Banking & Digital Banking Compliance in Australia

Australia is open to digital banks, but entry runs through a single prudential gate. APRA grants the banking authority, AUSTRAC supervises anti-money laundering and counter-terrorism financing (AML/CTF) compliance, and the Australian Securities and Investments Commission (ASIC) regulates conduct and, from 2026, scams prevention for the banking sector.

The biggest obstacle for a new entrant is the APRA licence itself, and its rules are being rewritten: under APRA's May 2026 proposal, every applicant would have 12 months to meet one set of criteria. Once licensed, a bank's onboarding must meet the reformed AML/CTF customer due diligence rules that took effect on 31 March 2026, with a transitional option to keep pre-reform procedures until 31 March 2029.

1. Who regulates this sector

Banking is regulated nationally.

2. Licensing and authorisation

A body corporate that carries on banking business in Australia without being the Reserve Bank or an ADI commits an indictable offence (200 penalty units, with each day a separate offence) under Banking Act 1959 s 8 (Compilation No. 69, 31 March 2026). Authority is sought from APRA in writing under s 9, and APRA may set criteria by legislative instrument. Using "bank", "banker", "banking" or a similar word in a financial business without APRA's consent is a separate offence under s 66; APRA lists "neobank", "banc" and "banq" among the restricted words.

A licensing framework in transition [Proposed, final late 2026]

APRA's current guidelines (August 2021) offer a full ADI licence or a restricted ADI licence for up to two years, and require an attestation of a board-approved AML/CTF programme and AUSTRAC enrolment. On 13 May 2026 APRA released draft formal licensing criteria in a legislative instrument and announced it is discontinuing the restricted pathway. Applicants would have 12 months to meet the criteria, APRA aims to decide within 90 days of a substantially complete application, and all decisions, including refusals, would be published. Final criteria are expected in late 2026.

Overseas banks serving retail clients need a local subsidiary. Deposits at locally incorporated ADIs are protected under the Financial Claims Scheme up to $250,000 per account holder per ADI; foreign-currency deposits are excluded.

3. AML, KYC and customer due diligence

Opening an account by an ADI is a designated service under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) s 6, table 1, item 1 (Compilation No. 63, 1 October 2026). A provider must apply to enrol with AUSTRAC within 28 days of starting (s 51B) and must maintain an ML/TF risk assessment and AML/CTF policies (ss 26E and 26F).

Initial customer due diligence [In force from 31 Mar 2026]

Under s 28, a bank must not start providing a service until it has established on reasonable grounds the customer's identity, anyone acting for the customer and their authority, beneficial owners, whether any of them is a politically exposed person (PEP) or designated for targeted financial sanctions, and the nature and purpose of the relationship. For an individual it must take reasonable steps to establish that the customer is the person they claim to be, and verify KYC information "using reliable and independent data" to the extent appropriate to the customer's risk. The delivery channel is a mandatory factor in that risk assessment (s 28(4)(d)). Beneficial owner means an individual who ultimately owns 25% or more of, or controls, a non-individual customer (s 5); Rules r 6-7 eases this for listed companies and government bodies.

Enhanced due diligence

Section 32 requires enhanced measures for high-risk customers, continuing relationships after a suspicious matter report, foreign PEPs, links to Financial Action Task Force (FATF) high-risk jurisdictions and nested services. Rules r 6-20 adds unusually complex or large transactions; r 6-21 requires source of wealth and funds where relevant.

Correspondent banking

A financial institution must not enter a correspondent relationship with a shell bank, or with an institution that deals with one, and must end it, or ask the other institution to end its shell bank link, within 20 days (s 95). Vostro relationships need a documented due diligence assessment and senior officer approval before entry (s 96).

Reporting and records

• Suspicious matters: within 3 business days of forming the suspicion, or 24 hours for terrorism financing (s 41). Suspecting that a person is not who they claim to be is itself a trigger.
• Threshold transactions: physical currency transfers of $10,000 or more, reported within 10 business days (ss 5 and 43).
• International transfers: international funds transfer instruction reports continue until the bank moves to new international value transfer service reports, 31 March 2029 or a later date notified to AUSTRAC, no later than 30 September 2029.
• Records: CDD records for 7 years after the relationship ends (s 111); transaction records for 7 years (s 107).

4. Identity verification and onboarding

The reformed Act does not list acceptable documents. AUSTRAC's guidance "Initial CDD for individuals" (updated 31 March 2026) describes this baseline:

• Collect: full name, other names, date of birth, residential address and a unique identifier such as a passport or driver's licence number.
• Verify: a government-issued primary photographic identification document; or a primary non-photographic document plus a secondary document showing name and address; or other independent and reliable data. An original or a reliable copy may be used.
• Confirm the person: compare the customer with the photo ID in person, compare "the name and features of the live video image" on a video call, or use biometric technology "such as a solution provided by an ID verification provider".
• Screen: PEP status and the latest Department of Foreign Affairs and Trade (DFAT) Consolidated List, checking alternative spellings.

For individuals without standard evidence, Rules r 6-10 allows identity to be established through reasonable steps, reasonably available data and policies managing the extra risk.

Government verification services

Under the Identity Verification Services Act 2023, businesses reach the Document Verification Service, which checks identity documents against government records, only through an approved gateway service provider. Participation agreements require the individual's express consent, and IDMatch advises that the DVS should not be the sole basis for a decision. Facial images are not provided in response to requests by or on behalf of non-government entities, so face matching for private onboarding is done by the bank or its provider. The Rules also anticipate verification through an entity accredited under the Digital ID Act 2024: suspicious matter and threshold reports must include any reference number such an entity provided (rr 9-3 and 9-7).

Reliance

A bank may rely on KYC information collected and verified by a reporting entity, or by a firm regulated under foreign laws giving effect to the FATF Recommendations, under a written arrangement (s 37A; Rules r 6-29). The arrangement must give the bank all KYC information before service starts (or within any permitted delay) and copies of the verification data on request, and must be reassessed at least every 2 years (r 6-30). AUSTRAC's guidance (updated 13 October 2026) treats a KYC service provider as outsourcing, not reliance: the bank stays liable.

5. Digital channels: what's different

Bottom line: the AML/CTF rules are channel-neutral, so a bank may onboard fully online, but the step of confirming the applicant is the person on the document moves from a branch comparison to a video call or biometric match, which brings privacy rules for biometric data into play.

Liveness and face matching are a method, not a mandate

AUSTRAC names biometric technology as one option but sets no liveness or presentation attack standard. The bank documents its method in its AML/CTF policies (ss 26F and 28).

Open first, release funds later

Rules r 6-13 lets an ADI open an account and accept deposits before initial due diligence is complete, provided s 29 conditions are met (delay essential to avoid interrupting business, additional risk low, policies in place). Due diligence must still be completed as soon as reasonably practicable, and until s 28(1) is satisfied the bank must not transfer money for the customer or otherwise make funds available.

Bank partnerships and outsourced onboarding

Where a technology or fintech partner runs onboarding, the bank remains the reporting entity and liable for due diligence, and APRA's Prudential Standard CPS 230 requires a register of material service providers, due diligence before entering a material arrangement, a formal agreement, and notice to APRA within 20 business days of entering an agreement for a service that supports a critical operation.

No statute mandates strong customer authentication for account access; most banks subscribe to ASIC's voluntary ePayments Code, which allocates liability for unauthorised transactions.

What is changing

The Australian Government Digital ID System opens to the private sector from December 2026 [Announced, from Dec 2026]; use of Digital ID by individuals remains voluntary. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Bill 2026 would let the AUSTRAC CEO restrict or prohibit high-risk mechanisms, including delivery channels, used to provide designated services [Passed House, before Senate].

6. Data protection and biometrics

The OAIC's facial recognition guide (29 July 2026) states that biometric templates and facial images used for automated verification or identification are sensitive information. Collection must be reasonably necessary and, under the consent pathway, made with valid consent, unless an exception applies. The OAIC recommends a privacy impact assessment and a retention and destruction protocol for biometric information.

Retention needs reconciling with s 111, which requires records of "the type and content of the data collected" for 7 years after the relationship ends.

From 10 December 2026, Australian Privacy Principle 1.7 requires privacy policies to describe the kinds of personal information used, and the kinds of decisions made, by computer programs where a decision could significantly affect an individual [Adopted, effective 10 Dec 2026].

7. Sector-specific obligations

Transitional customer identification procedures

Banks enrolled on 30 March 2026 may keep carrying out the pre-reform "applicable customer identification procedure" for named customer classes under the AML/CTF Transitional Rules 2026 s 7. For medium or lower risk individuals these included an electronic safe harbour: name plus address or date of birth verified from at least two separate electronic data sources (former Rules 2007, paras 4.2.13 and 4.2.14). From 1 July 2026 policies must list each class and the date the old procedure stops for it. The section ceases to have effect on 31 March 2029. Ongoing due diligence under the reformed s 30 applies to all customers from 31 March 2026.

Scams Prevention Framework

Under Part IVF of the Competition and Consumer Act 2010, ADI banking services were designated a regulated sector in May 2026, with ASIC as sector regulator. Banks had to join the Australian Financial Complaints Authority scheme by 1 September 2026; most principles (prevent, detect, report, disrupt, respond) apply from 31 March 2027. A banking code, consulted on by Treasury to 25 June 2026, will set out the reasonable steps expected [Draft code, consultation closed].

Operational risk and outsourcing

Prudential Standard CPS 230 Operational Risk Management (current version commenced 1 July 2026) requires ADIs to submit their register of material service providers to APRA annually and to treat providers of core technology services and risk management as material unless justified otherwise. CPS 234 Information Security also applies.

8. Risk indicators and red flags

Indicators for banks (AUSTRAC, updated 25 March 2026)

• Unverifiable ID: an identification document that cannot be authenticated, or inconsistent details across documents.
• Shared identifiers: apparently unrelated customers using the same mobile number, email or IP address.
• Short-stay accounts: a visitor or short-term visa holder opening an account during a brief stay.
• Pass-through activity: numerous outgoing payments to unrelated parties shortly after incoming funds arrive.
• Profile changes before withdrawal: a large withdrawal following changes to identification or contact details.
• Structuring: cash deposits split below the $10,000 threshold, across branches, ATMs or third parties.
• Dormant reactivation: an inactive account that suddenly shows frequent activity.
• Higher-risk IP: access from an IP address linked to a jurisdiction associated with scams.

9. Enforcement and penalties

AUSTRAC's tools include civil penalty proceedings, enforceable undertakings, infringement notices and remedial directions. The maximum civil penalty is 100,000 penalty units per contravention for a body corporate and 20,000 for other persons (AML/CTF Act s 175). At the current Commonwealth penalty unit of $364 (Crimes Act 1914 s 4AA, indexed on 1 July 2026), the corporate maximum is about $36.4 million per contravention. Failing initial due diligence is a separate contravention for each service provided to the customer (s 28(9)).

• Westpac (2020): the Federal Court declared breaches on over 19 million occasions and ordered a $1.3 billion penalty on 21 October 2020.
• Commonwealth Bank of Australia (2018): the Federal Court ordered a $700 million penalty on 20 June 2018.
• Bank of Queensland (2023, ongoing): an enforceable undertaking (s 197) after findings on customer identification, enhanced due diligence and risk assessment, with an external auditor reporting every four months.

Under the Scams Prevention Framework, tier 1 contraventions (prevent, detect, disrupt, respond) carry the greater of 159,745 penalty units, three times the benefit obtained or 30% of adjusted turnover; tier 2 (governance, reporting, codes) the greater of 31,950 penalty units, three times the benefit or 10% of turnover (Competition and Consumer Act ss 58FK and 58FL).

10. Recent changes and what to watch

• 31 March 2029[Adopted, effective 31 Mar 2029]: the transitional customer identification option ends and international value transfer service reports replace current international transfer reports. Migrate every customer class before this date.
• 31 March 2027[Adopted, effective 31 Mar 2027]: most Scams Prevention Framework principles start to apply to banks; onboarding and payment controls will be judged against the banking code once made.
• 10 December 2026[Adopted, effective 10 Dec 2026]: privacy policies must disclose automated decisions, including onboarding outcomes; the Digital ID System is also due to open to private-sector participants this month.
• Late 2026[Proposed, consultation closed 31 Jul 2026]: APRA's formal ADI licensing criteria, with the restricted ADI pathway discontinued. Applicants should plan against the draft criteria.
• 12 October 2026[Bill, passed House only]: the AML/CTF Amendment Bill 2026, introduced in the Senate, would allow AUSTRAC to restrict or prohibit high-risk products, services or delivery channels.
• 1 September 2026[Partly in force]: Scams Prevention Framework Rules 2026 commence and banks must belong to the complaints scheme for scam disputes.
• 31 March 2026[In force]: the reformed AML/CTF obligations and AML/CTF Rules 2025 apply, replacing prescriptive identification procedures with outcomes-based due diligence; on 1 July 2026 transitional policies had to name customer classes and stop dates.

11. What this means for identity verification

• Outcome, not checklist: evidence each s 28(2) matter and the steps taken to confirm the person.
• Remote person-matching: a video call or biometric face match against a government photo ID meets AUSTRAC's description; document the method and its accuracy in the AML/CTF policies.
• Document checks: DVS checks need express consent and should not be the only basis for a decision.
• Payment holds: block outflows from accounts opened before checks finish.
• Biometric governance: obtain consent, run a privacy impact assessment, and keep verification evidence separate from raw templates.
• Re-verification triggers: contact-detail changes before large withdrawals, shared identifiers and higher-risk IP addresses should prompt review under ongoing due diligence.