Recent amendments to the AML/CTF Rules made significant changes to:
- how reporting entities can collect 'know your customer' ("KYC") information for customers; and
- the requirements for reporting entities to rely on electronic verification methods.
Both are good news for reporting entities. These changes affect Chapter 4 of the AML/CTF Rules, which has been replaced entirely. You can view a marked-up version of the new rules that we have created to show the exact changes here.1
Collection methods for KYC information about customers
Until now, Chapter 4 of the AML/CTF Rules has required that reporting entities must collect KYC information "from" the customer. See, for example, rule 4.2.3 – 4.2.5 in relation to individuals. This has now been changed to a requirement to collect information "about" the customer.
While this may appear to be a minor change, the implications are significant as, in practical terms, it drastically increases flexibility for reporting entities in designing their initial on-boarding processes (subject, as before, to the risk rating of particular customer categories). Whereas in the past it was necessary to obtain all KYC information directly from the customer, and then verify it, it is now possible to use the verification document (such as a drivers licence or passport) to both collect and verify the information in one step.
While in theory this change does reduce the robustness of the due diligence conducted on the customer (to the extent that reliance on the customer themselves as a source of information is reduced), the global FATF measures themselves do not require this and specify only that customer due diligence measures taken include:
Electronic Verification
The AML/CTF Rules permit electronic verification using reliable and independent data which offers an opportunity for reporting entities to streamline on-boarding processes by avoiding the need for customers to provide copies of identification documents which then have to be retained and managed. Reliance on electronic data to conduct these KYC checks has proven increasingly popular as costs have fallen over the years.
Previously, Chapter 4 permitted reporting entities to utilise electronic verification methods for medium or lower risk customers to meet KYC information verification requirements, provided the reporting entities verify:
- the customer's name and residential address from at least two separate 'reliable and independent' data sources; and
- either:
-
- the customers date of birth from at least one independent data source; or
- that the customer has a transaction history for at least three years.
Practically, there are a limited number of data sources that maintain this combination of name and address and date of birth, and the amendments have relaxed this requirement so that, now, the electronic verification safe harbour allows individual customers to be verified by checks of:
- the customer's name; and either
- residential address; or
- date of birth; or
- that the customer has a transaction history for at least three years.
Importantly, verification of name, residential address or date of birth still requires two separate data sources. Verification of transaction history requires only one data source.
Reporting entities, while not necessarily required to update their AML/CTF Programs in light of these changes, should consider whether they trigger the review provisions in their Program and, if so, whether to take the opportunity to amend it so as to streamline customer due diligence processes and/or electronic verification procedures.
Footnotes
1 Only those chapters of the Rules affected by the amendments have been reproduced. Some notes to Schedules (replacing references to CrimTrac with Australian Crime Commission) have been omitted for brevity.
2 The FATF Recommendations February 2012 (Updated June 2016), paragraph 10.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
