delay is minimal.

Section 913A of the Corporations Act 2001 (Cth)
Section 913B(3) of the Corporations Act 2001 (Cth)

Start Your AFSL Application with a Lawyer

⚠️ Moderate Delay Likely: Extra ASIC Scrutiny

Because you serve retail clients or operate a complex business model (digital assets, crypto, or managed funds), ASIC will apply additional scrutiny.

Expect your AFSL application to take 9–14 months.

Ensure you have robust dispute resolution systems (including AFCA membership) and PI insurance that meets Section 912B of the Corporations Act 2001 (Cth) and ASIC RG 126.

Applications involving digital assets must comply with the Corporations Amendment (Digital Assets Framework) Act 2026 (Cth) from 9 April 2027.

Section 912A(1)(g) and Section 912A(2) of the Corporations Act 2001 (Cth)
Section 912B of the Corporations Act 2001 (Cth)
Corporations Amendment (Digital Assets Framework) Act 2026 (Cth)

Book an AFSL Strategy Session

❌ High Risk: Application Rejection Likely

ASIC is likely to refuse to accept your application for lodgement due to missing or outdated ‘People Proofs’ or generic compliance documents.

This triggers the ‘Portal Incomplete Trigger’ under Section 1274(8) of the Corporations Act 2001 (Cth), causing a complete timeline reset and loss of your application fee.

All supporting documents must be current (less than 12 months old) and tailored to your business, as required by ASIC RG 1.149 and RG 1.

Section 1274(8) of the Corporations Act 2001 (Cth)
ASIC RG 1.149 and RG 1

Get a Compliance Review Before You Lodge

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

The 5 Phases of the AFSL Application Process

Phase 1: Pre-Application Preparation

This initial phase represents the hidden timeline in the AFSL application process and typically requires one to three months of focused work before you even access the ASIC Regulatory Portal. During this stage, you must establish the foundational elements of your financial services business to demonstrate your readiness to operate.

Key activities during this preparatory phase include:

Establishing the applicant structure: This involves confirming the legal person or entity that will apply for the AFS licence. Under ASIC Regulatory Guide (RG) 1, licence applications may be made by a natural person, body corporate, partnership, or multiple trustee entity. Companies will usually be required to obtain an Australian Company Number (ACN). An Australian Business Number (ABN) may also be relevant depending on the applicant structure and business setup.
Appointing Responsible Managers (RMs): You must nominate individuals who have the necessary knowledge and skills to oversee your financial services. ASIC assesses responsible managers as part of its organisational competence assessment under Sections 912A(1)(e) and 913B(1)(b) of the Corporations Act 2001 (Cth), using its RG 105 and RG 1. This is often the most significant hurdle.
Gathering People Proofs: You will need to assemble all required “People Proofs” for specified fit and proper persons and responsible managers. These include national criminal history checks, overseas criminal history checks where required, bankruptcy checks and Statements of Personal Information. RG 1.149 provides that those People Proofs must be no more than 12 months old.
Developing your compliance framework: This involves drafting your core governance and risk management procedures. ASIC assesses whether the applicant is likely to comply with its AFS licensee obligations if licensed, including the obligations in Section 912A of the Corporations Act 2001 (Cth), as relevant to the proposed business.

Phase 2: Application Lodgement & the ASIC Portal

Once your preparation is complete, you can proceed to lodge your AFSL application, a process that takes between one and four weeks. Section 913A of the Corporations Act 2001 (Cth) mandates that an application for an AFS licence must be lodged with ASIC in the prescribed form and accompanied by the prescribed information and documents.

Further, as explained in ASIC INFO 294, from 16 June 2025 all new applications must be submitted through the ASIC Regulatory Portal, which replaced the legacy eLicensing system and Form FS01. This online system requires you to upload all supporting documents and pay the application fee at the time of submission.

After you lodge, an ASIC analyst conducts an initial completeness check. This is a critical step, as ASIC’s official assessment clock only starts once your application is deemed complete and formally accepted for lodgement. Submitting an incomplete application can trigger the Portal Incomplete Trigger. If this happens, ASIC may refuse to receive the application for lodgement under Section 1274(8) of the Corporations Act 2001 (Cth), or may require the application to be amended, completed, replaced or supplemented before it proceeds.

Phase 3: ASIC Formal Assessment & The RFI Loop

The formal assessment is the longest part of the AFSL application process, typically lasting between four and eight months. During this phase, ASIC acts as a gatekeeper, conducting a thorough review of your proposed financial services business, your compliance, and risk management frameworks, and the organisational competence demonstrated by your RMs.

ASIC’s Service Charter aims to decide on the following:

70% of complete applications within 150 days; and
90% of complete applications within 240 days.

These are ASIC Service Charter targets, not statutory decision deadlines. Applications may take longer if they raise complex or new policy issues, or if the applicant does not give ASIC all the information it needs.

A significant part of this stage is the “RFI loop,” where ASIC issues Requests for Further Information (RFIs) to clarify aspects of your application. Under Section 913B(3) of the Corporations Act 2001 (Cth), ASIC may require further information, require an audit report, or require confirmation of whether there has been a material change in information already given. Section 913B(4B) specifies that if the applicant does not comply with a requirement within the period specified by ASIC, the application is taken to have been withdrawn. The speed and quality of your responses directly impact the overall timeline, as delays or incomplete answers can extend the assessment period considerably.

Phase 4: Draft Licence Requirements & Final Grant

If ASIC is satisfied with its assessment, it usually issues a requirements letter and draft AFS licence as part of ASIC’s administrative assessment process. This stage typically lasts two to six weeks. The draft licence outlines the specific authorisations and conditions that ASIC proposes to grant.

Before the final licence is issued, you must satisfy the outstanding conditions outlined in the requirements letter, which commonly include the following:

providing a certificate of currency for your professional indemnity (PI) insurance that meets the requirements of Section 912B of the Corporations Act 2001 (Cth), Reg 7.6.02AAA of the Corporations Regulations 2001 (Cth), and ASIC’s RG 126;
confirming your membership with the Australian Financial Complaints Authority (AFCA), which is mandatory if you intend to provide financial services to retail clients because Section 912A of the Corporations Act 2001 (Cth) requires a compliant dispute resolution system for retail-client financial services; and
submitting updated financial statements to demonstrate that your business has adequate financial resources where ASIC requests that information under Section 913B(3) of the Corporations Act 2001 (Cth), or as part of the requirements stage described in ASIC INFO 294.

Phase 5: Post-Licence Requirements & Commencing Operations

Receiving your final AFSL is a major milestone, but it is not the end of your obligations. As a new AFS licensee, you must comply with several immediate post-approval requirements to maintain your licence and commence operations lawfully.

Your key obligations include:

Appoint an auditor: Under Section 990B(1) of the Corporations Act 2001 (Cth), an AFS licensee to which the provision applies must appoint an auditor within one month after beginning to hold the licence. This requirement does not apply to public companies, as mentioned in Section 990A; and modified reporting arrangements may apply to limited AFS licensees under the Corporations Regulations 2001 (Cth).
Commence financial services: You are required to begin providing a financial service covered by your licence within six months of the grant date. Under Section 915B of the Corporations Act 2001 (Cth), ASIC has the power to cancel a licence if the licensee fails to commence its financial services business within this timeframe.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Critical Regulatory Deadlines for Australian Businesses

The June 2025 Regulatory Portal Transition

A significant change to the AFSL application process occurred with the mandatory transition to the ASIC Regulatory Portal. As noted earlier, the legacy eLicensing system and Form FS01 have been replaced for new applications made from 16 June 2025.

All transactions related to an AFS licence must now be completed through the ASIC Regulatory Portal, including:

New AFSL applications;
Applications to vary or cancel an existing licence; and
Notifications of changes to licensee details.

ASIC INFO 294 confirms that applications already submitted through eLicensing and accepted for lodgement do not need to be re-registered or updated in the ASIC Regulatory Portal. It also confirms that ASIC no longer refers to core and non-core proofs, and instead requires People Proofs through the current application process.

The September 2026 Digital Asset Application Deadline

Providers of certain digital asset financial products must be aware of an important ASIC no-action deadline. ASIC’s sector-wide no-action position, detailed in INFO 225 and its updated no-action materials, is set to expire on 30 September 2026.

This deadline affects businesses that provide financial services related to digital assets, including:

Tokenised custody platforms;
Stablecoin issuers; and
Other providers of digital asset financial products.

It is important to note that this is ASIC policy, not legislation. ASIC’s no-action position does not itself make otherwise unlicensed conduct lawful, determine whether a product is a financial product, or bind courts or other enforcement bodies. It indicates the circumstances in which ASIC does not intend to take enforcement action for certain contraventions of the Corporations Act 2001 (Cth), subject to the conditions and limitations of the no-action letter.

To reduce enforcement risk and continue operating within the scope of ASIC’s stated no-action position, these businesses should ensure they satisfy the applicable conditions, including lodging any required AFS licence application or variation with ASIC through the regulatory portal by the 30 September 2026 cut-off.

The April 2027 Digital Assets Framework Act Commencement

The regulatory landscape for digital assets will undergo further changes with the commencement of new legislation. The Corporations Amendment (Digital Assets Framework) Act 2026 (Cth) is scheduled to take full effect on 9 April 2027.

This legislation will formally integrate Digital Asset Platforms (DAPs) into the existing financial services licensing regime. As a result, these platforms will be fully under ASIC’s supervision, requiring them to hold an AFS licence and comply with all associated obligations to provide financial services in Australia.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

How Business Models Impact the AFSL Application Timeline

Retail vs. Wholesale: Impact on Application Timelines

The type of client your financial services business serves is a primary factor in determining the length of your AFS licence application timeline. Applications that include authorisations to provide financial services to retail clients consistently may take longer to process than those limited to wholesale clients. This is because serving retail clients triggers additional consumer protection obligations under the Corporations Act 2001 (Cth).

Consequently, ASIC applies greater scrutiny to retail-facing businesses to ensure these protections are met. Key additional requirements that extend the assessment period include:

Dispute resolution systems: Under Section 912A(1)(g) and Section 912A(2) of the Corporations Act 2001 (Cth), licensees serving retail clients must have a comprehensive dispute resolution system. This involves establishing internal dispute resolution procedures and securing membership with AFCA.
Compensation arrangements: Section 912B of the Corporations Act 2001 (Cth) mandates that licensees have adequate arrangements to compensate retail clients for losses or damage suffered because of specified Chapter 7 breaches. This obligation is typically met by obtaining and maintaining PI insurance that meets ASIC’s standards, adding another layer of verification to the application process.

Assessing Fintech, Crypto & Managed Funds Timelines

Complex or novel business models, particularly in the fintech, crypto, and managed funds sectors, face a more intensive and lengthy assessment from ASIC. The regulator uses a risk-based approach, dedicating more resources to high-risk or intricate applications to ensure they meet all statutory requirements before a licence is granted.

For businesses operating managed investment schemes, the AFSL application process involves seeking specific authorisations to operate a registered scheme. ASIC assesses your organisational competence to manage particular asset classes, which can range from financial assets and derivatives to direct real property and cryptoassets. This detailed evaluation of your capacity to handle scheme assets adds significant time to the review.

Furthermore, applications related to fintech and digital assets, such as crypto, are subject to particularly deep scrutiny. ASIC has noted a substantial increase in licence applications from the digital asset sector. As outlined in INFO 225, the financial product definitions in current law are broad and technology-neutral. Whether a particular digital asset, platform, or service requires an AFSL depends on the legal obligations attached to the product, and the conduct involved.

The novelty and complexity of these products require ASIC to conduct a more thorough analysis, which often extends the application timeline by several months. This analysis focuses on areas including the following:

The underlying business model;
Internal risk management systems; and
Overall compliance frameworks.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Navigating the Portal Incomplete Trigger

Understanding ASIC as a Gatekeeper

In the current regulatory environment, ASIC functions as a strict gatekeeper for the financial services industry, not merely a processor of paperwork. It uses a risk-based assessment approach, focusing its resources on high-quality, complete AFSL applications. As a result, businesses must demonstrate they are ready to meet their compliance obligations from day one.

This gatekeeper role means ASIC has shifted its approach to handling submissions. ASIC may refuse to receive a document for lodgement under Section 1274(8) of the Corporations Act 2001 (Cth) where, for example, the document has not been duly completed because of an omission or misdescription. It may also request further information under Section 913B(3) when assessing an application. The outcome depends on the deficiency and ASIC’s assessment. Ultimately, ASIC expects a financial services business to be fully prepared, with all its systems and processes in place before seeking a licence.

Avoiding the Portal Incomplete Trigger

As introduced earlier, the “Portal Incomplete Trigger” is the risk that an AFSL application is not accepted for lodgement or cannot progress efficiently due to incompleteness. Even if the ASIC Regulatory Portal allows you to submit, a human analyst conducts an initial completeness check. If a mandatory proof document is missing or incorrect, the application may be refused for lodgement or ASIC may require the document to be amended, completed, replaced or supplemented.

This outcome has significant consequences for any proposed financial services business, as follows:

Complete Timeline Reset: You are forced to restart the entire process, causing a multi-month delay to your business launch.
Significant Delays: The applicant is forced to restart the entire AFS licence application process from the beginning, losing months of progress.
Wasted Resources: The time and effort invested in preparing the initial submission are lost.

In addition, common triggers for the Portal Incomplete Trigger include:

missing “People Proofs” for a nominated RM;
submitting a criminal history check that is more than 12 months old; or
failing to provide a comprehensive business description.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Common AFSL Application Delays & How to Mitigate Them

Common Causes of Application Delays

Several common administrative errors can significantly extend the AFSL application timeline. A primary cause for delay is the submission of incomplete or incorrect “People Proofs” for a nominated RM. As established, these supporting documents—such as national criminal history and bankruptcy checks—must be no more than 12 months old at the time of lodgement where required by ASIC RG 1.149 and related RG 1 guidance.

Other frequent mistakes that can stall the AFSL application process include:

Gaps in RM coverage: ASIC assesses your organisational competence by reviewing the collective experience of your nominated RMs. If their skills and experience do not cover all the financial services and product authorisations you are applying for, ASIC will question your ability to operate compliantly.
Using generic compliance documentation: Submitting template policies and procedures that are not tailored to your specific financial services business is a common pitfall. ASIC expects your compliance and risk management frameworks to reflect how your business will actually operate.
Requesting overly broad authorisations: Applying for licence authorisations that do not align with your business model or the demonstrated experience of your RMs often leads to detailed questions from ASIC, prolonging the assessment.

Proactive Strategies for Mitigating Delays

Operations managers can adopt several proactive strategies to streamline the AFSL application process and avoid unnecessary friction. Ensuring all documentation is tailored to the specific operations of your financial services business is a critical first step. Furthermore, your business description, compliance arrangements, and risk management systems must present a clear and consistent picture of your proposed activities.

Responding promptly to any RFIs from ASIC within the period specified by ASIC under Section 913B(3) of the Corporations Act 2001 (Cth) is also essential. Ultimately, the speed and quality of your responses have a direct impact on the assessment timeline, as delays can add months to the process.

Engaging with specialists can help ensure your licence application is complete and lodgement-ready from the outset. Partnering with Click Legal provides a frictionless approach, helping your financial services business navigate the complexities of the ASIC Regulatory Portal and avoid common errors that could trigger rejection and the loss of your application fee.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

Securing an AFSL is a complex journey that extends far beyond the formal assessment, demanding months of upfront preparation to satisfy ASIC’s strict gatekeeper requirements. A successful AFSL application depends on understanding the end-to-end timeline, the impact of your business model, and how to avoid critical errors that can lead to rejection.

To navigate the AFSL application process with confidence, partner with our AFSL application lawyers at Click Legal for end-to-end support. Our frictionless, fixed-fee approach ensures your submission is complete and lodgement-ready, helping your financial services business avoid costly delays and launch successfully.

Frequently Asked Questions

How long does the AFSL application process take?

The end-to-end AFSL application process, including preparation and assessment, typically spans 6 to 14 months. While ASIC has service charter targets, the actual time depends on your business model’s complexity and the quality of your application.

Does the timeline differ between NSW & other Australian states?

No, the timeline is identical across Australia, including New South Wales. The AFSL is a federal licence administered by ASIC, so the application process and requirements are the same regardless of your state or territory.

What are the ASIC service charter targets for AFSL applications?

ASIC aims to decide 70% of complete applications within 150 days and 90% within 240 days. This assessment clock only begins once a complete and lodgement-ready application is submitted through the ASIC Regulatory Portal.

What is the portal incomplete trigger?

The portal incomplete trigger refers to the practical risk that an AFSL application may not be accepted for lodgement, or may not progress efficiently, if it is submitted with missing mandatory information or documents.

How does serving retail clients affect the application timeline?

Serving retail clients typically adds months to the application timeline. This is due to the extra scrutiny from ASIC and the mandatory requirements to have adequate PI insurance and membership with AFCA.

What are People Proofs & why are they important?

People Proofs are mandatory documents required by ASIC to assess the competence and character of your nominated RMs and other key individuals. These documents, which include items like national police checks, bankruptcy checks, qualifications, and statements of personal information, are essential for demonstrating your firm’s organisational competence.

How long do I have to respond to an ASIC requisition?

You are generally required to respond to a request for further information, also known as a requisition, from ASIC within the period specified by ASIC, which is typically ten days.

Can I operate my financial services business while my application is pending?

No, you cannot legally provide financial services that require a licence while your application is pending. The only exception is if you are operating as an Authorised Representative under another business that already holds a valid AFSL.

What happens if my application is rejected for lodgement?

If your application is rejected for lodgement because it is incomplete, it will not proceed to the assessment phase. ASIC may refuse to receive the lodgement and require the application to be amended, completed and resubmitted, replaced or supplemented.

Varying Your AFSL in NSW & Australia: A Guide to the New ASIC Portal

Hannah Deuk — Fri, 10 Jul 2026 04:26:32 +0000

Introduction

For fintech founders and compliance officers, expanding your operations may require a variation to the conditions of your Australian Financial Services Licence (AFSL). In May 2025, the Australian Securities and Investments Commission (ASIC) introduced a new Regulatory Portal, and by 16 June 2025, new AFSL variation and notification transactions were moved from eLicensing to this Regulatory Portal. Varying an AFSL is not just a clerical task; it is a strategic re-pitch to the regulator under the Corporations Act 2001 (Cth). Licensees must clearly demonstrate they maintain the organisational competence and compliance arrangements to support any new financial product or service.

This article explains the AFSL variation application process for Australian businesses and distinguishes an authorisation or licence-condition variation from a prescribed change notification. It covers how to use the digital workflow, the difference between a full variation and a notification, and the separate obligations that may apply where a responsible manager named in a key person condition ceases their role.

Interactive Tool: See If You Need an AFSL Variation & Notification

AFSL Variation or Notification Checker

Quickly determine if your business change requires a full AFSL variation or a simple ASIC notification.

What type of change are you making to your business or AFSL?

Does your proposed change affect your AFSL authorisations or licence conditions?

Are you notifying ASIC about a key person or Responsible Manager leaving?

⚖️ Full AFSL Variation Required

Your proposed change requires a full AFSL variation application under Section 914A(2)(b) of the Corporations Act 2001 (Cth). You must demonstrate that your business maintains the necessary organisational competence and compliance arrangements for the new activities.

Be prepared to provide updated business descriptions, financials, and ‘People Proofs’ for Responsible Managers.

Failure to obtain the correct authorisation before commencing the new activity may breach Section 911A(1) of the Corporations Act 2001 (Cth).

Section 914A(2)(b) of the Corporations Act 2001 (Cth)
Section 911A(1) of the Corporations Act 2001 (Cth)

Book an AFSL Variation Audit

✅ Simple ASIC Notification Sufficient

Your change appears to be a minor administrative update that does not affect your AFSL authorisations or licence conditions.

You can lodge a notification through the ASIC Regulatory Portal to keep your records up to date.

For Responsible Manager updates, ensure you notify ASIC within 10 business days as required by Regulation 7.6.04(1)(b) and Regulation 7.6.05(1)(g) of the Corporations Regulations 2001 (Cth).

Regulation 7.6.04(1)(b) and Regulation 7.6.05(1)(g) of the Corporations Regulations 2001 (Cth)

Get Help with ASIC Notifications

⚠️ Key Person Notification Required

If a key person named in your AFSL conditions leaves, you must notify ASIC in writing within five business days, as required by your licence conditions under Section 914A of the Corporations Act 2001 (Cth).

Failure to comply can result in suspension or cancellation of your AFSL.

Include the date of departure, any replacement details, or reasons for not appointing a replacement.

Section 914A of the Corporations Act 2001 (Cth)

Speak to an AFSL Compliance Lawyer

❌ Unclear – Seek Legal Advice

Your situation is complex or does not fit standard categories.

ASIC may require a full variation or additional notifications depending on your specific circumstances.

It is strongly recommended that you seek tailored legal advice to avoid regulatory breaches.

Speak to an AFSL Lawyer

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

The 2025 Portal Pivot & Why Your AFSL Variation is a Re-Pitch

Moving AFSL Transactions into the ASIC Regulatory Portal

In mid-2025, the ASIC implemented a fundamental change in how financial service providers manage their licensing. It moved new AFSL variation, cancellation and change-notification transactions to the ASIC Regulatory Portal. Before that date, applicants generally used Form FS03 for variations and Form FS20 for change notifications through eLicensing.

The old methods have been replaced by the ASIC Regulatory Portal, which operates as a digital-first platform. Key changes from this transition include:

End of numbered forms: Applications are now completed as online “transactions” within the portal, rather than through the former eLicensing workflow.
Direct document uploads: ASIC no longer provides a MOVEit address for AFSL proof documents, and portal uploads are no longer subject to the former 10 MB file limitation.
Structured data entry: ASIC collects information through structured transaction fields and no longer distinguishes between “core” and “non-core” proofs.

Ultimately, this move to a centralised digital system was designed to streamline interactions with the regulator. However, it requires a new approach to preparing and lodging applications.

Treating Your Licence Variation as a Strategic Re-Pitch to ASIC

The introduction of the ASIC Regulatory Portal means a variation to your AFSL is more than just an administrative update. Instead, it should be viewed as a complete re-pitch of your business to the regulator. Furthermore, the portal’s digital workflow is designed to be dynamic, adjusting the questions you need to answer based on your real-time inputs.

This intelligent system connects previously separate datasets, allowing algorithms to flag inconsistencies in your application instantly. Consequently, a discrepancy that might have been missed or queried weeks later by a human analyst can now halt your application at the initial digital stage. For this reason, every variation is an opportunity for ASIC to conduct a fresh assessment of your entire operation, ranging from your organisational competence to your financial stability.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Variation vs. Notification: A Decision Matrix

When to Lodge a Full AFSL Variation

A full AFSL variation is required where your proposed activity requires a change to the authorisations or other conditions of your licence. The relevant application is made under Section 914A(2)(b) of the Corporations Act 2001 (Cth). The test is not whether the change is commercially significant; it is whether the existing AFSL conditions cover the proposed activity.

Common triggers that necessitate a full variation include:

Adding new financial products or services: If your business intends to provide a financial service or deal in a financial product not covered by its existing authorisation conditions, it should apply to vary those conditions under Section 914A(2)(b) before carrying on that activity. Section 911A(1) of the Corporations Act 2001 (Cth) requires the licensee to hold an AFSL covering the financial services business it carries on.
Changing your client base: Moving from wholesale-only clients to retail clients may require a variation if the existing AFSL authorisation conditions are limited to wholesale clients. This move introduces a higher level of consumer protection obligations, and ASIC will need to assess your capacity to meet them. The expansion can also engage retail-client obligations, including dispute-resolution obligations under Section 912A, and compensation-arrangement obligations under Section 912B.
Altering how you handle client money: If you plan to change the way you hold client funds or assets, a variation may be needed if the proposed model adds a financial service not covered by the existing licence conditions. This includes a custodial or depository service within Section 766E of the Corporations Act 2001 (Cth). However, a change in internal procedures alone does not automatically require an AFSL variation. Further, if the licensee receives client money in connection with a financial service, Section 981B may impose separate client-money obligations.

When a Simple Notification is Enough

Not every business change requires a full variation application. For minor administrative updates that do not alter the authorisations or conditions of your AFSL, a simple notification through the ASIC Regulatory Portal is enough. These updates are designed to keep ASIC’s records current.

A portal notification is appropriate for changes such as:

Updating your business details: This may include changes to information required to be recorded on the register, where the change falls within Reg 7.6.05 of the Corporations Regulations 2001 (Cth).
Updating Responsible Manager details: A change to a responsible manager is generally notified under Reg 7.6.04(1)(b) and Reg 7.6.05(1)(g) within 10 business days. This is in addition to any separate requirement under a key person condition on the AFSL.
Amending compensation or dispute resolution details: Minor updates to your compensation arrangements, such as a new professional indemnity insurance policy, can be lodged via a notification.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Navigating the Digital Workflow to Vary Your AFSL

Preparing Your Documentation & Initiating the Transaction

Before you begin your application in the ASIC Regulatory Portal, it is important to conduct a pre-flight check. This initial step helps prevent access issues that can delay your submission, and involves ensuring that:

your user permissions are correct; and
your Australian Financial Services AFSL registrations are up to date and properly linked within the portal.

Once you are ready, you can initiate the “Vary AFSL” transaction. The portal will require you to select the type of variation you are making, such as changing your authorisations or amending licence conditions. Make these selections with precision, as the portal’s dynamic questionnaire generates new evidence questions based on your inputs. A carefully considered choice at this stage can minimise unnecessary back-and-forth requisitions from the ASIC.

Uploading Tailored Proofs & Settling Invoices

As you move through the digital workflow, the portal will prompt you to attach specific documentation requested by the dynamic questionnaire. ASIC no longer distinguishes between “core” and “non-core” proofs, and supporting documents are described as People Proofs. However, People Proofs are not necessarily required for every person at the point of lodgement; ASIC may request them for only a subset of fit and proper people during assessment. This process replaces the old MOVEit system and its 10MB file limitation, allowing for a more integrated submission.

After you submit the application, the portal digitally generates an invoice for the required fee. ASIC will not assign your application to an analyst for assessment until this invoice has been paid, and the funds have cleared. You can pay the application fee by BPAY or cheque. Promptly settling this invoice is a critical step to ensure your variation enters the assessment queue without delay.

ASIC may request information or material under Section 914B(3) of the Corporations Act 2001 (Cth). A failure to provide requested information within the period specified by ASIC can result in the application being taken to have been withdrawn under Section 914B(6).

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Avoiding the Key Person 5-Day Trap & Lessons for Responsible Managers

Understanding the High-Stakes Five-Day Notification Rule

An AFSL may include a key person condition, which ASIC generally imposes when a licensee is heavily dependent on the competence of one or two specific responsible managers. If a person named under this condition leaves your business or ceases their duties, your compliance arrangements are immediately at risk.

AFS licensees are typically required to notify ASIC in writing within five business days of the date the key person ceases their role, depending on the wording of the actual AFSL condition, as imposed or varied under Section 914A of the Corporations Act 2001 (Cth). There is no general provision in the Corporations Act 2001 (Cth) that imposes a five-business-day notification rule whenever any responsible manager leaves.

Your notification to ASIC must include:

the date the key person stopped being an officer or performing their duties;
details of any new responsible manager appointed to replace the key person; and
if no replacement has been appointed, detailed reasons why.

Case Study: Focused Financial Advice Pty Ltd Licence Suspension

The consequences of failing to comply with a key person condition are not theoretical. In ASIC Media Release 25-293MR, the regulator detailed the suspension of the AFSL held by Focused Financial Advice Pty Ltd.

The company’s key person and responsible manager had ceased their roles, but the licensee failed to notify ASIC within five business days as required by its licence conditions. The business continued to provide financial services for more than two years without a key person in place.

The breach was only identified after ASIC made direct enquiries. Ultimately, this failure led ASIC to suspend the company’s AFSL, providing a clear example of the serious regulatory action that can result from not adhering to key person conditions.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Updating Fit and Proper Information & People Proofs

Automating Fit & Proper Assessments with Digital Background Checks

ASIC must be satisfied, in accordance with Section 913BA of the Corporations Act 2001 (Cth), that the relevant people are fit and proper in the circumstances prescribed by that section. The ASIC Regulatory Portal automates significant parts of the “Fit and Proper Person” assessment for your AFSL variation. This digital process involves real-time cross-referencing of a nominee’s details against police and bankruptcy registries. As a result, the system is designed to flag discrepancies or expired documents instantly.

This automation increases the need for accuracy when providing information for any new responsible manager or officer. Key aspects of the digital background check process include:

Direct data validation: The portal can verify information against national databases, leaving no room for error.
Streamlined document submission: You must upload all required “People Proofs,” such as a national criminal history check, directly into the portal.
Reduced applicant burden: ASIC has removed the need for applicants to provide Australian bankruptcy certificates for fit and proper persons, as the regulator now handles these checks internally.

Because the system has zero tolerance for misclassified or outdated documents, you must ensure every piece of information articulating a nominee’s competence is flawless before submission.

Refreshing Your Business Description & Financials

A variation application is a re-pitch of your business to the regulator, meaning your core proofs must reflect your new operational reality. Your business description and financial-resources evidence should explain how the proposed authorisations can be supported in practice. This includes the operating model, responsible-manager capability, financial resources and risk management relevant to the expanded activities.

This description must also demonstrate that your compliance framework can scale to meet new challenges, such as changing client demographics or the complex legal requirements of the 2026 AML/CTF reforms.

While ASIC now requests financial statements at the “requirements stage” rather than upfront, you must have them prepared.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

The NSW Advantage & Localised Support for Sydney Fintechs

Navigating Unique Local Pressures in the Sydney Tech Ecosystem

Operating a financial services business in Sydney can present commercial pressures associated with fundraising, product expansion and hiring. However, this need for speed cannot come at the expense of a sound regulatory strategy. Fintech founders in Sydney must navigate complex pivots and expansions without compromising their compliance arrangements, a common area where legal advice for startups is essential.

Investors may assess whether the business has identified the licensing consequences of its growth plan. The relevant objective is not a “bulletproof” compliance strategy, but an approach that is aligned with applicable licensing obligations and appropriate to the nature, scale, and complexity of the business.

Leveraging Fractional General Counsel for Proactive Risk Management

For scaling Sydney businesses, a Fractional General Counsel model provides on-demand access to high-level institutional knowledge and legal strategy. This approach is designed to match the operational speed that the tech industry demands, without the significant overhead of hiring a full-time general counsel.

This model focuses on proactive risk management, helping founders navigate key challenges, including:

the realities of ASIC enforcement; and
the expectations of local investors.

Ultimately, by having a legal partner who understands the Sydney ecosystem, a business can ensure its compliance framework acts as a strategic asset for growth rather than a roadblock.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

The shift to the ASIC Regulatory Portal has transformed the AFSL variation process into a strategic re-pitch, requiring businesses to navigate a new digital workflow and provide robust digital proof. Successfully managing this landscape means understanding the critical difference between a variation and a notification and avoiding high-stakes pitfalls like the five-day key person notification trap.

Navigating these changes requires a clear strategy to ensure your compliance framework supports your growth. Contact Click Legal’s AFSL lawyers for a fixed-fee variation audit to gain operational certainty and ensure your business is ready to scale smoothly.

Frequently Asked Questions

How long does ASIC take to assess an AFSL variation?

There is no statutory decision period for an AFSL variation application. However, ASIC’s Service Charter states that it aims to decide 70% of complete licence and variation applications within 150 days and 90% within 240 days.

What happens if I miss the five-day deadline for a key person departure?

If your AFSL conditions mention a five-day deadline, failing to notify ASIC within such period of a key person’s departure can breach Section 912A(1)(b) of the Corporations Act 2001 (Cth), and ASIC may suspend or cancel your licence.

Do I need to submit a full variation to change my business address?

No, you typically do not need to submit a full variation to change your business address, as this is considered a minor administrative update that only requires a simple notification through the ASIC Regulatory Portal. However, check the individual AFSL for any tailored condition that may require a different response.

What are the new People Proofs required for Responsible Managers?

The required People Proofs for a new responsible manager include a signed statement of personal information, a national criminal history check, and a bankruptcy check, with all background checks being less than 12 months old.

Can I still use the MOVEit portal for my supporting documents?

No, the MOVEit portal has been retired as part of ASIC’s digital transition, and all supporting documents must now be uploaded directly within the ASIC Regulatory Portal during the application transaction.

How do the 2026 AML/CTF reforms impact my licence variation?

An AFSL variation does not itself trigger AML/CTF obligations. The relevant question is whether the proposed activity involves a designated service under the AML/CTF framework. The 2026 AML/CTF reforms bring new businesses under the regulation, so you may have new AML/CTF compliance obligations to consider.

What is the difference between a retail & wholesale client authorisation?

Adding a retail client authorisation to your AFSL requires more extensive documentation to demonstrate consumer protections, such as proof of membership with the Australian Financial Complaints Authority and adequate professional indemnity insurance.

Are financial statements required upfront in the new portal?

No, financial statements are no longer required when you first submit your application in the portal but will be requested by ASIC at the requirements stage if your variation is moving towards approval.

How much does an online variation application cost for a body corporate?

The online variation application fee for a body corporate is $2,470, and this payment must be cleared before ASIC will assign an analyst to begin assessing your submission.

Hiring the Right Responsible Manager for an AFSL Application

Hannah Deuk — Fri, 10 Jul 2026 04:21:45 +0000

Introduction

Securing an Australian Financial Services Licence (AFSL) requires an AFS licensee to demonstrate organisational competence under the Corporations Act 2001 (Cth). The Australian Securities and Investments Commission (ASIC) assesses this competency through the appointment of a responsible manager (RM) who is directly responsible for significant day-to-day decisions regarding the ongoing provision of financial services.

This article explains the AFSL application process for a financial services business so you can appoint a suitable candidate. It outlines how to assess a nominated RM, verify their knowledge and skills, and ensure they are fit and proper to maintain compliance.

Interactive Tool: See If Your Candidate Qualifies as a Responsible Manager

Responsible Manager Eligibility Checker

Quickly assess if your Responsible Manager candidate meets ASIC’s AFSL requirements before you apply.

Which best describes your Responsible Manager candidate’s qualifications?

Does the candidate have at least 3 years of relevant experience in the last 5 years (or 5 in the last 8 for Option 2)?

Has the candidate passed all required fit and proper person checks (criminal, bankruptcy, regulatory history)?

✅ Candidate Likely Meets ASIC RM Requirements

Based on your answers, your Responsible Manager candidate appears to satisfy ASIC’s core eligibility criteria under Regulatory Guide 105 and Section 912A(1)(e) of the Corporations Act 2001 (Cth). Ensure you retain evidence of qualifications, experience, and all People Proofs for your AFSL application.

Tip: ASIC will assess both individual and collective competence, so review your full RM team coverage.

Legal References: Section 912A(1)(e) of the Corporations Act 2001 (Cth) | Regulatory Guide 105 (ASIC) | RG 105.54 (ASIC)

Start Your AFSL Application with a Lawyer

⚠️ Experience or Documentation Gap Detected

Your candidate may not meet ASIC’s minimum experience or documentation requirements. ASIC requires strict evidence of relevant experience and fit and proper person checks for Responsible Managers under Section 913BA of the Corporations Act 2001 (Cth) and RG 1.182–RG 1.183.

Action: Review your candidate’s qualifications and gather all required People Proofs before proceeding.

Legal References: Section 913BA of the Corporations Act 2001 (Cth) | RG 1.182–RG 1.183 (ASIC)

Get Legal Advice on RM Eligibility

❌ Candidate Unlikely to Qualify as Responsible Manager

Your answers suggest the candidate does not meet ASIC’s Responsible Manager requirements under Regulatory Guide 105 and Section 912A(1)(e) of the Corporations Act 2001 (Cth). ASIC may reject your AFSL application or require a new nomination.

Next Step: Consider nominating a different candidate or seek legal advice to address gaps.

Legal References: Section 912A(1)(e) of the Corporations Act 2001 (Cth) | Regulatory Guide 105 (ASIC)

Speak to an AFSL Lawyer Now

⚖️ Written Submission Pathway Required

Your candidate may only be eligible via the written submission pathway (Option 5). This requires a detailed submission to ASIC explaining why the candidate’s knowledge and skills are appropriate for the proposed financial services and products.

Tip: This pathway is not inferior but requires strong evidence and clear documentation.

Legal References: RG 105.54 (ASIC) | Section 912A(1)(e) of the Corporations Act 2001 (Cth)

Book a Consultation for Written Submissions

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Understanding the Responsible Manager Role

Direct Responsibility & Day-to-Day Decisions

Under ASIC’s Regulatory Guide 105 (RG 105), a nominated RM is expected to have direct responsibility for significant day-to-day decisions about the ongoing provision of the relevant financial services. This plays a critical role in demonstrating compliance with Section 912A(1)(e) of the Corporations Act 2001 (Cth) that requires the AFS licensee to maintain competence to provide the financial services covered by its licence.

In practice, an RM’s responsibility involves:

deciding how your financial services are delivered; and
supervising the provision of those services.

The role is not for a figurehead, as ASIC expects the RM to be organisationally close to the actual delivery of financial services. Furthermore, as per RG 105.23 senior executives like a chief financial officer or a compliance manager may not meet the standard where they do not oversee the relevant operational decisions.

In addition, ASIC scrutinises arrangements where an RM appears to be appointed on paper only. A person cannot simply accept fees for the role without fulfilling the duties, as such an arrangement may mean the licensee cannot comply with its obligations under Section 912A(1)(e) and Section 913B(1)(b) of the Corporations Act (Cth). The purpose of an RM is to ensure genuine oversight and management of the financial service, not just to satisfy a licensing requirement.

Ensuring Collective Competency & Coverage

As per RG 105.8(b), RG 105.36 and RG 105.42, the team of nominated RMs must collectively possess the knowledge and skills to cover all financial services and financial products authorised under your AFS licence. ASIC assesses organisational competence at the licensee level, meaning the combined expertise of your RMs is what matters. Consequently, each financial product and service you offer must be matched by the skills and experience of at least one RM.

This requirement ensures there are no gaps in competency. For instance, if your AFS licence authorises you to advise on and deal in both life and general insurance products, you could meet this obligation in several ways, as follows:

appoint one RM with expertise in life insurance and a second with expertise in general insurance; or
nominate one RM with knowledge and skills in advising on both product types, and another with competence in dealing in both.

ASIC generally expects an AFS licensee to nominate at least two RMs under RG 105.49 and Regulatory Guide 1.174 (RG 1). This approach helps ensure comprehensive coverage across all authorised services and mitigates the risk of depending too heavily on a single individual’s competence. For a one-person advisory business, however, ASIC may accept a single RM.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Evaluating ASIC’s 5 Competency Pathways

Meeting Industry Standards & Individual Assessments (Options 1 & 2)

Under its RG 105.54, ASIC provides five options through which each nominated RM is expected to demonstrate appropriate knowledge and skills. A nominated RM must satisfy one of the five options.

Option 1 allows a candidate to qualify by meeting a widely adopted industry standard or a relevant standard set by Australian Prudential Regulation Authority (APRA). Furthermore, this must be paired with at least three years of relevant experience within the last five years.

By contrast, Option 2 is designed for experienced professionals who may lack formal qualifications. This pathway involves:

Individual assessment: an assessment by an authorised assessor to confirm the candidate has knowledge equivalent to a diploma; and
Experience requirement: a minimum of five years of relevant experience over the past eight years.

Combining University Degrees & Short Industry Courses (Options 3 & 4)

Options 3 and 4 focus on formal academic and industry-specific qualifications. To satisfy Option 3, an RM must hold a university degree in a relevant discipline, such as business, commerce, economics, or finance. In addition, this degree must be supplemented with a relevant short industry course and three years of applicable experience in the last five years.

Alternatively, Option 4 requires a candidate to have an industry or product-specific qualification that is equivalent to a diploma or higher. Similar to Option 3, that qualification must be relevant to the RM role and must be accompanied by three years of relevant experience within the past five years.

Using the Written Submission Pathway (Option 5)

Option 5 is a flexible, case-specific pathway for those who do not meet the criteria for the other four options. This pathway requires a detailed written submission to ASIC that explains why the person has the appropriate knowledge and skills for the role. Specifically, the submission must outline the RM’s:

Role and responsibilities within the business;
Relevant qualifications and courses completed;
Experience over the past 10 years;
Professional credentials or affiliations; and
Reasons why the person is appropriate for the particular financial services and products sought.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

The Step-by-Step RM Hiring Process

Alignment of Candidate Competencies with Licence Authorisations

RG 105.39–RG 105.42 requires applicants to demonstrate that their RMs collectively have appropriate knowledge and skills for every financial service and product covered by the proposed AFSL. As established, ASIC assesses organisational competence at the licensee level, meaning your team must collectively cover every authorisation on your licence without any gaps.

If a single RM does not have expertise across all areas, you may appoint others to achieve full coverage. Furthermore, for businesses that operate managed investment schemes, at least one RM must demonstrate an understanding of the investment and operational aspects of the assets under management.

Conducting Strict Fit & Proper Background Checks

Section 913BA of the Corporations Act 2001 (Cth) applies the statutory fit-and-proper-person test to the RM applicant, among others. Further, RG 1.182–RG 1.183 states that ASIC requires People Proofs for RMs and applies comparable probity checks when the RM is not already assessed under the statutory fit-and-proper test.

The essential checks and documents include:

a national criminal history check, including relevant overseas criminal history checks;
bankruptcy checks for each country in which the person has lived for more than 12 months in the preceding 10 years;
a completed, signed Statement of Personal Information;
qualification certificates; and
information about the RM’s relevant roles, experience, and responsibilities.

In addition, ASIC will also consider any history of regulatory issues, such as previous licence suspensions or disqualifications from managing corporations. For persons subject to Section 913BA, these matters are expressly relevant under Section 913BB(2) of the Corporations Act 2001 (Cth). It is important to note that under RG 1.149, People Proofs must generally be no more than 12 months old.

Assessing Capacity & Prior Regulatory Problems

A candidate’s capacity to fulfil the role is a critical consideration. As per RG 105.26–RG 105.27 and RG 1.179, an RM must have sufficient time available to oversee significant day-to-day decisions. Therefore, you should evaluate their overall business commitments, as multiple roles may prevent them from effectively performing their duties for your licence.

Factors that affect an RM’s capacity include the following:

whether they are already an RM for other AFS licensees;
the number of staff they must supervise; and
any other professional roles they hold.

Investigating a candidate’s past is also a necessary step. If a potential RM was involved with another AFS licensee that faced regulatory action from ASIC, this history is highly relevant. While it may not automatically disqualify them, ASIC will consider it when assessing their suitability and your business’s overall organisational competence.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Internal Promotions vs. External Consultants

Promoting Internal Talent as RMs

Promoting existing employees, such as directors or senior staff, may make it easier to demonstrate genuine day-to-day involvement because the person is already embedded in the business.

That said, it is a practical evidentiary advantage, not an ASIC rule or statutory preference for internal appointments. An RM does not need to be an employee, director, or officer of the licensee. The central issue is whether they have the required direct responsibility, knowledge, skills, and capacity.

Mitigating the Risks of Hiring External Consultants

Engaging an external consultant as an RM is a viable option, particularly for businesses that lack the necessary in-house expertise. However, the consultant must still satisfy ASIC’s direct-responsibility and capacity expectations under RG 105.22–RG 105.27. Further, it is important to not enter into “rent-a-name” arrangements with an RM, designed only to meet licensing requirements on paper.

To manage these risks, you must ensure any external RM is genuinely integrated into your financial services business. Key mitigation strategies include:

Defining a clear role: The consultant’s agreement should explicitly detail their responsibilities, time commitment, and decision-making authority.
Ensuring genuine involvement: The external RM must have real operational connection and influence over your day-to-day financial services.
Avoiding over-commitment: Assess whether their other RM appointments create capacity or conflict concerns.
Maintaining evidentiary records: Retain evidence showing how the consultant is involved in the relevant financial-services operations.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Learning from ASIC Enforcement Actions

The Financial Services Group Australia Case Study

ASIC provides clear examples of the consequences for failing to meet RM duties. In June 2025, ASIC cancelled the AFS licence of Financial Services Group Australia Pty Ltd (FSGA) and permanently banned its RM, Graham Holmes.

ASIC’s investigation found that Mr Holmes had accepted the RM role ‘on paper’ only. He received fees for the position but knew he was not fulfilling the required duties, which include having direct responsibility for significant day-to-day decisions.

Under Section 912A(1)(e) of the Corporations Act 2001 (Cth), an AFS licensee is required to maintain organisational competence. The RM arrangement with Mr Holmes was relevant to ASIC’s assessment of whether FSGA had maintained that competence.

ASIC stated that FSGA had failed to maintain competence and the enforcement action also highlighted broader licensee failings, including:

A failure to ensure its representatives acted in the best interests of clients.
Inadequate financial and human resources.
A failure to maintain the competence to provide the financial services covered by the licence.

The MW Planning Licence Suspension Case Study

The case of MW Planning Pty Ltd as detailed in Media Release 25-299MR demonstrates the critical importance of succession planning for an RM. On 11 December 2025, ASIC suspended MW Planning’s AFSL after it failed to appoint a replacement RM following the banning of its existing RM, Robert John Tohill.

This failure meant the AFS licensee could not meet its organisational competence and human resources obligations. The situation underscores the risk for a financial services business that depends heavily on a single individual to demonstrate its competency to the regulator.

Furthermore, ASIC found that MW Planning had failed to lodge required financial statements and did not report its compliance failures to ASIC. The licence was initially suspended until June 2026, but the issues were not rectified, and ultimately this led ASIC to cancel the AFS licence permanently in May 2026.

The Global Financial Markets Pty Ltd Case Study

The importance of precisely matching a candidate’s expertise to the requested authorisations was affirmed in Global Financial Markets Pty Ltd and Australian Securities and Investments Commission [2017] AATA 1397 [27].

The Administrative Appeals Tribunal (AAT) upheld ASIC’s refusal to grant a licence because the nominated responsible manager could not demonstrate the specific ‘knowledge and skills’ required under RG 105. As a result, ASIC was not satisfied that the applicant was likely to comply with Section 912A of the Corporations Act (Cth).

The practical lesson is that general experience should be clearly connected to the particular services, products, compliance systems and supervisory responsibilities proposed under the AFSL.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Navigating the ASIC Nomination Process

Submitting ‘People Proofs’ via the ASIC Portal

For a new AFSL application, RG 105.95 requires the applicant to nominate RMs in the application and provide People Proofs showing that each RM meets an RG 105 pathway and that the RMs collectively cover the proposed services and products.

For an existing AFS licensee, Reg 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth) requires notification of changes to registered information. ASIC’s current Regulatory Portal process requires notification of RM changes within 10 business days of the change occurring.

When adding a new RM through the current ASIC portal, the licensee is required to provide:

a Statement of Personal Information;
a criminal history check;
competence information, including relevant roles during the preceding 10 years;
qualification certificates; and
overseas bankruptcy and police certificates where the person has lived outside Australia for more than 12 months during the preceding 10 years.

Managing Key Person Conditions & Succession Planning

If your financial services business is heavily dependent on the knowledge and skills of one or two individuals, ASIC may impose a ‘key person condition’ on your AFS licence. This condition, detailed in RG 105, names the specific RMs whose competence is critical to your organisational competence.

The departure of a named key person may require the licensee to notify ASIC, apply to vary the licence condition, nominate a replacement or explain why no replacement has been appointed, and demonstrate continuing organisational competence.

ASIC’s RG 1 example states that a licensee with a departing key person must lodge the variation application within five business days of the person ceasing to be an officer or ceasing to perform duties for the licensee. This separate key-person-condition process should not be confused with the general 10-business-day RM-change notification under Reg 7.6.04(1)(b) of the Corporations Regulations 2001 (Cth).

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

Appointing the right RM is a critical step in securing an AFSL and demonstrating organisational competence to ASIC. The process requires a thorough assessment of a candidate’s experience, qualifications, and character to ensure they can genuinely oversee your financial services business and maintain compliance.

To navigate the complexities of the AFSL application process and appoint a suitable RM, contact our AFSL application lawyers at Click Legal. Our team provides clear, fixed-fee legal support to help ensure your financial services business meets its regulatory obligations with confidence.

Frequently Asked Questions

What is the role of a Responsible Manager in an AFSL application?

A Responsible Manager’s role is to demonstrate to ASIC that your business has the organisational competence to provide the financial services covered by your AFSL. They are directly responsible for significant day-to-day decisions about the provision of financial services, ensuring compliance with obligations under Section 912A(1)(e) of the Corporations Act 2001 (Cth).

How many Responsible Managers does an Australian financial services business need?

The number of RMs required depends on the nature, scale, and complexity of your financial services business. While a small, one-person advisory firm may only need one, ASIC generally expects a business to have at least two to ensure all financial products and services are covered and to mitigate key person risk.

Can a contractor serve as a Responsible Manager?

Yes. Neither Section 912A(1)(e) of the Corporations Act 2001 (Cth) nor RG 105 requires an RM to be an employee or officer. However, the contractor must have genuine direct responsibility, sufficient capacity and appropriate knowledge and skills under RG 105.22–RG 105.27.

What happens if ASIC rejects a nominated Responsible Manager?

If ASIC rejects your nominated RM, your business must promptly address the reasons for the rejection. This typically involves either nominating a different candidate who meets ASIC’s requirements or providing further evidence to enhance the qualifications and experience of the original nominee to prove their competence.

How do I prove a candidate is a fit & proper person?

To prove a candidate is a fit and proper person, you must provide ASIC with a set of documents often called ‘People Proofs’. ASIC also applies comparable probity checks to RMs under RG 1.182–RG 1.183. Current People Proofs include criminal-history and bankruptcy checks, a signed Statement of Personal Information and relevant supporting evidence.

What is a key person condition on an AFSL?

ASIC imposes a key person condition on an AFSL when it determines that the business is heavily reliant on the knowledge and skills of one or two individuals. If a person named under this condition leaves, the licensee must notify ASIC and promptly nominate a replacement to demonstrate that organisational competence is maintained.

How quickly must I notify ASIC if my Responsible Manager leaves?

For an ordinary change to an RM, an existing AFS licensee must generally notify ASIC within 10 business days. If the departing RM is named in a key-person condition, the licensee may also need to apply to vary that condition, typically within a five-business-day timeframe.

Can offshore experience count towards Responsible Manager qualifications?

ASIC may accept a relevant overseas qualification where it is comparable to an Australian qualification that satisfies an RG 105 pathway. Overseas experience may still be relevant, but the applicant should explain how it equips the RM for the particular Australian authorisations and regulatory obligations sought.

What are the risks of relying solely on Option 5 for competency?

The practical risk of relying on Option 5 for competency is evidentiary: the applicant must clearly demonstrate why the RM’s knowledge and skills are appropriate for the proposed financial services, products and business model. However, this option is not legally inferior and is not subject to a separate statutory penalty or presumption against approval.

The Fit & Proper Person Test for AFSL Applications in Australia

Hannah Deuk — Fri, 10 Jul 2026 04:16:29 +0000

Introduction

Securing an Australian Financial Services Licence (AFSL) requires applicants to pass the fit and proper person test mandated by Section 913BA of the Corporations Act 2001 (Cth). While this assessment can feel thorough—as the Australian Securities and Investments Commission (ASIC) is essentially looking into your past to predict the firm’s future—it ensures that key individuals possess the integrity and competence to provide financial services.

Following amendments introduced by the Financial Sector Reform (Hayne Royal Commission Response—Stronger Regulators (2019 Measures)) Act 2020 (Cth) (2020 Amendment), the current statutory framework replaced the former “good fame and character” criterion with ss 913BA and 913BB of the Corporations Act 2001 (Cth). This article explains the core assessment criteria, the required people proofs, and the ongoing obligations for responsible managers and controllers so you can manage your licensing requirements.

Interactive Tool: See If You Meet the AFSL Fit & Proper Person Test

AFSL Fit & Proper Person Test Checker

Quickly assess if you or your key personnel are likely to meet ASIC’s fit and proper person test for an AFSL application or ongoing compliance.

Step 1 of 4

Are you applying for a new AFSL, varying an existing AFSL, or maintaining ongoing compliance?

Has any key person (director, responsible manager, controller) had a criminal conviction for dishonesty, fraud, or financial services offences in the last 10 years?

Has any key person been subject to a banning order, licence cancellation, or is currently bankrupt or insolvent?

Are you or any key person a controller (including significant investors or parent entities) as defined under Section 910B of the Corporations Act 2001 (Cth)?

✅ Likely to Satisfy ASIC’s Fit & Proper Person Test

Based on your answers, you and your key personnel appear to meet the core requirements of the fit and proper person test under Section 913BA and Section 913BB of the Corporations Act 2001 (Cth). Ensure all People Proofs (including criminal history and bankruptcy checks less than 12 months old) are prepared and submitted with your application. Ongoing compliance reviews are recommended.

Note: This is a general assessment only. ASIC may consider additional factors or request further information.

Section 913BA of the Corporations Act 2001 (Cth)

Section 913BB of the Corporations Act 2001 (Cth)

Start Your AFSL Application with a Lawyer

⚠️ Controller Status May Trigger Extra Scrutiny

ASIC’s fit and proper person test applies to controllers, including significant investors and parent entities, under Section 910B of the Corporations Act 2001 (Cth). If you are unsure about your controller status, seek legal advice to avoid delays or compliance breaches. Controllers must provide People Proofs, and foreign controllers may face additional documentation hurdles.

Section 910B of the Corporations Act 2001 (Cth)

Section 913BA of the Corporations Act 2001 (Cth)

Book a Controller Status Review

❌ Likely to Fail: Disqualifying Criminal Conviction or Banning Order

A recent conviction for dishonesty, fraud, or financial services offences, or a banning/disqualification order, is a major statutory red flag under Section 913BB and Section 920A of the Corporations Act 2001 (Cth). ASIC is unlikely to grant or renew an AFSL unless exceptional circumstances exist. You should seek urgent legal advice regarding your eligibility and potential disclosure obligations.

Section 913BB of the Corporations Act 2001 (Cth)

Section 920A of the Corporations Act 2001 (Cth)

Speak to a Financial Services Lawyer Now

⚖️ Ongoing Compliance Required

The fit and proper person test is an ongoing obligation for all AFSL holders under Section 915C and Section 912A of the Corporations Act 2001 (Cth). Regular checks (criminal, bankruptcy, and ASIC registers) and signed declarations are recommended to maintain compliance and avoid licence suspension or cancellation.

Section 915C of the Corporations Act 2001 (Cth)

Section 912A of the Corporations Act 2001 (Cth)

Book a Compliance Health Check

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

The Fit & Proper Test: Definition & Assessment Criteria

The fit and proper person test is a mandatory requirement for any business applying for or holding an AFSL. Under Section 913BA(1) of the Corporations Act 2001 (Cth), ASIC must have no reason to believe that the key individuals involved in a financial services business are not fit and proper.

ASIC evaluates individuals against several core criteria to determine if they are fit and proper. In terms of Regulatory Guide (RG) 1.139, this assessment may include competence in the relevant role, character, diligence, honesty, integrity, judgement, compliance history and conflicts of interest.

Further, the statutory matters to which ASIC must have regard are set out in Section 913BB(2) of the Corporations Act 2001 (Cth), including:

Licence History: Whether the person has ever had an AFS licence or Australian credit licence suspended or cancelled.
Banning and Disqualification: Whether any banning orders or disqualification orders have been made against the person under the Corporations Act 2001 (Cth) or the National Consumer Credit Protection Act 2009 (Cth).
Criminal Convictions: Any convictions for offences involving fraud, dishonesty, or financial services laws in the last 10 years.
Insolvency and Bankruptcy: Whether the individual is an undischarged bankrupt or bound by a personal insolvency agreement.
AFCA Determinations: Any failures to comply with determinations made by the Australian Financial Complaints Authority (AFCA).

This statutory list is important, but it is not exhaustive because ASIC must also have regard to any other matter it considers relevant.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Scope of Scrutiny & The Controller Trap for Investors

Who is Assessed Under the Test?

Under Section 913BA of the Corporations Act 2001 (Cth), the fit and proper assessment casts a wide net, extending beyond just the directors you appoint. It applies differently depending on the applicant’s legal structure.

ASIC's scrutiny applies to a broad range of individuals connected to the management and control of the AFSL applicant. The test covers:

The applicant if they are an individual.
Officers of the applicant if it is a body corporate, which includes all directors, company secretaries, and senior managers, regardless of whether they perform duties directly related to the AFSL.
Partners and senior managers if the applicant is a partnership.
Trustees and senior managers if the applicant is a trust with multiple trustees.
Any person or entity that controls the applicant.
The officers of any corporate controller, extending the test up the ownership chain.

The term 'officer' is defined broadly under Section 9 of the Corporations Act 2001 (Cth). It includes not only directors and secretaries but also anyone who makes, or participates in making, decisions that affect a substantial part of the business or who has the capacity to significantly affect the company's financial standing, or whose instructions the directors are accustomed to following.

Navigating the Controller Trap for Significant Investors

Many founders preparing AFSL applications are surprised to learn that their significant investors, including venture capital (VC) funds or silent partners, may be subject to ASIC's fit and proper person test. This is known as the "controller trap". The test applies to any person or entity that controls the applicant, and this extends beyond day-to-day management.

A controller is not limited to a shareholder with more than 50% ownership. Under Section 910B of the Corporations Act 2001 (Cth), a person is considered a controller if they have the capacity to:

cast, or control the casting of, more than half the votes at a general meeting;
hold more than half of the issued share capital of the company;
control the composition of the board; or
determine the outcome of decisions about the company's financial and operating policies, considering the practical influence the person can exert.

This means that even an investor with no direct involvement in the business must provide their personal information and proofs to ASIC if their shareholding or voting power meets this threshold. If the controller is a corporate entity, such as a VC fund, the fit and proper requirements extend to the officers of that controlling entity as well. Furthermore, this can be particularly onerous for businesses with foreign controllers, where obtaining the necessary documentation from overseas can be difficult.

For an existing AFSL holder, a person starting or ceasing to control the licensee triggers a notification obligation. As per Section 912DA(1) of the Corporations Act 2001 (Cth), the licensee must notify ASIC in the prescribed form within 30 business days. Failure to comply is a strict-liability offence under Section 912DA(2), with the offence consequence arising through Section 1311(1).

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Application Proofs & The ASIC Assessment Process

Required People Proofs & Documentation

To assess each individual against the fit and proper person test, ASIC requires a set of mandatory documents known as "People Proofs". As per RG 1.148-1.150, ASIC ordinarily requires People Proofs for relevant fit and proper persons, including officers of a corporate applicant, relevant controllers and certain persons connected with controller entities.

Each relevant person must provide the following documents, which must be no more than 12 months old at the time of submission:

Statement of Personal Information: This is a detailed questionnaire provided by ASIC that asks about the individual's conduct over the last 10 years, including any past disqualifications, enforcement history, or licence cancellations.
National Criminal History Check: This police background check is required to identify any convictions within the last 10 years, and equivalent checks may also be necessary if a person has lived or worked in other countries during that period.
Bankruptcy Check: An official search of insolvency registries is needed to confirm the individual's financial standing and to verify they are not insolvent under administration.

For individuals nominated as a responsible manager, additional proofs are often required to demonstrate their organisational competence under ASIC's RG 105. These supplementary documents typically include qualification certificates and business references.

How ASIC Administers the Test

ASIC administers the fit and proper person test primarily through a documentary assessment process conducted via the ASIC Regulatory Portal. The process is not typically an interview; instead, ASIC analysts review the submitted People Proofs against the specific criteria. Ultimately, the application is lodged online, and all supporting documents are uploaded directly to the portal.

ASIC's assessment is a comprehensive evaluation of character, history, and capabilities. If the information provided in the Statement of Personal Information or other proofs raises questions, ASIC may issue a formal request for further information to clarify the matter.

For large corporate groups with complex ownership structures, ASIC provides some practical relief. In certain situations, an applicant can provide a certification for officers of intermediate entities in the corporate chain, rather than submitting full People Proofs for every individual. However, this certification option is not available for the officers of the AFSL applicant itself or for the officers of the ultimate holding company.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Consequences of Failing the Assessment

What May Prevent ASIC from Being Satisfied

The statutory question is not whether a person “fails” a standalone test. The question is whether ASIC is satisfied that there is no reason to believe a person identified in Section 913BA(1) of the Corporations Act 2001 (Cth) is not fit and proper for the relevant role.

As established under Section 913BB of the Corporations Act 2001 (Cth), ASIC relies on the broad statutory red flags previously discussed—such as recent criminal convictions, insolvency events, past licence cancellations, or banning orders—to determine if an applicant falls short of the required standard.

License Refusal, Suspension and Cancellation

For a new application, ASIC must not grant an AFSL unless the fit and proper person requirement in Section 913BA of the Corporations Act 2001 (Cth) is satisfied. In such a case, ASIC may refuse the application.

For an application to vary AFSL conditions, ASIC may refuse the application if the fit and proper test is not satisfied in relation to the applicant and the licence as proposed to be varied, in terms of Section 914B.

For an existing AFSL holder, ASIC may suspend or cancel the licence where the fit and proper person requirement is not satisfied in relation to the licensee and the licence.

In all these cases, ASIC must offer the licensee an opportunity to be heard and make submissions before acting.

Banning Orders

Under Section 920A of the Corporations Act 2001 (Cth), ASIC may make a banning order in writing where it has reason to believe that a person is not fit and proper to provide financial services, act as an officer of an entity carrying on a financial services business, or control such an entity.

Further, such a person may be prohibited from providing financial services, performing specified functions in a financial services business, or controlling a financial services entity, for a specified period or permanently.

ASIC Enforcement Examples & Regulatory Outcomes

ASIC's enforcement actions provide clear examples of how failing the fit and proper person test can end a career in financial services. These cases serve as cautionary tales for all AFSL applicants and holders.

A notable example is ASIC's action against Financial Services Group Australia Pty Ltd (FSGA). As detailed in Media Release 25-102MR, ASIC cancelled FSGA's AFSL and permanently banned its responsible manager, Graham Holmes. ASIC found that Mr Holmes was a responsible manager 'on paper' only, knew he was not fulfilling his duties, and was involved in FSGA's failure to ensure its representatives acted in clients' best interests. Consequently, ASIC determined he was not a fit and proper person to participate in the industry.

Other cases further illustrate ASIC's application of the standard:

In the case involving Mark Bringans, as detailed in Media Release 22-301MR, the former Responsible Manager of Sirius Financial Markets (trading as "TradeDirect365"), ASIC issued an eight-year ban after finding he was inadequately trained, incompetent, and "not a fit and proper person to provide financial services".
In ASIC v Adler (2002) NSWSC 171, the court's findings of dishonesty and reckless disregard for legal obligations were central to determining that the individual was not a fit and proper person.
More recently, ASIC banned financial adviser Rhys James Rolls Reilly for ten years over misconduct connected to the Shield Master Fund, finding he was not a fit and proper person and had failed to properly oversee advisers.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Ongoing Compliance & Strategic Implications

Maintaining Ongoing Compliance Obligations

The fit and proper person test is not a one-off hurdle at the application stage; it is an ongoing requirement for the entire life of an AFSL. ASIC expects AFSL holders to have procedures in place to ensure that all officers, responsible managers, and controllers continue to meet the standard.

Good governance practice suggests that AFSL holders should carry out periodic checks to ensure their key personnel remain fit and proper. These regular reviews should include:

Annual criminal history checks for all officers and responsible managers.
Annual bankruptcy checks to confirm ongoing financial stability.
Regular searches of ASIC's banned and disqualified persons register.
Signed declarations from directors, responsible managers, and officers on a periodic basis, confirming any adverse circumstances that may affect their status.

Understanding the Strategic Implications for Compliance

For Australian businesses, compliance with the fit and proper person test must be treated as a strategic asset rather than a simple administrative task. The test applies continuously, meaning a failure at any point can lead to ASIC suspending or cancelling a licence or issuing a banning order against an individual under Section 920A of the Corporations Act 2001 (Cth). This makes robust, ongoing monitoring a critical component of risk management.

The strategic importance of this compliance is heightened by its intersection with other regulatory frameworks, such as the Financial Accountability Regime (FAR). The FAR imposes a separate but similar statutory obligation on certain entities to ensure their "Accountable Persons" are fit and proper. While the regimes have their own distinct rules, a failure under one is likely to influence an assessment under the other, reinforcing the need for a comprehensive and proactive approach to governance and compliance.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

Successfully securing and maintaining an AFSL hinges on key individuals passing the comprehensive fit and proper person test under the Corporations Act 2001 (Cth). This ongoing assessment requires complete transparency and the submission of detailed proofs, with failure carrying severe consequences such as licence cancellation and personal banning orders from ASIC.

Navigating the fit and proper person test can be a sensitive process, particularly when addressing historical issues before they are lodged with the regulator. For a confidential review of your personal history and a frictionless application process, contact our AFSL application lawyers at Click Legal to ensure your submission meets ASIC's high standards for integrity and transparency.

Frequently Asked Questions

What is the fit & proper person test for an AFSL?

The fit and proper person test is a mandatory requirement under the Corporations Act 2001 (Cth) for anyone applying for or holding an AFSL. This test ensures that individuals involved in providing financial services possess the necessary integrity, competence, and financial standing to protect consumers and market integrity. ASIC will only grant or vary an AFSL if it has no reason to believe that key personnel are not fit and proper to perform their roles.

Who is considered a controller under the Corporations Act?

A controller under the Corporations Act 2001 (Cth) is defined as a person or entity with the capacity to cast more than half the votes at a general meeting, hold more than half the issued share capital, or control the board's composition. This also includes anyone with the capacity to determine the outcome of decisions about the company's financial and operating policies. Even silent investors may be deemed controllers and become subject to the fit and proper person test.

What documents are required for People Proofs?

The mandatory documents required for People Proofs include a completed Statement of Personal Information, a national criminal history check, and a bankruptcy check. These must be provided for each person subject to the fit and proper person test, such as a responsible manager or director, as part of the AFSL application.

How long are criminal history checks valid for?

Both national criminal history checks and bankruptcy checks submitted as part of an AFSL application must be less than 12 months old at the time of submission to ASIC.

Can an AFSL be cancelled if I fail the test?

Yes, under Section 915C of the Corporations Act 2001 (Cth), ASIC has the power to suspend or cancel an existing AFSL if a licensee, officer, or controller ceases to meet the fit and proper person test. This demonstrates that the fit and proper person test is an ongoing obligation for every AFSL holder.

What is the efficiently, honestly & fairly standard?

The "efficiently, honestly and fairly" standard is a core obligation for an AFSL holder under Section 912A of the Corporations Act 2001 (Cth). It is a composite, principles-based obligation that ASIC uses to scrutinise how a person performs and operates their financial services business over time.

Do ongoing compliance obligations apply after the licence is granted?

Yes, the fit and proper person test is an ongoing requirement that applies for the entire time an AFSL is held, not just during the initial application. AFSL holders must conduct regular assessments, such as annual checks, to ensure their senior managers and other key personnel continue to meet the standard.

What happens if a responsible manager hides past misconduct?

Providing false or misleading information to ASIC, such as a responsible manager hiding past misconduct, is an offence under the Corporations Act 2001 (Cth). This action will almost certainly lead to the refusal of a licence application or the suspension or cancellation of an existing AFSL.

How does ASIC administer the fit & proper test?

ASIC administers the fit and proper person test through the AFSL application process on its Regulatory Portal, where it collects and assesses the required People Proofs. Each individual is evaluated against key criteria, including integrity, competence, financial standing, legal compliance, and conflict of interest management.

Who Should Be Your AML/CTF Senior Manager? What the Law Actually Requires (2026)

Hannah Deuk — Tue, 23 Jun 2026 05:31:48 +0000

Reforms to the AML/CTF Act that took effect on 31 March 2026 established specific governance requirements for reporting entities. Under this framework, businesses must appoint an AML/CTF senior manager who holds personal, non-delegable obligations to approve risk assessments and compliance policies.

With the 1 July 2026 deadline approaching for newly regulated Tranche 2 entities, understanding the statutory definition of this role is a regulatory priority. This article explains the legal requirements for selecting a senior manager so reporting entities can meet AUSTRAC expectations and manage money laundering and terrorism financing risks.

Interactive Tool: See If Your Senior Manager Meets the Legal Requirements

AML/CTF Senior Manager Eligibility Checker

Quickly check if your nominated AML/CTF senior manager meets the legal requirements under the latest reforms.

Question 1 of 3: Is your business a reporting entity under the AML/CTF Act (including Tranche 2 sectors from 1 July 2026)?

Question 2 of 3: Does your nominated senior manager have genuine authority to make or participate in decisions affecting the whole, or a substantial part, of your business?

Question 3 of 3: Is your nominated senior manager able to personally approve AML/CTF risk assessments, policies, and high-risk customer relationships (without delegating these obligations)?

✅ Your Senior Manager Meets the Statutory Test

Your nominated senior manager appears to satisfy the functional test under Section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). They have genuine decision-making authority and will personally fulfil all non-delegable AML/CTF obligations, including approving risk assessments and high-risk customer relationships.

Ensure you maintain detailed records of their appointment, responsibilities, and qualification reasoning as required by Section 116 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).

Legal References:

Section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Section 26P of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Section 116 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Get AML/CTF Legal Advice

❌ Not a Reporting Entity – No Senior Manager Required

Based on your answer, your business is not currently a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). You are not required to appoint an AML/CTF senior manager at this time.

If your business activities change or you become captured under Tranche 2 reforms, revisit your obligations promptly.

Legal References:

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer about AML/CTF obligations

⚠️ Senior Manager Lacks Sufficient Authority

Your nominated senior manager does not meet the statutory definition in Section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) because they lack genuine decision-making power over the business. AUSTRAC expects the senior manager to have real authority to make or influence strategic or operational decisions.

Appointing someone without this authority risks non-compliance and regulatory action.

Legal References:

Section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

AUSTRAC Guidance (2026)

Speak to a Lawyer about AML/CTF Governance

❌ Senior Manager Cannot Delegate Obligations

The senior manager must personally approve your AML/CTF risk assessment, policies, and high-risk customer relationships under Section 26P of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Delegating or ‘rubber-stamping’ these obligations is not permitted and may result in regulatory breaches or penalties.

Legal References:

Section 26P of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

AUSTRAC Guidance (2026)

Get Legal Advice on AML/CTF Role Compliance

The Three-Role Governance Framework for Reporting Entities

Identifying the Three Distinct Governance Roles

Every reporting entity must establish a clear governance structure to protect their business from criminal misuse and maintain compliance with anti-money laundering and counter-terrorism financing laws, a process often managed with guidance from specialist AML/CTF compliance lawyers.

The three mandatory roles are as follows:

Governing body: This is the board of directors or an equivalent body. It holds the primary responsibility for the entity’s governance and executive decisions, providing oversight of AML/CTF compliance at the highest level.
Senior manager: This individual is responsible for approving the AML/CTF program and making key compliance decisions. Unlike other roles, a senior manager’s functions under the AML/CTF Act involve directly and personally meeting specific obligations.
AML/CTF compliance officer: This officer handles the day-to-day management of the AML/CTF program, ensuring that all policies and procedures are correctly implemented throughout the business.

A critical distinction exists between these roles. The governing body and the AML/CTF compliance officer generally oversee compliance, whereas the senior manager must personally approve critical components like risk assessments and AML/CTF policies.

Applying Governance Flexibility for Smaller Businesses

While the governance framework requires three separate functions, it allows for flexibility depending on the size and structure of the reporting entity. The roles are typically held by different people to ensure a separation of duties.

In smaller businesses, it is permissible for one person to take on multiple governance responsibilities. For instance, a sole trader can act as the governing body, senior manager, and AML/CTF compliance officer simultaneously. Ultimately, this flexibility ensures that smaller reporting entities can meet their obligations without needing a large corporate structure.

The Statutory Definition of a Senior Manager

Decision-Making Authority Over Job Title

Under Section 5 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), a senior manager is defined as “an individual who makes, or participates in making, decisions that affect the whole, or a substantial part, of the business of the reporting entity.” This definition establishes a functional test, meaning the role is determined by a person’s actual authority rather than their corporate title.

AUSTRAC guidance clarifies that the key factor is the individual’s ability to make or influence strategic or operational decisions. Furthermore, these decisions do not need to be related to anti-money laundering and counter-terrorism financing, and a person does not need to be a C-suite executive to qualify.

Depending on the business structure, a senior manager could be:

A business owner or director;
A general manager; or
A money laundering reporting officer who holds a leadership position.

Appointing External Personnel as Senior Managers

The definition of a senior manager in Section 5 of the AML/CTF Act refers to “an individual” without stipulating that they must be an employee of the reporting entity. This wording provides flexibility, particularly for smaller businesses or newly regulated entities building their governance frameworks.

As a result, a reporting entity can appoint external personnel to the role, provided that person has genuine decision-making authority over the business. Ultimately, the focus remains on the function the person performs rather than their employment relationship with the entity.

Does Your Senior Manager Have to Be an Employee?

No, a senior manager does not have to be an employee. As established by the functional test, the role is defined by authority rather than employment status.

This flexibility allows smaller reporting entities, including those captured under the Tranche 2 reforms, to appoint an external individual with the appropriate seniority. For such an appointment to be compliant, two conditions must be met:

The individual must genuinely possess the required decision-making authority over the whole or a substantial part of the business.
The individual must be able to personally fulfil the non-delegable statutory obligations associated with the senior manager role.

Can Your Senior Manager Be Based Offshore?

Yes, but only if they hold genuine corporate power over the Australian entity.

Because the statutory definition under Section 5 of the AML/CTF Act is purely functional, an individual residing overseas can legally fill the role if they make or influence strategic decisions affecting a substantial part of the local business. For example, a foreign director or a global head of risk within a multinational corporate structure may qualify.

However, local businesses and newly regulated Tranche 2 entities cannot simply contract an offshore compliance consultant or virtual assistant to act as their Senior Manager. If that overseas individual does not hold direct operational decision-making authority over the core Australian business, the appointment fails AUSTRAC’s statutory test.

The Non-Delegable Obligations of Your Senior Manager

A senior manager’s responsibilities under the anti-money laundering and counter-terrorism financing framework are personal and direct. Consequently, these obligations cannot be delegated to a compliance officer or any other personnel within the reporting entity.

Approving the Risk Assessment & AML/CTF Policies Including Any Updates

Under Section 26P of the AML/CTF Act, a senior manager must personally approve the reporting entity’s ML/TF risk assessment and all AML/CTF policies. This responsibility also extends to any subsequent updates or amendments to these documents. Furthermore, Section 26P(2) requires that any updates to the ML/TF risk assessment are notified in writing to the governing body as soon as practicable.

Approving or Being Informed of Certain Customer Relationships Before Entry

Your AML/CTF policies must specify which types of business relationships require a senior manager to either approve them or be informed about them before the relationship is established. Ultimately, this ensures there is appropriate oversight at a senior level for customer engagements that may present a higher risk.

Approving Third-Party CDD Arrangements

If your reporting entity plans to use a third party to handle aspects of customer due diligence (CDD), a senior manager must approve this arrangement. This includes giving approval for any written agreement with a third party that will be responsible for collecting and verifying CDD information on your behalf.

Approving High-Risk Customer Onboarding

Senior manager approval is mandatory before providing any designated service to a high-risk customer. This requirement applies specifically when your business has reasonable grounds to believe a customer, beneficial owner, or agent is a:

Foreign politically exposed person (PEP);
High-risk domestic PEP; or
High-risk international organisation PEP.

In addition, this obligation applies if an existing customer is later identified as falling into one of these high-risk PEP categories. In such cases, senior manager approval must be obtained before continuing to provide designated services.

Approving Any Other Circumstances Specified in Your Policies

A senior manager must provide approval for any other situations outlined in your entity’s AML/CTF policies. For example, this includes giving approval before your business provides a designated service to a customer in a nested services relationship. Therefore, your policies must clearly identify any additional circumstances that require senior manager approval and specify which senior manager is authorised to provide it.

Appointing Multiple Senior Managers for Your Reporting Entity

Allocating Specific Tasks Among Multiple Managers

A reporting entity has the flexibility to appoint more than one senior manager to fulfil its anti-money laundering and counter-terrorism financing obligations. This approach allows a business to distribute the personal and non-delegable responsibilities of the role across different individuals who hold the necessary decision-making authority.

According to AUSTRAC guidance, specific tasks can be assigned to different senior managers, such as:

Approving the AML/CTF program: one senior manager could be responsible for the program and its associated risk assessment; and
Approving high-risk customer relationships: another could be tasked with approving these relationships before they are established.

Ultimately, this division of labour can be particularly useful in larger or more complex organisations where different senior personnel oversee distinct operational areas.

Documenting the Division of Responsibilities

When a reporting entity chooses to appoint multiple senior managers, it is essential to clearly document the division of their responsibilities. This ensures there is no ambiguity about who is accountable for each specific obligation, creating a clear framework for governance and oversight.

Your AML/CTF policies must identify which senior manager is responsible for each designated task, as this documentation is a key component of demonstrating compliance to AUSTRAC. Specifically, records should clearly state the name of each appointed senior manager and specify their individual AML/CTF responsibilities.

This level of detail ensures that all statutory obligations are covered and that there is a clear audit trail for any approvals or decisions made.

AUSTRAC Record-Keeping Expectations for Reporting Entities

Documenting Senior Manager Appointments & Responsibilities

Under Section 116(1) of the AML/CTF Act, reporting entities must maintain records that are reasonably necessary to demonstrate compliance with their obligations. To meet AUSTRAC’s expectations, your documentation must clearly show how your senior managers have fulfilled their responsibilities.

Your records should include the following details for each appointed senior manager:

Name and responsibilities: The person’s full name and their specific AML/CTF responsibilities.
Appointment date: The date they were appointed to the senior manager role.
Qualification reasons: The reasons the individual qualifies as a senior manager, detailing the aspects of their role that give them authority to make or influence decisions affecting a substantial part of your business.

These records are a critical part of your governance framework and provide the evidence AUSTRAC will review to assess your compliance. Furthermore, according to Section 116(3), these records must be retained for seven years.

Recording Customer Escalations & Approvals

In addition to documenting appointments, reporting entities must keep detailed records of any business relationships that require senior manager approval. Consequently, this creates a clear audit trail demonstrating that high-risk decisions receive appropriate oversight.

When a customer relationship is escalated for approval, your records must show:

Customer details: The name of the customer and the specific reasons for the escalation.
Authorised manager: The name and role of the senior manager who was authorised to approve the relationship.
Decision particulars: The date the decision was made and the reasoning behind the approval or denial.

A practical way to manage approvals for documents like the risk assessment and AML/CTF policies is to use version control. This process can record key details such as the approval date, the name of the approver, the document version, and the next scheduled review date.

Common Mistakes to Avoid

Appointing the Wrong Person

A frequent error is selecting a senior manager based on their job title rather than their actual authority. As outlined earlier, Section 5 of the AML/CTF Act relies on a functional test.

Appointing someone who lacks genuine strategic or operational decision-making power fails this statutory requirement. As long as they meet the functional definition, your appointed senior manager could be:

A business owner;
A general manager; or
A money laundering reporting officer with a leadership role.

Treating Approval as a Formality

As established under Section 26P, the obligations of a senior manager are personal and cannot be delegated. A common mistake is for the appointed individual to treat their approval responsibilities as a simple sign-off or “rubber-stamping” exercise without genuine consideration.

A senior manager must personally engage with and approve critical elements—including the risk assessment, policies, and high-risk customer relationships—to ensure the reporting entity’s framework is robust and effective, a standard formally tested through independent AML/CTF program reviews. Ultimately, a failure to genuinely review these documents undermines the entire governance structure.

Failing to Update When Things Change

Your governance framework is not a static document, and it must adapt to changes within your business. Reporting entities sometimes fail to update their senior manager appointments and related policies when significant changes occur.

These events can include:

Changes in key personnel;
Corporate restructures; and
Shifts in the business model or services offered.

Your policies and records must always reflect the current position of your business. If a person’s role changes and they no longer meet the functional definition of a senior manager, your documentation must be updated to appoint a new individual who does.

Not Recording the Reasoning

Simply naming a senior manager in your AML/CTF program is not enough to demonstrate compliance. As required by AUSTRAC’s record-keeping expectations, your documentation must explicitly detail the reasoning behind their qualification for the role.

Failing to record how their authority satisfies the functional test means you cannot prove to AUSTRAC that your appointment satisfies the legal requirements.

What This Means for Tranche 2 Entities

Establishing Your Governance Framework Before July 2026

For businesses newly captured by the Tranche 2 reforms, such as those in the legal, accounting, and real estate sectors, AUSTRAC expects a complete compliance framework to be in place by the 1 July 2026 commencement date.

To meet these regulatory expectations, your business must take several preparatory steps. Key actions to complete before the deadline include:

Enrolling as a reporting entity with AUSTRAC, a process that opened on 31 March 2026.
Developing and implementing a comprehensive AML/CTF program tailored to your specific money laundering and terrorism financing risks.
Appointing a qualified AML/CTF compliance officer to manage day-to-day compliance.
Identifying and formally appointing a senior manager who has the authority to approve your risk assessment and AML/CTF policies.
Training all relevant personnel on their obligations under the new framework and your internal processes.

Managing ML/TF Risks as a Regulatory Priority

AUSTRAC has clearly stated that a failure to manage money laundering and terrorism financing risks is a serious regulatory concern. As a result, newly regulated entities are expected to proactively establish robust systems and controls rather than attempting to retrofit compliance measures after the deadline.

Building your compliance structure correctly from the beginning is more effective than addressing deficiencies during a regulatory review. After the commencement date, AUSTRAC will prioritise enforcement action against any entity that wilfully ignores its obligation to enrol or is found to be complicit with financial crime.

Conclusion

Correctly appointing an AML/CTF senior manager based on their genuine decision-making authority is a critical governance obligation for every reporting entity. Fulfilling the role’s personal, non-delegable responsibilities and maintaining detailed records are essential for demonstrating compliance to AUSTRAC, particularly for Tranche 2 entities approaching the 1 July 2026 deadline.

If you need assistance establishing your governance framework or preparing your AML/CTF program, you can contact our AML/CTF compliance lawyers at Click Legal for specialist advice.

Frequently Asked Questions

Can a small business owner act as the governing body, senior manager, and compliance officer?

Yes, one person may hold multiple governance roles in smaller businesses or sole trader operations. While these responsibilities are typically held by different people in larger organisations, AUSTRAC guidance allows for this flexibility to suit the scale of the business.

Does the senior manager have to be a C-suite executive?

No, a person does not need to be a C-suite executive to be a senior manager. The role is defined by an individual’s authority to make or participate in making strategic or operational decisions that affect the whole or a substantial part of the business, not by their job title.

Can a senior manager delegate their AML/CTF approval obligations to a compliance team?

No, a senior manager must personally fulfil their obligations under the AML/CTF Act. Key responsibilities, such as approving the AML/CTF program, risk assessments, and high-risk customer relationships, cannot be delegated.

What records must be kept regarding the appointment of a senior manager?

A reporting entity must keep records that show the name of each senior manager, their date of appointment, and their specific AML/CTF responsibilities. The records must also explain the reasons the individual qualifies for the role, detailing their authority to make decisions affecting the business.

Is it permissible to have more than one senior manager for a reporting entity?

Yes, a reporting entity can appoint multiple senior managers. When this approach is taken, specific obligations can be allocated among them, and these responsibilities must be clearly documented in the AML/CTF program.

When must newly regulated Tranche 2 entities have their governance framework in place?

Newly regulated entities, often referred to as Tranche 2 entities, must have their complete AML/CTF program, including the appointment of a senior manager and a documented governance framework, established by 1 July 2026.

How long must a reporting entity retain records of senior manager approvals?

Under Section 116 of the AML/CTF Act, reporting entities are required to retain records that demonstrate compliance, including senior manager approvals, for a period of seven years.

What happens if an existing customer becomes a politically exposed person?

If an existing customer is identified as a PEP or a high-risk domestic PEP, the reporting entity must obtain senior manager approval before continuing to provide them with designated services.

Must the senior manager approve third-party customer due diligence arrangements?

Yes, a senior manager must approve any written agreement or arrangement with a third party to collect and verify CDD information. This approval is required before the arrangement is entered into.

Understanding Simplified Customer Due Diligence for AML Compliance

Hannah Deuk — Sat, 13 Jun 2026 14:08:48 +0000

Introduction

Reforms under the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) (‘AML/CTF Amendment Act‘), which commenced on 31 March 2026, introduced new customer due diligence requirements in Australia. Managing money laundering and terrorism financing risks remains a core obligation for reporting entities when they provide a designated service. Simplified customer due diligence allows them to simplify their customer identification procedures for low-risk customers, reducing compliance burdens while maintaining market integrity.

This article explains simplified customer due diligence for reporting entities so you can appropriately manage low customer risk. It outlines the specific conditions for applying these measures, practical examples for initial customer due diligence and ongoing customer due diligence, and how to integrate these procedures into your anti-money laundering and counter-terrorism financing policies.

Interactive Tool: See If You Qualify for Simplified Customer Due Diligence

Simplified Customer Due Diligence Eligibility Checker

Quickly determine if you can apply simplified customer due diligence (CDD) for AML/CTF compliance under the latest Australian law.

Is your customer assessed as low risk for money laundering or terrorism financing (ML/TF)?

Are any triggers for enhanced customer due diligence (CDD) present?

Is the customer a trust, body corporate, or strata title association?

✅ Eligible for Simplified CDD

You may apply simplified customer due diligence under Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) and Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth). Ensure your AML/CTF policies document the basis for low-risk classification and ongoing monitoring.

Note: You must continue to collect and verify appropriate KYC information and reassess risk if circumstances change.

Legislative References:

Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth)
Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth)

Get AML/CTF Compliance Advice

✅ Simplified CDD & Beneficial Owner Exception

You may apply simplified customer due diligence and, if your customer is a regulated entity or strata title association, you are not required to identify beneficial owners under the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth). Ensure you have documented the low-risk status and that no enhanced CDD triggers apply.

Legislative References:

Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth)

Speak to an AML/CTF Lawyer

❌ Enhanced CDD Required

You cannot use simplified customer due diligence because at least one trigger for enhanced CDD applies (e.g., foreign PEP, high-risk jurisdiction, or suspicious activity). You must follow the enhanced due diligence process under Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth).

Legislative References:

Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth)

Get Enhanced Due Diligence Guidance

⚠️ Not Eligible for Simplified CDD

You cannot use simplified customer due diligence because the customer is not objectively assessed as low risk. You must apply standard or enhanced CDD as required by Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth).

Legislative References:

Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth)

Review Your AML/CTF Risk Assessment

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

What is Simplified Customer Due Diligence for Reporting Entities?

The Purpose of Streamlined Identification & Verification

Simplified customer due diligence (simplified CDD) allows reporting entities to streamline the customer identification and verification process for certain low-risk customers. Ultimately, it is a proportionate, risk-based approach to managing low money laundering and terrorism financing (ML/TF) risks. This framework enables reporting entities to adjust their customer due diligence measures to match the lower risk profile of a particular customer.

The primary purpose is to reduce the compliance burden in situations where the potential for money laundering or terrorism financing is minimal. Instead of applying the full scope of initial customer due diligence, a reporting entity can use more streamlined methods, including:

Reducing the amount of evidence required for identity verification; or
Not seeking specific information on the nature and purpose of the business relationship, if it can be inferred from the service being provided.

How Simplified Measures Differ from Exemptions

Applying simplified CDD is not an exemption from anti-money laundering and counter-terrorism financing obligations. Therefore, reporting entities must still conduct both initial and ongoing customer due diligence. The “simplified” aspect refers to the methods used, not the removal of the core requirement.

Even under this approach, reporting entities must collect all required know your customer (KYC) information. They also need to verify enough of that information to be satisfied on reasonable grounds about the customer’s identity and their ML/TF risk. Consequently, the fundamental CDD obligation to KYC remains, ensuring that even low-risk customers are properly identified and understood.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

When Reporting Entities Can Apply Simplified Measures

Assessing Low Money Laundering & Terrorism Financing Risk

Reporting entities can apply simplified CDD measures only when a customer presents a low ML/TF risk. This assessment must be based on an objective evaluation of the KYC information that is reasonably available before providing a designated service. Furthermore, your AML/CTF compliance policies must outline how you will apply these simplified measures.

Under Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) (‘AML/CTF Rules‘), this involves:

Identifying the customer’s ML/TF risk based on KYC information available before the service begins;
Collecting KYC information that is appropriate for that low-risk profile; and
Ensuring there are no reasonable grounds to doubt the accuracy of the information collected.

The decision to classify a customer as low-risk must be defensible and documented as part of your customer due diligence obligations.

Ensuring Enhanced Due Diligence Triggers Do Not Apply

Simplified CDD is not permissible if any circumstances requiring enhanced customer due diligence (enhanced CDD) are present. Even if a customer initially appears to have a low ML/TF risk, the presence of a single trigger for enhanced CDD means simplified measures cannot be used. Therefore, reporting entities must ensure their customer risk assessment process screens for these triggers.

Triggers that mandate the application of enhanced CDD include situations where:

The customer or their beneficial owner is identified as a foreign politically exposed person (PEP);
A transaction involves a high-risk jurisdiction as identified by the Financial Action Task Force (FATF);
There is a suspicion of money laundering, terrorism financing, or identity fraud; or
The designated service is part of a nested services relationship.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Practical Examples of Simplified Measures for Reporting Entities

Streamlining Initial Identification & Verification

When reporting entities determine a customer poses a low ML/TF risk, they can apply simplified CDD measures during the initial onboarding phase. This approach allows for a more streamlined process for collecting and verifying KYC information.

Practical examples of simplified measures during initial identification include:

Reduced evidence for identity verification: Reporting entities may require less documentation to verify a customer’s identity based on the assessment that the customer is low risk.
Inferring the purpose of the business relationship: It may not be necessary to explicitly ask for information on the nature and purpose of the business relationship, as this can often be understood from the type of designated service being provided and other details collected during onboarding.

Adjusting Ongoing Monitoring & Re-verification

Simplified CDD measures can also be applied to ongoing customer due diligence, provided the customer’s risk profile remains low. This allows reporting entities to adjust their monitoring and review processes to be proportionate to the identified risk.

For low-risk customers, ongoing monitoring can be modified in several ways:

Less frequent re-verification of KYC information: The schedule for re-verifying a customer’s identity and other KYC information can be extended to reflect the lower risk associated with the customer relationship.
Different thresholds for transaction monitoring alerts: Automated transaction monitoring systems can be calibrated with different thresholds, meaning alerts for review might be triggered by higher transaction values or different patterns of activity than those set for medium or high-risk customers.

However, if a low-risk customer’s behaviour changes or their transactions become unusual, reporting entities must reassess their ML/TF risk. If the risk level increases, simplified measures will no longer be appropriate, and standard or enhanced CDD must be applied.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Simplified Verification Rules for Complex Customer Types

Establishing Matters for Trusts & Bodies Corporate

Under simplified CDD, reporting entities can streamline how they establish key information for low-risk customers that are trusts or bodies corporate.

According to Rule 6-17, a reporting entity is considered to have established the identity of certain individuals without needing to formally verify their details, including:

Representatives: any person acting on behalf of the customer;
Service recipients: any person receiving designated services on behalf of the customer; and
Beneficial owners: the beneficial owner of the customer.

This simplified verification is permitted only when the previously outlined conditions are met—namely, the customer maintains a low risk profile, appropriate KYC information has been collected, and there are no reasonable grounds to doubt its accuracy.

Exceptions for Regulated Entities & Strata Title Associations

Specific exceptions exist that remove the need to identify the beneficial owners of certain low-risk customers. These exceptions apply when the customer is a complex entity but is subject to other forms of oversight or has a very low risk profile.

Under AML/CTF Rules, reporting entities are not required to check for a beneficial owner if the customer has a low ML/TF risk and is controlled by one of the following:

Regulated entities: an entity that is subject to regulatory oversight by a prudential, insurance, or investor protection regulator; or
Homeowner associations: a corporation or association of homeowners in a strata title or community title scheme.

If these conditions are satisfied, the reporting entity is also taken to have established whether any beneficial owner is a politically exposed person (PEP) or is designated for targeted financial sanctions. Ultimately, this exception significantly reduces the customer due diligence burden for these specific low-risk customer types.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Integrating Simplified Measures into AML & CTF Policies

Documenting Low-Risk Customer Profiles & Procedures

Reporting entities must ensure their anti-money laundering and counter-terrorism financing policies explicitly detail how and when simplified CDD will be applied. These policies are a legal requirement and form the foundation of a compliant, risk-based approach that is subject to independent AML/CTF program reviews & evaluations. Furthermore, they must provide clear guidance for staff to follow consistently.

Your policies should clearly define:

Low-risk customer types: Specify the characteristics of customers that your business considers to be low ML/TF risk.
Eligible products and services: Identify which of your designated services are considered low-risk and therefore eligible for simplified CDD measures.
Information to be collected and verified: Outline the specific KYC information that must be gathered and checked for these low-risk profiles.
Ongoing checks: Describe the procedures for ensuring the simplified CDD approach remains appropriate for the customer over time.

Transitioning to Enhanced Measures if Risk Levels Change

Your anti-money laundering and counter-terrorism financing policies must also include procedures for ongoing customer due diligence, even for customers who initially qualify for simplified CDD. A customer’s risk profile is not static and can change based on their behaviour or transaction patterns. Therefore, the policies must outline a clear process for monitoring and reassessing customer risk.

If a customer’s behaviour changes or suspicious activity occurs, you must reassess their ML/TF risk. As a result, your policies must detail the steps to take if a customer’s risk level increases. This includes transitioning from simplified CDD to standard or enhanced CDD to ensure you continue to manage and mitigate the identified risk appropriately.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

Simplified customer due diligence allows reporting entities to streamline identification procedures for low-risk customers, reducing compliance burdens without compromising core anti-money laundering and counter-terrorism financing obligations. This risk-based approach requires a clear assessment of low customer risk, the absence of enhanced due diligence triggers, and documented procedures within your AML/CTF policies.

Ensuring your anti-money laundering and counter-terrorism financing policies correctly implement these measures is vital for compliance. If you need assistance navigating your customer due diligence requirements, contact our AML/CTF compliance lawyers at Click Legal today to discuss how we can support your business.

Frequently Asked Questions

What is simplified customer due diligence?

Simplified customer due diligence allows reporting entities to streamline the customer identification and verification process for certain low-risk customers. It is a proportionate, risk-based approach to managing low ML/TF risks.

Is simplified customer due diligence an exemption from compliance?

No, simplified customer due diligence is not an exemption from your compliance obligations. Reporting entities must still collect required KYC information and verify enough data to establish required matters on reasonable grounds and identify the customer’s risk.

When can reporting entities apply simplified customer due diligence?

Reporting entities can apply simplified customer due diligence measures when the ML/TF risk of the customer is low and none of the triggers for enhanced customer due diligence apply. Your anti-money laundering and counter-terrorism financing policies must also set out how these simplified measures will be applied.

Can simplified measures be used during ongoing customer due diligence?

Yes, appropriate simplified customer due diligence measures may be used during both initial and ongoing customer due diligence. This is permitted provided the customer’s risk remains low and no triggers for enhanced customer due diligence apply.

What are examples of simplified customer due diligence measures?

Examples of simplified customer due diligence measures include using reduced evidence for identity verification and not seeking information on the nature and purpose of the business relationship if it can be inferred. Reporting entities may also implement less frequent re-verification of KYC information or use different thresholds for transaction monitoring alerts.

How does simplified customer due diligence apply to trusts & bodies corporate?

For trusts and bodies corporate with a low ML/TF risk, you are taken to have established the identity of beneficial owners and persons acting on behalf of the customer without needing to verify their details. This simplified verification applies under the AML/CTF Rules if you have collected the appropriate KYC information and have no reasonable grounds to doubt it.

Do reporting entities need to identify beneficial owners for low-risk strata title associations?

No, reporting entities do not need to identify the beneficial owners of a low-risk customer if that customer is controlled by a corporation or association of homeowners in a strata title or community title scheme. This exception is provided under AML/CTF Rules.

What must be included in AML & CTF policies regarding simplified measures?

Your anti-money laundering and counter-terrorism financing policies must clearly explain how and when simplified customer due diligence measures will be applied. The policies should set out the types of customers, products, or services considered low risk, the specific information to be collected and verified, and the checks you will perform to ensure the approach remains appropriate.

What happens if a low-risk customer changes their behaviour?

If a low-risk customer’s behaviour changes or suspicious activity occurs, you must reassess their ML/TF risk level. If the customer’s risk increases, you must transition from simplified measures and apply enhanced customer due diligence.

Understanding Initial Customer Due Diligence for AML Compliance

Hannah Deuk — Sat, 13 Jun 2026 14:03:22 +0000

Introduction

Initial customer due diligence is a mandatory process for Australian reporting entities to identify a customer and assess their customer risk before they provide a designated service. Under the upcoming anti-money laundering and counter-terrorism financing reforms commencing on 1 July 2026, businesses must transition to an outcomes-based framework to establish identity, screen any politically exposed person, and mitigate risks to meet AUSTRAC requirements.

This article explains initial CDD obligations for reporting entities so you can collect and verify know your customer (KYC) information properly. It outlines how to complete initial CDD, identify a beneficial owner, and understand when you can delay initial CDD or apply simplified customer due diligence before starting a business relationship.

Interactive Tool: Check Your Initial Customer Due Diligence & AML Compliance

AML/CTF Initial Customer Due Diligence Checker

Quickly assess if your business is meeting its initial customer due diligence (CDD) obligations under the new AML/CTF regime.

Are you providing a ‘designated service’ as defined under the AML/CTF Act?

Have you collected and verified KYC information for all customers and beneficial owners?

Have you screened customers and beneficial owners for Politically Exposed Persons (PEPs) and targeted financial sanctions?

Do you have documented records demonstrating how you established customer identity and risk rating on reasonable grounds?

⚖️ Not a Reporting Entity (Confirm Status)

Based on your answers, you may not be a ‘reporting entity’ under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). However, it is critical to confirm your status as definitions are broad and penalties for non-compliance are significant.

Seek legal advice to ensure your business is not inadvertently exposed.

Reference: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer about your AML/CTF obligations

✅ CDD Obligations Likely Met

You appear to have met your initial customer due diligence obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Continue to monitor for changes in customer risk, keep records for seven years, and ensure ongoing compliance with AUSTRAC requirements.

For tailored advice or independent review, consult our AML/CTF compliance lawyers.

Reference: Section 111 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Get AML/CTF Legal Advice

⚠️ Critical Gaps in CDD Compliance

Your process is missing key steps required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), such as collecting and verifying KYC information or screening for PEPs and sanctions. You must not provide designated services until these are complete.

Failure to comply can result in significant civil penalties and regulatory action by AUSTRAC.

Reference: Section 32 and Section 39 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer to address your CDD gaps

❌ Record Keeping Deficiency

You are not maintaining adequate records as required by Section 111 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). This is a direct civil penalty provision and exposes your business to enforcement action.

Immediate remediation is recommended to avoid penalties.

Reference: Section 111 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Get Legal Help to fix your AML/CTF record keeping

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

What is Initial Customer Due Diligence for Australian Reporting Entities?

The Core Purpose of Initial CDD

Initial customer due diligence (CDD) is the process reporting entities must use to understand who their customers are before providing them with a designated service. This process forms the foundation of your anti-money laundering and counter-terrorism financing (AML/CTF) obligations and continues throughout the business relationship.

The core purpose of initial CDD is to act as a critical safeguard for your business. It serves three main functions:

Establishing identity: It helps you confirm who your customers are, who they might be acting on behalf of, and whether there are any legal reasons you cannot provide the requested service.
Assessing risk: It allows you to identify and assess the money laundering and terrorism financing (ML/TF) risks involved in providing a designated service to a particular customer. This helps you determine if a customer’s risk profile is too high for your business or if you can implement controls to manage the risks.
Gathering information for reporting: It ensures you collect the necessary KYC information to make required reports to AUSTRAC. These reports are vital for law enforcement and national security investigations.

Transitioning from ACIP to the New AML Framework

Australia’s AML/CTF regime is transitioning from the previous framework of Applicable Customer Identification Procedures (ACIP), which was outlined in the AML/CTF Rules (‘Rules’). The new requirements for CDD are now established directly within the amended Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act’).

This shift introduces an outcomes-based framework, which focuses on the effectiveness of the CDD measures a business takes—often tested through independent AML/CTF program reviews—rather than simple procedural compliance. Furthermore, a significant terminology change is the replacement of ‘ACIP’ with the phrase “collection and verification of KYC information”.

For some businesses, a transitional period is in place as follows:

Eligible entities: Reporting entities that were enrolled with AUSTRAC on 30 March 2026 and had compliant ACIP in their AML/CTF program may be able to continue using those procedures.
Applicable timeframe: This transitional period runs from 31 March 2026 to 31 March 2029.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Key Matters to Establish Before Providing Designated Services

Identifying the Customer & Beneficial Owners

Before providing a designated service, reporting entities must establish the identity of the customer on reasonable grounds. This CDD obligation extends to identifying any person acting on behalf of the customer and any individual on whose behalf the customer is receiving the service, such as a trust beneficiary.

For non-individual customers like companies or trusts, you must also identify any beneficial owners. A beneficial owner is an individual who ultimately owns or controls the customer, including anyone who:

Directly or indirectly owns 25% or more of the customer; or
Otherwise exercises control over the customer’s finances or operations.

Identifying the ultimate beneficial owner can require looking through multiple layers of ownership. For instance, if your customer is a company owned by another company, you must follow the chain of ownership until you identify the individual or individuals who ultimately own or control it. Once identified, you must collect and verify their KYC information to establish their identity.

Screening for Politically Exposed Persons & Targeted Financial Sanctions

A critical step in CDD is determining whether the customer or their beneficial owner is a politically exposed person (PEP) or is subject to targeted financial sanctions. This screening must be completed before you provide a designated service. A PEP is an individual who holds a prominent public position, along with their immediate family and close associates, who may pose a higher risk for financial crimes.

You are also required to check if the customer, any beneficial owners, or anyone acting on their behalf is named on a targeted financial sanctions list. Australian sanctions law prohibits dealing with designated individuals or entities, which includes a ban on making assets available to them, either directly or indirectly. You can check the consolidated list published by the Department of Foreign Affairs and Trade to meet this obligation.

Understanding the Nature & Purpose of the Business Relationship

Reporting entities must collect information to understand the nature and purpose of the business relationship or occasional transaction. This involves asking why the customer is seeking your services, which helps to establish a baseline of their normal or expected activity. Understanding this purpose is essential for identifying unusual or suspicious behaviour during ongoing CDD.

The information you gather will depend on the customer and the service, but it might include details about:

The intended use of the designated services.
The customer’s expected transaction frequency and volume.
Whether the services will be used for personal or business purposes.
The nature of an individual’s occupation or a company’s commercial activities.
The source of the customer’s wealth and the funds for the designated service.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

How to Collect & Verify KYC Information Effectively

Establishing Identity on Reasonable Grounds

When conducting CDD, you must establish a customer’s identity on “reasonable grounds.” This is an objective standard, meaning a reasonable person in your position would conclude that the customer’s identity is properly established based on the facts and information available at the time.

Your business must be able to explain how you reached this conclusion. Therefore, it is a requirement to keep records that demonstrate how each matter was established on reasonable grounds for every customer. This documentation should be clear enough that another person with similar training and knowledge would likely reach the same conclusion after reviewing the material.

Using Independent & Reliable Data Sources

Collecting and verifying KYC information are distinct but related processes. Collection involves gathering details directly from the customer, often through an onboarding form. In contrast, verification is the process of confirming that the collected information is accurate by checking it against reliable and independent data sources.

To verify KYC information, you can use a variety of sources, including:

Government records and official registers;
Trusted documents from reliable sources; and
Third-party digital identity services.

When using electronic or digital identity services, you must consider whether the data is reliable, independent, secure, and up-to-date. If you discover inconsistencies during verification, your AML/CTF policies should outline the steps to resolve them.

Resolving these inconsistencies may involve:

Using other independent data;
Contacting issuing authorities; or
Asking the customer for clarification and supporting evidence.

Ultimately, if you cannot resolve the discrepancies, you must not provide the designated service.

Applying Alternative Identification Procedures for Vulnerable Customers

Some individuals may face barriers to providing standard identification due to circumstances beyond their control. In these situations, you can use alternative identification procedures. This flexible approach is designed to support financial inclusion for vulnerable customers while still managing ML/TF risks.

Individuals who may require a flexible approach include those affected by:

Natural disasters.
Family and domestic violence.
Homelessness.
Recent migration or refugee status.
Living in remote areas.

When using alternative procedures, you must still take reasonable steps to be satisfied the person is who they claim to be. This involves assessing the customer’s ML/TF risk as low and implementing controls to mitigate any additional risks.

Alternative identification options can include:

Accepting a referee statement from a person in a position of trust;
Using recently expired identification; or
Relying on correspondence from a government authority.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Assessing Customer ML/TF Risk & Tailoring Your Approach

Assigning Customer Risk Ratings

As part of your CDD obligations, you must assess the ML/TF risk for each individual customer. This customer risk assessment is distinct from the broader ML/TF risk assessment for your entire business. Based on the KYC information collected, you must assign each customer a risk rating, such as low, medium, or high.

Your method for determining and recording these ratings must be documented in your AML/CTF program. Several factors influence a customer’s risk profile, including:

Customer type: Whether the customer is an individual, a company with a complex ownership structure, or a trust.
Designated services: The specific services the customer will use and the level of risk associated with them.
Delivery channels: How the customer interacts with your business, such as face-to-face, online, or through an agent.
Geographic factors: The countries involved in the business relationship, including where the customer is located or where funds will be sent.

For example, an Australian resident seeking a low-risk service locally would likely be rated as low risk. In contrast, a customer with a complex, multi-layered corporate structure or ties to high-risk jurisdictions would require a higher risk rating.

How Risk Ratings Influence CDD Measures

The customer risk rating you assign during initial CDD directly determines the level of due diligence required for that customer. Your AML/CTF policies must outline the specific measures you will take for each risk level to manage and mitigate ML/TF risks effectively, and if you need assistance structuring these, you can speak with our AML/CTF compliance program lawyers. Ultimately, this risk-based approach ensures your compliance efforts are proportionate to the identified risks.

A customer’s rating dictates which form of CDD is appropriate, as follows:

Low-risk customers: May qualify for simplified customer due diligence (SCDD), which allows for a more streamlined identification process.
Medium-risk customers: Will require standard initial CDD measures.
High-risk customers: Mandate the application of enhanced customer due diligence (ECDD), which involves taking extra steps to verify information and understand the customer’s circumstances.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Understanding When Your Business Can Delay Initial CDD

General Requirements for Delaying Verification

Reporting entities can only delay completing CDD in very limited situations. Before providing a designated service, you must determine on reasonable grounds that delaying the process is essential to avoid interrupting the ordinary course of business. Furthermore, you must establish that there is a low ML/TF risk in doing so.

Your AML/CTF policies must clearly outline the specific circumstances in which a delay is permissible. In addition, these policies should detail the procedures for managing and mitigating any risks that arise from the delay, such as how you would handle returning funds if the customer is later found to be outside your risk appetite. Ultimately, inconvenience for you or the customer is not a sufficient reason to delay initial CDD.

It may be considered essential to delay verification to avoid business interruption in situations such as:

Time-critical services where an exchange rate or interest rate must be locked in on the day of the request.
Allowing a customer to open an account online when their identity cannot be verified immediately.
Assisting customers in emergencies, like natural disasters or family violence, who do not have access to their identification documents.

Specific Scenarios Permitting Delayed Initial CDD

The AML/CTF Act and its associated Rules specify a few scenarios where you may begin providing a designated service before all initial CDD is complete. In all cases, the outstanding verification must be completed as soon as reasonably practicable within the required timeframes.

Permitted scenarios include:

Designated services in Australia: For most designated services provided in Australia, you may delay verifying certain KYC information. However, you must complete the full initial CDD process within 20 business days and before you transfer any money, property, or virtual assets on behalf of the customer.
Opening an account: A financial institution can open an account and allow deposits before completing initial CDD. Full verification must be completed within 20 business days and before any funds are made available to the customer.
Rapid financial market transactions: For certain transactions on a declared financial market that must be performed quickly, initial CDD must be completed within five business days of providing the service.
Real estate transactions: If you are a real estate agent, legal practitioner, or conveyancer, you may be able to delay initial CDD on the other party to the transaction. Verification must be completed by the earlier of 28 days after the contract exchange or at least three days before the agreed settlement day.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Record Keeping Requirements & Penalties for Non-Compliance

Maintaining Accurate CDD Records for Seven Years

Reporting entities must maintain clear, complete, and accurate records that demonstrate how they have complied with their CDD obligations for every customer. Under Section 111 of the AML/CTF Act, these records must be kept for seven years after the business relationship ends or seven years following the date of the last occasional transaction.

The records you are required to keep include:

Customer information: The data you collected and how you verified it.
Risk assessment process: The steps you followed to identify and assess the customer’s ML/TF risk.
Risk decisions: Any decisions made regarding the customer’s risk and the reasons behind them.
Review outcomes: Key outcomes from any reviews and monitoring activities conducted during initial CDD.

It is not a requirement to keep scanned copies or photocopies of identity documents. However, you must record the type and content of the data you collected.

Civil Penalty Provisions & Evasive Behaviour Offences

The amended AML/CTF Act makes initial CDD requirements subject to direct civil penalty provisions. As a result, AUSTRAC can take regulatory action for non-compliance.

Failing to meet your obligations can result in significant civil penalties, with actionable failures including:

Identity verification: Not identifying and verifying a customer’s identity before providing a designated service.
Sanctions screening: Failing to screen for PEPs and targeted financial sanctions.
Risk assessment: Neglecting to assess the ML/TF risk of a customer.
Record keeping: Not keeping adequate records of the initial due diligence and risk identification process.

In addition to regulatory penalties for reporting entities, there are criminal offences for customers who exhibit evasive behaviour. A person may commit an offence if they receive a designated service while:

Acting anonymously: Using a false name or acting anonymously.
Undisclosed aliases: Using one name without disclosing other names they are commonly known by.
Misleading information: Knowingly providing false or misleading information or documents.

If you have reasonable grounds to suspect a person has committed one of these offences, you must submit a suspicious matter report to AUSTRAC.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

CDD is a foundational AML/CTF obligation for reporting entities, requiring you to identify customers, beneficial owners, and assess their ML/TF risk before providing a designated service. This involves collecting and verifying KYC information, screening for high-risk individuals like PEPs, and keeping detailed records to comply with AUSTRAC requirements and avoid significant penalties.

Navigating the complexities of these CDD obligations requires careful planning and expert guidance to ensure your business is protected. If you need assistance with your AML/CTF program or require fractional general counsel support, contact our AML/CTF compliance lawyers at Click Legal today to ensure your compliance framework is robust and effective.

Frequently Asked Questions

What is the difference between initial CDD & ongoing CDD?

CDD must be completed before providing a designated service to establish a customer’s identity and assess their ML/TF risk. In contrast, ongoing CDD involves monitoring the customer’s transactions and behaviour throughout the business relationship to detect unusual patterns and ensure their activity aligns with their risk profile.

Can I rely on a third party to conduct initial CDD?

Yes, reporting entities can rely on a third party to conduct CDD, but your business remains fully responsible for ensuring compliance with all AML/CTF obligations. You must have reasonable grounds to believe you can obtain the collected KYC information from the third party immediately upon request.

What should I do if customer information is inconsistent?

If you identify inconsistencies in KYC information, your AML/CTF policies should guide your response, which may include verifying the details with independent data or asking the customer for an explanation. If you suspect the customer is not who they claim to be, you must not provide the designated service and are required to submit a suspicious matter report to AUSTRAC.

How do I identify the beneficial owner of a complex trust?

To identify the beneficial owner of a complex trust, you must follow the chain of ownership to find the individuals who ultimately control it or meet the 25% ownership threshold. Once identified, you must collect and verify their KYC information to establish their identity on reasonable grounds.

Are there exceptions for customers without standard identification?

Yes, you can use alternative identification procedures for individuals who face barriers to obtaining standard identification for reasons beyond their control. This flexible approach may involve accepting referee statements or recently expired identification, provided you assess the ML/TF risk as low and implement controls to manage any additional risks.

What happens if I cannot verify a customer identity?

If you cannot establish a customer’s identity on reasonable grounds, you are prohibited from providing them with a designated service. If the inability to verify their identity raises suspicions about their intentions or true identity, you must also submit a suspicious matter report to AUSTRAC.

Do I need to conduct initial CDD on existing pre-commencement customers?

Generally, you do not need to repeat the full initial CDD process for existing pre-commencement customers. You are, however, required to conduct initial CDD if a suspicious matter report is triggered for that customer or if a significant change in your business relationship elevates their ML/TF risk to medium or high.

How does initial CDD apply to nested services relationships?

When providing designated services within a nested services relationship, where your customer provides services to their own underlying customers, you have additional CDD obligations. Because these structures can obscure the flow of funds, you must apply enhanced CDD to understand the parties involved and the ML/TF risk they present.

What are the penalties for failing to complete initial CDD?

Failing to complete CDD can lead to significant civil penalties under the amended AML/CTF Act. These civil penalty provisions apply to failures such as not identifying and verifying a customer, not screening for PEPs, failing to assess ML/TF risk, or not keeping appropriate records before providing a designated service.

What is Enhanced Customer Due Diligence & How to Conduct It for AML Compliance

Hannah Deuk — Sat, 13 Jun 2026 13:57:46 +0000

Introduction

Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), Australian reporting entities must conduct enhanced customer due diligence to manage and mitigate high risks of money laundering and terrorism financing. This rigorous level of customer identification and verification acts as a required safeguard to protect businesses from criminal exploitation when providing a designated service.

Upcoming regulatory changes scheduled to commence on 1 July 2026 make it necessary to understand exactly when enhanced CDD must be applied. This article explains enhanced customer due diligence for reporting entities so you can accurately assess customer risk and implement the required enhanced CDD measures.

Interactive Tool: Check If You Must Conduct Enhanced Customer Due Diligence

Enhanced Customer Due Diligence Trigger Checker

Quickly assess if your business must apply enhanced customer due diligence (ECDD) under the AML/CTF Act.

Question 1 of 3: Is your customer, their beneficial owner, or an agent a Politically Exposed Person (PEP) or linked to a high-risk jurisdiction?

Question 2 of 3: Has the customer exhibited unusual or suspicious transaction patterns?

Question 3 of 3: Has the customer’s risk profile increased since onboarding (e.g., new KYC info, system alerts, or service usage changes)?

✅ Enhanced Customer Due Diligence is Mandatory

Your business must apply Enhanced Customer Due Diligence (ECDD).

Under Section 32 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), ECDD is required when a customer is a Politically Exposed Person (PEP), linked to a high-risk jurisdiction, or exhibits suspicious activity. You must collect and verify additional KYC information, conduct detailed transaction monitoring, and obtain senior management approval before continuing the business relationship.

Failure to comply can result in significant penalties and regulatory action by AUSTRAC.

Legal References:

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth)
AUSTRAC v Mounties [2024] FCA 123

Speak to a lawyer about your ECDD obligations

⚠️ Enhanced Due Diligence May Be Required

Your scenario may trigger Enhanced Customer Due Diligence (ECDD).

If your customer’s risk profile has increased, or if there are emerging risk factors (such as new KYC details or changes in service use), you should reassess their risk and consider applying ECDD measures.

Document your decision-making and seek legal advice to ensure compliance with the AML/CTF Act.

Legal References:

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth)

Get AML/CTF legal advice from a lawyer

⚖️ Standard Customer Due Diligence Applies

Enhanced Customer Due Diligence (ECDD) is not currently required.

Based on your responses, only standard CDD obligations apply. However, you must continue to monitor the customer and update their risk assessment if circumstances change.

For ongoing compliance, ensure your AML/CTF program is up to date and ready for independent review.

Legal References:

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Request an AML/CTF program review

❌ Insufficient Information to Determine ECDD Requirement

We cannot determine your ECDD obligations based on the information provided.

Please review your customer’s risk factors and transaction history, or seek legal advice for a tailored assessment.

Legal References:

Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to an AML/CTF lawyer for a risk assessment

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Understanding Enhanced Customer Due Diligence for Reporting Entities

The Core Purpose of Enhanced Customer Due Diligence in AML Compliance

Enhanced Customer Due Diligence (ECDD) is a critical component of a reporting entity’s obligations under the anti-money laundering and counter-terrorism financing framework. Its primary function is to detect, disrupt, and prevent money laundering and terrorism financing (ML/TF).

By applying these rigorous measures, your business can identify, assess, and manage high ML/TF risks presented by certain customers. This process gives you a deeper understanding of who your customer is and how they use the designated services you provide. Ultimately, effective ECDD protects your business, the financial system, and the broader Australian community from criminal exploitation.

How Enhanced Measures Differ from Standard Customer Due Diligence

While standard customer due diligence (CDD) establishes a baseline for customer identification, enhanced measures are applied when a higher risk of ML/TF is detected. As a result, ECDD is a more intensive process than initial CDD or simplified CDD.

The key differences include:

Level of scrutiny: Standard CDD involves foundational identity verification for most customers. ECDD applies a higher level of scrutiny and more detailed monitoring for customers who present an elevated customer risk.
Information collection: While initial CDD requires collecting and verifying key KYC information, ECDD involves gathering additional details. This can include more in-depth information about a customer’s source of funds or source of wealth.
Verification process: ECDD requires more rigorous verification of customer information. This may involve using additional independent sources to confirm details or re-verifying information you already hold if doubts arise about its accuracy.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Identifying Triggers for Applying Enhanced Customer Due Diligence

Assessing High Money Laundering & Terrorism Financing Risks

Reporting entities must conduct ECDD when a customer is identified as presenting a high risk of ML/TF. This assessment can occur at different stages of the business relationship.

A high customer risk rating may be determined during the initial CDD process when you first onboard a client. For example, if a new customer has a complex ownership structure involving multiple layers of companies and trusts with no clear purpose, this could indicate a high ML/TF risk, triggering the need for enhanced CDD measures from the outset.

Alternatively, a customer’s risk level can increase over time. Through ongoing CDD, you might detect changes in their behaviour or circumstances that elevate their risk profile, which could be due to:

System alerts: alerts from your customer monitoring systems;
KYC changes: changes to their know your customer (KYC) information, such as a new country of residence; or
Service shifts: a shift in how they use your designated services, like a sudden increase in transaction frequency or value.

When ongoing monitoring reveals that a customer’s ML/TF risk has become high, you must apply enhanced CDD to reassess their profile and implement appropriate controls to manage and mitigate the new level of risk.

Managing Transactions Linked to High-Risk Jurisdictions

Enhanced CDD is mandatory when a transaction involves individuals or entities connected to a high-risk jurisdiction. The Financial Action Task Force (FATF) identifies countries that have weaknesses in their anti-money laundering and counter-terrorism financing regimes, and these are considered high-risk.

This requirement applies if any of the following parties are physically located in or legally formed in a high-risk jurisdiction:

Your customer;
The beneficial owner of your customer;
A person receiving a designated service on the customer’s behalf; or
An individual acting on behalf of the customer.

These jurisdictions often present a greater risk of criminal activity due to factors like corruption, tax secrecy, or limited regulatory oversight. You might identify a link to a high-risk jurisdiction during initial CDD when reviewing corporate documents, or as part of ongoing monitoring when a customer updates their address or begins transacting with entities in those countries.

Dealing with Foreign Politically Exposed Persons

You must apply enhanced CDD measures when your customer, their beneficial owner, or a person acting on their behalf is a foreign politically exposed person (PEP). A foreign PEP is an individual who holds a prominent public function in a foreign country, such as a senior government official, judge, or military leader.

Foreign PEPs are considered to present a high ML/TF risk because their position and influence can create opportunities for corruption and the misuse of public funds. Furthermore, this elevated risk extends to their family members and close associates.

A foreign PEP can be identified during initial CDD or through ongoing monitoring. For instance, a review of identification documents might reveal a customer’s prominent public role, or you might discover that a director or beneficiary of a customer’s company is a foreign PEP.

Responding to Unusual Transactions & Suspicious Matter Reports

Enhanced CDD is also required in response to specific transactional activities and reporting obligations. You must apply enhanced measures if a customer requests a designated service that involves:

Unusually large or complex transactions;
Unusual pattern of transactions; or
Transactions with no apparent economic or legal purpose.

These situations require a deeper investigation to determine if the activity is consistent with the customer’s profile and circumstances.

Additionally, you must conduct enhanced CDD if you are required to submit a suspicious matter report (SMR) for a customer and you intend to continue providing a designated service to them. The ECDD process helps you reassess the customer’s ML/TF risk and decide whether to continue the business relationship.

It is important to submit the SMR within the required timeframe without waiting to complete the ECDD process. You must also be careful to avoid “tipping off” the customer that a report has been made, as this is a criminal offence.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Key Enhanced Customer Due Diligence Measures to Implement

Collecting & Verifying Additional Customer Information

When a customer presents a high ML/TF risk, reporting entities must collect and verify additional KYC information. This process helps to clarify any gaps or inconsistencies in the customer’s profile, providing a greater level of confidence in their identity. The goal is to build a clearer picture of the customer to better understand and mitigate the specific risks they pose.

The type of additional KYC information collected should be targeted to the nature of the risk. Examples of extra details to gather include:

Information about the customer’s or beneficial owner’s source of funds and source of wealth.
Details regarding the customer’s reputation, including their past and present business activities.
Clarification of complex ownership or control structures to identify all beneficial owners.
The intended purpose of the business relationship and the reasons for seeking specific designated services.

Verifying this additional information involves checking it against reliable and independent sources. You might need to re-verify details you previously collected to ensure they remain accurate, especially if you have doubts about their authenticity. This could involve using different independent sources or requesting additional identity documents to confirm the customer’s identity and update their risk profile.

Conducting Detailed Transaction Monitoring & Analysis

ECDD often requires more detailed monitoring of a customer’s transactions and behaviour. This level of scrutiny helps to determine if their activity aligns with the stated purpose of the business relationship and what is known about their financial situation. It is a critical step in identifying patterns that might indicate illicit activity that standard monitoring could miss.

Methods for increased monitoring and analysis include:

Reviewing the customer’s past transactions more closely to better identify and assess their ML/TF risk.
Increasing the frequency of reviews for the business relationship to assess whether the customer’s risk has changed.
Manually reviewing unusual, complex, or high-value transactions that may not have a clear economic or lawful purpose.
Updating automated monitoring triggers to flag additional kinds of transactions or behaviours that are inconsistent with the customer’s profile.

Obtaining Senior Management Approval for High-Risk Relationships

A crucial governance measure within an ECDD program is obtaining approval from senior management before establishing or continuing a high-risk business relationship. This ensures an additional layer of oversight and accountability, confirming that the decision aligns with the organisation’s risk appetite. It is a required step when dealing with high-risk customers, including a PEP.

This process ensures senior managers have direct oversight of the business’s most significant ML/TF risks. It allows them to make informed decisions about whether the entity is equipped to manage and mitigate those risks effectively. Furthermore, approval may also be required before processing certain high-value or complex transactions for these customers.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Establishing Source of Funds & Source of Wealth

Understanding the Difference Between Source of Funds & Source of Wealth

As part of ECDD, reporting entities must understand where a customer’s money comes from. This involves examining both their source of funds and their source of wealth. While related, these two concepts provide different insights into a customer’s financial profile and potential ML/TF risk.

Source of funds refers to how and where a customer obtained the money for a specific transaction. This check helps you confirm that the funds for a particular designated service come from a legitimate origin and that the activity aligns with what you know about the customer. For example, the source of funds for a large property deposit might be the proceeds from the sale of another asset.

Source of wealth provides a broader picture of how a customer has accumulated their total net worth over time. This assessment helps you determine if their overall financial position is credible and consistent with their profile. A customer’s source of wealth could include:

their employment history;
business ownership;
investments; or
inheritance.

When Source of Wealth Checks Are Mandatory for Reporting Entities

Under the anti-money laundering and counter-terrorism financing framework, establishing a customer’s source of funds and source of wealth on reasonable grounds is a mandatory enhanced CDD measure in several high-risk scenarios. These checks are essential for assessing whether a customer’s financial activities are legitimate.

You must conduct these checks in the following circumstances:

Politically Exposed Persons (PEPs): It is a requirement to establish the source of funds and source of wealth for any customer or beneficial owner who is a PEP. This also applies to high-risk domestic PEPs and high-risk international organisation PEPs.
High ML/TF Risk Customers: You must establish the source of funds and source of wealth when it is relevant to the nature of a customer’s high ML/TF risk. This helps to manage and mitigate risks associated with:
- Customers with complex or opaque wealth structures, such as high-net-worth individuals with unclear income sources.
- The use of shell companies or intricate trust arrangements that obscure the true beneficial owner.
- Customers conducting unusually large cash transactions or those whose wealth is derived from multiple jurisdictions.
- Individuals involved with high-risk jurisdictions.
- Former PEPs who continue to present a high customer risk due to their ongoing political influence.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Developing & Maintaining Effective ECDD Policies

Defining High-Risk Factors & Escalation Procedures

Your AML/CTF compliance program must contain clear policies, procedures, and controls for applying ECDD. This involves defining what constitutes a high ML/TF risk for your organisation. These definitions should identify specific high-risk factors across different areas of your business.

Key high-risk factors to define in your ECDD program include:

Customer Types: Categories of customers that present a higher risk, such as certain industries or business structures.
Designated Services: Specific services you offer that are more susceptible to criminal exploitation.
Delivery Channels: Methods of service delivery that may increase risk, such as non-face-to-face interactions.
Geographical Locations: Countries or regions identified as high-risk due to weak AML/CTF regimes or high levels of corruption.

Your policies must also assign clear responsibilities to staff for applying enhanced CDD measures. Furthermore, you need to establish clear escalation procedures. These procedures should outline the steps to take when enhanced measures cannot sufficiently manage and mitigate a customer’s risk, which may include deciding whether to continue providing a designated service or to end the business relationship.

Fulfilling Record Keeping Obligations for Enhanced Measures

Documenting the enhanced CDD measures you apply to a customer is a critical obligation. Proper record-keeping allows you to demonstrate compliance with your CDD obligations and helps build a clear picture of a customer’s evolving ML/TF risk. These records are essential for adapting your ECDD measures and continuing to manage risks effectively.

You must document several key aspects of the ECDD process, including:

The specific circumstances that required you to conduct enhanced CDD.
The reasons why you applied particular enhanced CDD measures.
Any additional KYC information you collected from the customer.
The methods used to verify the collected information.
Whether a SMR was submitted regarding the customer.
Any changes made to the customer’s risk rating as a result of the ECDD process.
Decisions to apply further measures to mitigate new risks or to cease providing a designated service due to unacceptable risk.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Case Study: AUSTRAC’s Enforcement Against AUSTRAC v Mounties (‘Mounties‘)

Ignoring High-Risk Behaviours Like Bill Stuffing & Minimal Play

AUSTRAC’s proceedings against Mounties in 2025 highlighted systemic failures in the club’s ECDD program, particularly in addressing high-risk customer behaviours. As a result, the club was exposed to significant money laundering risks by not effectively monitoring or acting on suspicious activities at its electronic gaming machines (EGMs).

Two key high-risk behaviours were identified as part of the proceedings:

Bill stuffing: This practice involves customers inserting cash into an EGM to obtain credit, which is then redeemed for a cheque after little to no gameplay. This can be a method for converting illicit cash into a seemingly legitimate financial instrument.
Minimal play with large cash inserts: Another red flag was customers inserting large amounts of cash into EGMs or multi-terminal gaming machines and then cashing out after minimal or no play. Ultimately, this activity is inconsistent with genuine gambling and can indicate an attempt to launder money.

These behaviours were identified as significant ML/TF risks that Mounties failed to adequately manage and mitigate.

The Failure to Apply Enhanced Measures to Suspicious Customers

The proceedings also revealed a failure to apply appropriate enhanced measures to the customers exhibiting these high-risk behaviours. Despite identifying suspicious activity, Mounties did not take the necessary steps to manage and mitigate the associated risks, even as these customers collectively reached turnovers exceeding $139 million from EGM play.

According to court documents, the failures in applying ECDD measures to these suspicious customers included:

Not conducting appropriate source of wealth or source of funds checks to verify that the customers’ gambling activities were consistent with their financial profiles.
Failing to subject these high-risk customers to a proper senior management review to decide if the business relationship should continue.
Neglecting to appropriately risk-rate customers who displayed clear indicators of high ML/TF risk.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Key Lessons from the Mounties

The Dangers of Over-Reliance on Third-Party Compliance Vendors

The Mounties serves as a cautionary tale for reporting entities that outsource their AML/CTF obligations. Mounties had engaged a third-party provider, BetSafe Pty Ltd, to create, maintain, and update its AML/CTF program.

However, AUSTRAC alleged that this reliance did not absolve Mounties of its duties under the AML/CTF Act. While engaging third-party providers is permissible, the legal responsibility for compliance remains with the reporting entity.

Passive reliance on an outsourced service without active internal oversight can lead to significant compliance failures. Therefore, reporting entities must ensure that:

Any third-party service is fit for purpose; and
They maintain sufficient oversight to manage and mitigate ML/TF risks effectively.

Inadequate Independent Reviews & Lack of Board Training

A significant failure in Mounties‘ governance was the inadequacy of its independent AML/CTF program reviews. Between 2019 and 2023, the reviews conducted by Legal Review Pty Ltd were found to be insufficient.

They did not meet the requirements of the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth) (‘AML/CTF Rules‘) because they were merely desktop exercises. Specifically, the reviews failed to assess the effectiveness of the AML/CTF program as they did not involve any testing or verification of the systems and procedures Mounties used.

Instead, the process was limited to the following actions rather than actively testing the controls:

Conducting interviews; and
Reading the program documents.

This lack of rigorous oversight was compounded by a failure in leadership accountability. The Mounties‘ board of directors did not complete the required biennial AML/CTF training as stipulated in their own program. Ultimately, this failure weakened governance and demonstrated a systemic deficiency in the organisation’s approach to its compliance responsibilities.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Conclusion

Robust ECDD is a critical requirement for Australian reporting entities to manage high risks of ML/TF. As highlighted by AUSTRAC’s enforcement actions, failing to implement an effective ECDD program can lead to severe penalties and expose a business to criminal exploitation.

Navigating these complex ECDD obligations requires specialised legal knowledge to ensure your AML/CTF program is compliant. Contact our AML/CTF compliance lawyers at Click Legal today for assistance in developing and reviewing your ECDD framework to protect your business and meet your regulatory requirements.

Frequently Asked Questions

What is the primary legislation for enhanced customer due diligence in Australia?

The primary legislation is the AML/CTF Act. This Act requires reporting entities to have an AML/CTF program, and Part A of this program must include details on how ECDD will be applied in high-risk situations.

Can a reporting entity delay enhanced customer due diligence?

No, a reporting entity generally cannot delay ECDD. While initial CDD may be delayed in very limited, low-risk circumstances, ECDD is specifically triggered by high ML/TF risk scenarios that require immediate measures to manage and mitigate.

How does enhanced customer due diligence differ from ongoing customer due diligence?

Ongoing CDD is the standard monitoring applied to all customers throughout a business relationship to ensure their activities are consistent with their profile. ECDD is a more intensive process with additional checks that must be applied specifically when a customer or transaction is identified as presenting a high risk of ML/TF.

What are the penalties for failing to comply with enhanced customer due diligence obligations?

Failing to comply with ECDD obligations can lead to severe consequences, including substantial civil penalties from AUSTRAC and significant reputational damage. Non-compliance leaves a business vulnerable to criminal exploitation, as seen in AUSTRAC’s enforcement action against entities like Mounties.

When must a reporting entity establish a customer’s source of wealth?

A reporting entity must establish a customer’s source of wealth on reasonable grounds in several high-risk situations. This includes when dealing with a PEP, a high-risk domestic or international organisation PEP, or any other customer whose high ML/TF risk is linked to their financial background, such as those with complex wealth structures.

Does submitting a suspicious matter report mean enhanced customer due diligence is complete?

No, submitting a SMR does not complete your ECDD obligations. If you submit an SMR for a customer but intend to continue providing a designated service to them, you are still required to apply ECDD to reassess and manage their risk. The SMR must not be delayed to complete the ECDD process.

What is a nested services relationship & why does it require enhanced measures?

A nested services relationship is where a reporting entity provides a designated service to a customer, and that customer then uses the service to provide services to their own clients in another country. This arrangement requires ECDD because it can obscure the identity of the end-users and the flow of funds, which increases the ML/TF risk.

How often should reporting entities review their enhanced customer due diligence programs?

An AML/CTF program, which includes ECDD procedures, must be subject to regular independent AML/CTF program reviews. The purpose of this review is to assess the program’s effectiveness in managing ML/TF risk and to ensure it complies with the AML/CTF Rules. These reviews should involve active testing of systems and controls, not just a desktop assessment.

Can reporting entities outsource their enhanced customer due diligence obligations?

No, reporting entities cannot outsource their legal obligations under the AML/CTF Act. While you can use third-party providers for certain processes, your business remains fully responsible for compliance and must maintain active oversight to ensure any outsourced functions are effective and fit for purpose.

A Guide to Ongoing Customer Due Diligence OCDD for AML Compliance

Hannah Deuk — Sat, 13 Jun 2026 13:51:51 +0000

Introduction

For reporting entities providing a designated service in Australia, ongoing customer due diligence is a mandatory process to identify, assess, manage, and mitigate money laundering and terrorism financing risks. Mandated by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), this continuous monitoring ensures businesses protect the financial system from criminal exploitation throughout the entire business relationship.

This article explains ongoing CDD obligations for reporting entities so you can effectively monitor your customers and maintain AML compliance.

Interactive Tool: Check If Your Business Meets OCDD & AML Requirements

Ongoing Customer Due Diligence (OCDD) Compliance Checker

Quickly check if your business is meeting its ongoing customer due diligence (OCDD) obligations under the AML/CTF Act.

Is your business a reporting entity providing designated services under the AML/CTF Act?

Do you have a documented and up-to-date OCDD program that includes both automated and manual monitoring measures?

Are you actively reviewing and updating customer KYC information and ML/TF risk profiles when trigger events occur?

✅ You appear to be OCDD compliant

Based on your responses, your business is actively meeting its ongoing customer due diligence obligations under Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth). Continue to monitor for trigger events, keep your OCDD program up to date, and ensure staff are trained on compliance requirements.

Tip: Schedule regular reviews and document all compliance actions to maintain a clear audit trail.

Legal References:

Section 30 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth)

Get AML/CTF Legal Advice

⚠️ Gaps in your OCDD compliance

Your business may have gaps in its ongoing customer due diligence program. Under Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), reporting entities must maintain a documented, risk-based OCDD program and regularly review customer KYC and risk profiles.

Failure to comply can result in formal warnings, civil penalties, or criminal charges. Immediate action is recommended to address compliance gaps.

Legal References:

Section 30 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
Section 41 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer about AML/CTF Compliance

❌ Not a reporting entity – OCDD obligations unlikely to apply

Based on your answer, your business is not a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Ongoing customer due diligence obligations do not apply unless you begin providing designated services. If you are unsure about your status or plan to expand your services, seek legal advice to confirm your compliance obligations.

Legal References:

Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)

Speak to a Lawyer about Reporting Entity Status

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Understanding Ongoing Customer Due Diligence for Reporting Entities

The Purpose of OCDD in AML Compliance

Ongoing customer due diligence (OCDD) is a continuous process that reporting entities must carry out after a customer has been onboarded. It involves monitoring your customers to identify, assess, manage, and mitigate the risks of money laundering and terrorism financing (ML/TF), as well as proliferation financing, throughout the business relationship. Unlike initial customer due diligence (CDD), which happens at the start of the relationship, the purpose of ongoing CDD is to ensure your understanding of the customer and their risk profile remains current.

Customer circumstances and behaviours can change over time, and criminals may attempt to exploit a business relationship after it has been established. As a result, effective OCDD helps you to:

detect suspicious activities;
maintain accurate customer information; and
manage ML/TF risks by adjusting a customer’s risk rating based on their behaviour and updated information.

The Legal Framework & AUSTRAC Oversight

The legal requirements for OCDD are established under the following legislation:

AML/CTF Act; and
Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (Cth) (‘AML/CTF Rules‘).

These laws mandate that reporting entities implement and maintain robust OCDD systems as a core part of their AML/CTF compliance programs.

The Australian Transaction Reports and Analysis Centre (AUSTRAC) is the primary regulator responsible for overseeing compliance with these obligations. Furthermore, AUSTRAC provides guidance to help businesses implement effective OCDD programs and enforces the legal framework.

Failure to comply with OCDD obligations can lead to severe consequences, including:

formal warnings;
infringement notices;
civil penalty orders; and
criminal charges.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

What Your Reporting Entity Must Monitor For

Identifying Unusual Transactions

A core part of OCDD is monitoring for transactions that are inconsistent with what you know about a customer. Furthermore, what is considered unusual depends on the customer’s profile, your business relationship, and the designated services you provide.

Examples of unusual transactions that your reporting entity should monitor include:

Inconsistent Activity: Transactions that do not align with a customer’s known risk profile, transaction history, or their stated source of funds or wealth.
Structured Transactions: A pattern of transactions that appears designed to avoid reporting obligations, such as splitting large cash deposits into smaller amounts to stay below the $10,000 threshold.
Unusual Complexity: Transactions that seem unnecessarily complex for the nature of the business relationship or have no apparent economic or lawful purpose.
High-Risk Dealings: Transactions involving individuals or entities in high-risk countries or regions, or those involving politically exposed persons (PEPs).
Large Cash Movements: Significant cash deposits or withdrawals that are out of character for the customer.
Obscured Ownership: The use of complex legal structures, such as companies or trusts, to conduct transactions for no clear commercial reason or to hide the true beneficial owner.

Spotting Unusual Customer Behaviours

Beyond financial transactions, a customer’s behaviour can also indicate heightened ML/TF risk. These behaviours can manifest during direct interactions or through patterns in how a customer uses your designated services over time.

Consequently, your monitoring should look for behavioural red flags, such as a customer who:

Appears nervous, defensive, or evasive when asked routine questions.
Provides answers that seem coached, rehearsed, or directed by a third party.
Is unable or unwilling to provide a clear explanation for establishing a business relationship or for the purpose of a transaction.
Frequently changes their know your customer (KYC) information without a logical reason.
Attempts to influence staff members, for instance, by offering incentives to discourage them from reporting unusual activity.
Shows an unusual interest in your reporting obligations, transaction limits, or internal processes.
Uses an agent or third party for transactions without a clear commercial or lawful purpose.

Monitoring for Specific Criminal Offences

Under Section 41 of the AML/CTF Act, you must monitor for transactions and behaviour that could be relevant to the investigation or prosecution of certain crimes. Identifying indicators of these offences is a key part of your OCDD.

Therefore, your monitoring program should be designed to detect activity related to various offences, including:

Financial crimes: Such as money laundering, financing of terrorism and proliferation financing, taxation-related crimes, bribery and corruption, as well as insider trading and market manipulation.
Trafficking and crimes against persons: Such as human trafficking and people smuggling, sexual exploitation (including of children), trafficking of illicit substances or arms, and murder or grievous bodily harm.
Other crimes: Such as fraud (including identity theft and scams), cybercrime, participation in organised crime, and terrorism.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

How to Effectively Monitor Your Customers

Implementing Automated & Manual Monitoring Systems

Your approach to customer monitoring can be manual, automated, or a combination of both. Ultimately, the right method depends on the nature, size, and complexity of your business. Therefore, your systems and controls must be appropriate to identify, assess, manage, and mitigate the ML/TF risks you face.

AUSTRAC expects reporting entities to use an automated transaction monitoring system if they cannot effectively monitor transactions manually. This is often the case for businesses that handle a high volume of transactions. Furthermore, transaction monitoring software can identify issues that are difficult to recognise manually, including:

Unusual patterns or spikes in activity.
Unusually large transactions.
Potential structuring of transactions to avoid reporting obligations.
Transactions involving high-risk jurisdictions or sanctioned individuals.

For smaller businesses or those with lower transaction volumes, manual monitoring can be an effective alternative. A robust manual monitoring process typically involves several key actions, as follows:

Training personnel to identify and respond to unusual transactions and behaviours.
Scheduling regular reviews of customer transactions, such as weekly or monthly.
Comparing a customer’s activity against their known history and profile.
Assessing a customer’s transactions against those of similar customers.
Escalating any unusual findings to an AML/CTF compliance officer for further review.

Setting Up Monitoring Alerts & Checking Effectiveness

An effective monitoring system uses alerts to flag transactions and behaviours that require further investigation. In addition, your AML/CTF policies should outline what triggers a review to determine if a suspicious matter report (SMR) is necessary. Without a clear process for reviewing and responding to alerts, it is difficult to demonstrate that you are effectively managing your ML/TF risks.

Alerts could be triggered by various factors, including:

The size, frequency, or pattern of transactions appears unusual.
A transaction involves a high-risk country or region.
A transaction involves a person or organisation on a sanctions list.
Activity appears structured to avoid threshold transaction reporting.
The behaviour is inconsistent with the customer’s known ML/TF risk profile.

Under Section 26F(1) of the AML/CTF Act, you must regularly check that your OCDD measures are effective, a requirement typically met by conducting independent AML/CTF program reviews. These checks confirm that your system is operating as intended. As a result, you should verify that you have enough information about your customers to identify unusual activity, that your alerts are functioning correctly, and that your team is responding to them appropriately.

If you identify any problems during these reviews, you are expected to address them promptly. You should also update your monitoring processes to reflect new indicators of criminal activity, whether they are identified through internal intelligence or published by AUSTRAC.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Reviewing & Updating Customer KYC Information & ML/TF Risk

Triggers for Updating Customer Risk Profiles

Under Section 30 of the AML/CTF Act, reporting entities must review and, where appropriate, update their assessment of a customer’s ML/TF risk. Furthermore, this is not a one-off task at onboarding but an ongoing obligation throughout the business relationship.

A reassessment of a customer’s ML/TF risk is required when certain trigger events occur. Ultimately, these events indicate that the initial risk profile may no longer be accurate. Key triggers include:

Changes to your business: If your business’s own ML/TF risk assessment changes, it could affect how you identify and assess your customers’ risk.
Changes in customer type: A customer’s circumstances can change, such as if they become a PEP or if there is a change to their corporate structure or beneficial owners.
Different designated services: The customer may request new products or designated services that carry a different level of ML/TF risk than what you currently provide them.
New delivery channels: The way you deliver services to the customer might change, for instance, through the involvement of an agent or a shift to online-only interactions.
Involvement of different countries: The customer’s transactions may begin to involve different countries, particularly those that are considered high-risk.
Unusual activity: Your transaction monitoring may flag unusual transactions or behaviour that is inconsistent with the customer’s known profile, which requires a risk review.

When & How to Reverify KYC Information

Reporting entities must periodically review and, where necessary, update and reverify their customers’ KYC information. Following the Section 30 requirements mentioned above, the frequency of these reviews must be appropriate to the customer’s assessed ML/TF risk. As a result, higher-risk customers will require more frequent reviews than lower-risk customers.

Certain circumstances automatically trigger the need to review and potentially reverify KYC information, including when:

You have doubts about the adequacy or truthfulness of the information you previously collected;
A customer, their beneficial owner, or a person acting on their behalf becomes a foreign PEP; or
A customer, their beneficial owner, or a person acting on their behalf becomes a domestic or international organisation PEP and their ML/TF risk is assessed as high.

In addition, your AML/CTF program should outline other triggers for collecting additional KYC information. Examples include a sudden and unexplained increase in transaction volumes or becoming aware of significant changes to a customer’s corporate structure.

The process of updating and reverifying information can be integrated into your regular business operations. Practical methods include:

Asking customers to confirm or update their details during face-to-face or telephone interactions.
Using a business application to prompt customers to review their information.
Requesting and verifying new documentation following changes to a customer’s ownership structure or beneficial owners.
Confirming a customer’s source of funds or source of wealth where appropriate.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Responding to Unusual Transactions & Behaviours

Steps for Reviewing & Escalating Alerts

When your monitoring systems flag unusual activity, you must have a structured process to review and respond. This ensures that potential risks are managed appropriately and consistently. Furthermore, your AML/CTF policies should outline the escalation process for handling these alerts.

A typical response process involves several key steps:

Review the activity in context: Compare the transaction or behaviour against what you already know about the customer. This includes their assessed ML/TF risk, their transaction history, and the nature of your business relationship, while considering whether the activity has a clear economic or lawful purpose.
Check existing information: Examine the records you hold for the customer, such as their KYC information, previous interactions, and any past alerts. You should also consider information from linked accounts or services to see if it provides additional context.
Decide on the next steps: After reviewing the activity and existing information, you must decide on the appropriate action. If you find a legitimate explanation, no further action may be necessary; otherwise, you might need to update the customer’s KYC information, apply enhanced customer due diligence, or escalate the matter to senior management.
Document your review: It is essential to keep detailed records of the alert, the steps you took to review it, and the decisions you made. This documentation demonstrates how you have complied with your OCDD obligations.

Applying Enhanced Customer Due Diligence

Unusual activity identified during ongoing monitoring can be a trigger for applying enhanced customer due diligence (ECDD). These are additional measures you must take to manage a higher ML/TF risk. As a result, your business must have established procedures in place to identify when these high-risk scenarios occur.

Under Section 32 of the AML/CTF Act, you are required to apply enhanced CDD measures if a designated service involves:

an unusually large or complex transaction;
an unusual pattern of transactions; or
a transaction with no apparent economic or lawful purpose.

Other situations that may trigger ECDD include dealing with a foreign PEP or having a suspicion of money laundering or terrorism financing. When a customer’s behaviour or circumstances change in a way that elevates their ML/TF risk to high, you must apply these more stringent due diligence measures. Ultimately, this could include establishing their source of funds or source of wealth.

Submitting Suspicious Matter Reports

If, after reviewing an unusual transaction or behaviour, you have reasonable grounds for suspicion, you must submit an SMR to AUSTRAC.

As established under Section 41 of the AML/CTF Act, you must file a report if you suspect a customer is not who they claim to be, is planning an ML/TF offence, or if you uncover information relevant to the crimes monitored above.

The timeframe for submitting an SMR is critical. For matters related to terrorism financing, the report must be submitted within 24 hours of forming the suspicion. By contrast, for all other matters, the deadline is three business days.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Best Practices for OCDD Compliance & Record Keeping

Fostering a Culture of Compliance & Staff Training

For your AML/CTF policies to be effective, your staff must understand and implement them correctly. Comprehensive training is essential for creating a culture of compliance where employees are the first line of defence in identifying and managing ML/TF risks.

Key aspects of an effective staff training program include:

Understanding ML/TF risks: Personnel should be trained to recognise ML/TF risks, typologies, and red flags relevant to your business and the designated services you provide.
Clear roles and responsibilities: Every relevant staff member must understand their specific duties within the AML/CTF program, particularly concerning OCDD.
Escalation procedures: Your team needs to be trained on the correct procedures for escalating unusual transactions, behaviours, or other compliance concerns to the appropriate person, such as an AML/CTF compliance officer.
Leadership commitment: A strong compliance culture starts with leadership, meaning senior management should actively promote the importance of meeting AML/CTF obligations throughout the organisation.
Continuous education: Provide regular updates and ongoing training to keep staff informed about changes in regulations, AUSTRAC guidance, and new or emerging ML/TF risks.

Meeting Record Keeping Obligations

Under Sections 107 and 111 of the AML/CTF Act, reporting entities have a legal obligation to keep detailed records. This documentation must demonstrate how you have complied with your OCDD obligations for each customer.

Your records must be thorough enough to show a clear audit trail of your compliance activities, which includes keeping records of:

All customer transactions conducted through your designated services.
Your identification, analysis, and assessment of each customer’s ML/TF risk.
Any decisions your business makes about how ongoing CDD is conducted for a particular customer.
The details of any monitoring alerts, including how you reviewed the activity, the steps taken, the decisions made, and the reasons for your response.

Request Free Consultation Today

Our senior lawyers will contact you to discuss your situation & outline next steps.

Case Study on AUSTRAC Enforcement Against Airwallex

Suspected Failures in Transaction Monitoring & Reporting

In January 2026, AUSTRAC ordered an external audit of the payment platform Airwallex due to suspected non-compliance with its obligations under the AML/CTF Act. Furthermore, the regulator expressed concerns that Airwallex had not demonstrated an acceptable understanding of its customers and the associated reporting requirements.

The audit, ordered under Section 162 of AML/CTF Act, was initiated to examine several key areas of potential non-compliance. AUSTRAC’s concerns included that Airwallex’s:

Transaction monitoring program was not properly attuned to the full range of ML/TF risks the business faced;
OCDD program was inadequate, with the audit notice specifically requiring a review of compliance with Section 36 of AML/CTF Act; and
Suspicious matter reporting processes were insufficient, with the audit set to evaluate the timeliness of reports and review decisions where matters were escalated but did not result in an SMR being submitted to AUSTRAC.

The Importance of Executive Oversight & Accountability

In announcing the audit, the AUSTRAC CEO highlighted that effective anti-money laundering controls must begin with a company’s leadership. Consequently, boards and senior executives are expected to actively oversee how ML/TF risks are identified, assessed, and managed across their organisation.

AUSTRAC stated that AML/CTF compliance is not a back-office function. Instead, it requires clear accountability, properly authorised staff who can submit reports, and enough resources to support timely and accurate reporting. Ultimately, the audit of Airwallex was set to include a review of the effectiveness of its AML/CTF governance, including oversight from its board and executives.

Speak to Our Senior Lawyers Today

Request your free consult & our senior lawyers will contact you to discuss your situation.

Conclusion

OCDD is a mandatory process for reporting entities to continuously monitor customers and manage ML/TF risks. This involves identifying unusual activity, keeping KYC information updated, and reassessing customer risk throughout the business relationship to maintain compliance.

Implementing a robust OCDD framework is essential for meeting your AML/CTF obligations. For assistance with developing or reviewing your AML/CTF program, contact our AML/CTF compliance lawyers at Click Legal to ensure your business remains compliant and protected.

Frequently Asked Questions

What is the difference between initial CDD & ongoing CDD?

Initial CDD is conducted at the beginning of a business relationship to verify a customer’s identity, while OCDD is the continuous process of monitoring that relationship to ensure the customer’s risk profile and information remain current.

Can we use simplified CDD during ongoing monitoring?

Yes, you can apply simplified ongoing OCDD measures if the customer’s ML/TF risk is low and enhanced CDD is not required. Your AML/CTF policies must specify how simplified measures are applied, and you must still meet your ongoing CDD obligations through less intensive monitoring.

What are the penalties for failing to conduct OCDD?

Failing to meet OCDD obligations can lead to severe consequences from AUSTRAC, including formal warnings, infringement notices, civil penalty orders, and criminal charges. Businesses may also suffer significant reputational damage.

How often should we update a customer’s KYC information?

The frequency for updating a customer’s KYC information must be appropriate for their assessed ML/TF risk. A review is also required when specific trigger events occur, such as having doubts about previously collected information, a customer becoming a PEP, or a sudden, unexplained change in their transaction patterns.

What should we do if we suspect a customer is tipping off?

If you are obligated to submit an SMR and believe that performing ongoing CDD would alert the customer, you are not required to conduct all aspects of ongoing CDD. You must, however, carry out as much of the process as possible without tipping off the customer.

Do we need an automated transaction monitoring system?

AUSTRAC expects reporting entities to use an automated transaction monitoring system if they cannot effectively monitor customer transactions manually. This is particularly relevant for businesses that handle a high volume of transactions where manual review may not be sufficient to detect unusual patterns.

What are nested services relationships in OCDD?

A nested services relationship is when a customer uses your designated services through another reporting entity located in a different country. For these relationships, you have an additional obligation to review and update the customer’s ML/TF risk and KYC information at least once every two years, or more frequently if their risk profile changes.

How do sector specific indicators help with monitoring?

Sector-specific indicators published by AUSTRAC provide practical examples of transactions and behaviours that may be linked to criminal activity within particular industries. These indicators help reporting entities to recognise suspicious activity that is common in their sector, thereby improving the effectiveness of their transaction monitoring systems.

What records must be kept for OCDD compliance?

Reporting entities must keep records that demonstrate compliance with their OCDD obligations. These records should include customer transactions, the identification and assessment of the customer’s ML/TF risk, and any decisions made about how ongoing CDD was conducted for that customer.