Australia
Australia regulates at Commonwealth level, with states and territories licensing gambling. AUSTRAC enrols and supervises reporting entities under the AML/CTF Act and receives suspicious matter and threshold reports, while APRA and ASIC license banks, insurers, payment firms and crypto platforms. Since 31 March 2026 KYC is outcomes-based, with identity confirmed online by video call or biometric face matching. Telecoms, healthcare, travel and public bodies follow their own identity rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
AUSTRAC, the Australian Transaction Reports and Analysis Centre, is both the anti-money laundering regulator and the financial intelligence unit. Reporting entities enrol with it, and it receives suspicious matter and threshold transaction reports. Prudential and conduct licensing sit with APRA and ASIC, and sanctions screening against the DFAT Consolidated List is part of every initial customer check. Gambling licences come from the states and territories.
Yes. Since 31 March 2026 the AML/CTF Act sets outcomes rather than a document checklist: a business must take reasonable steps to establish that the customer is the person they claim to be and verify identity data against reliable and independent data. AUSTRAC's guidance accepts a video call or biometric face matching against photo ID in place of an in-person comparison. The delivery channel is a risk factor, but online onboarding alone does not trigger enhanced due diligence.
Most reporting entities apply for enrolment within 28 days of starting. Remittance and crypto businesses are different: they must be registered with AUSTRAC before they provide any service, and registration of a virtual asset service provider can take up to 90 days. Trading unregistered is a criminal offence. Civil penalties for AML/CTF breaches reach 100,000 penalty units, about A$36.4 million, per contravention.
Generally yes. Biometric information used for automated verification, and biometric templates, are sensitive information under the Privacy Act, which may be collected only with consent and where reasonably necessary, unless an exception applies. The OAIC's facial recognition guidance also expects a privacy impact assessment, and from 10 December 2026 privacy policies must describe automated decisions that could significantly affect individuals. Accredited Digital ID providers must destroy biometrics immediately after the check.
Telecom carriers, healthcare providers, travel and accommodation sellers, online shops and marketplaces and public bodies are not reporting entities under the AML/CTF Act, nor are general insurers or life policies without a prescribed minimum surrender value. Providing a designated service changes that: currency exchange, or precious goods sold for A$10,000 or more in cash or crypto, brings a travel firm or retailer into scope. Otherwise identity duties come from sector rules such as ACMA's telecom determinations.