Most firms treat KYC as a task you finish. You verify the client at onboarding, tick the box, file the result, and move on to the compliance work. The identity check sits in a folder somewhere, done.

AUSTRAC sees it differently. The check at onboarding is the start of your obligation, not the end of it. And for a firm running thousands of clients through lodgement season, that gap between "checked once" and "checked on an ongoing basis" is where most of the risk lives.

Now that accounting firms fall under the expanded AML/CTF regime, it's worth being clear about what the ongoing part involves. This is general, not legal advice, and your program is yours to define. But the practical shape of ongoing customer due diligence is fairly consistent across firms. Here's what it looks like on the ground.

The category error: one-off versus ongoing

The onboarding check is called initial customer due diligence. You confirm who the client is, who owns the entity, and whether anything flags. That's step one.

Ongoing customer due diligence is the part firms forget. It means keeping that picture current for the life of the relationship. A client who was clean when you onboarded them can change. A new director joins. A name gets added to a sanctions list. A trust restructures and the beneficial owners shift.

If your last check was eighteen months ago, you're relying on data that's eighteen months old. AUSTRAC expects you to notice when the picture changes, not to assume it never will.

PEP and sanctions on a schedule

Two of the checks you're expected to keep current are politically exposed persons and sanctions.

A politically exposed person, or PEP, holds a prominent public role, or is close to someone who does. They aren't barred from being your client. They carry higher risk, so you're expected to know and to keep watching.

Sanctions screening checks a client against government and international lists of people and entities you can't deal with. Both of these lists move. Names get added. Circumstances change. A PEP result that came back clean last year can read differently today.

That's the core reason a single check doesn't hold. Screening a client once tells you about the day you screened them. Ongoing CDD means running PEP and sanctions checks on a schedule, so the result reflects now, not the day the engagement started.

Beneficial ownership for trusts and companies, down to 25%

Ultimate beneficial ownership is where it gets fiddly, and where manual processes tend to break.

A beneficial owner is the real person who owns or controls an entity. For a company or a trust, you're expected to trace ownership down to anyone holding 25% or more. Not the company on the letterhead. The people behind it.

For a mid-tier firm, this is the daily reality. Your client book is mostly SMEs, and the individuals behind those SMEs are the beneficial owners you need to identify. Layered trusts, corporate trustees, holdings inside holdings. Tracing all of that by hand, for every entity, and then keeping it current as structures change, is slow and easy to get wrong.

The busy-Thursday failure mode

Picture a 40-accountant firm in the middle of lodgement season. The admin team is buried. Signatures out, payments to chase, the ATO on the phone.

KYC is being run the manual way. A spreadsheet tracking who's been verified. Identity checks pushed through a legacy tool or the post. A note somewhere about when each client is due to be re-screened.

On a normal Thursday, here's what slips:

• The re-screening date nobody diarised.

• The UBO trace on a new entity that got half-finished.

• The PEP result that came back with a flag while three other things were on fire, so it got parked and never revisited.

None of that is negligence. It's volume. When one team is carrying compliance checks for thousands of clients by hand, the ongoing part is the first thing to fall behind. And ongoing is exactly the part AUSTRAC cares about.

How Admiin fires it automatically and keeps the trail

Admiin runs KYC and AML screening inside the same workflow your team already uses for lodgements. One click after you send the engagement letter or the tax document. No separate tool, no separate login.

That one click covers the full set:

• Identity verification through the DVS

• PEP screening

• Sanctions screening

• KYB for the business

• UBO identification down to the 25% threshold

When you're bringing on a book of clients or catching up on re-screening, you can bulk verify up to 1,000 at once instead of working through them one by one.

The results land in a compliance dashboard. Every client sits in one of three states:

• Verified, the check passed and the client is current.

• Pending, the check is running or waiting on something.

• Failed, with the reason shown, so your team knows what to action rather than guessing.

The busy-Thursday problem stops being about memory and diaries, because the status is on screen for the whole firm to see.

The other half of this is the audit trail. Every check is logged and timestamped. If AUSTRAC asks what you did and when, you can show them, rather than reconstructing it from a spreadsheet and someone's inbox. The screening is AUSTRAC-aligned and built into the workflow, so keeping the picture current becomes part of the job instead of a task that competes with it.

Ongoing CDD isn't a bigger version of the onboarding check. It's a different habit: keep verifying, keep the trail, notice when things change. For a firm running thousands of clients, that habit only holds if the tooling does the remembering for you.

See how it works

Want to see PEP, sanctions, and UBO screening run from inside the lodgement workflow, with the full compliance dashboard? Book a demo or see how it works.

The core product is free. Firms pay for white label and KYC screening, so you can put the ongoing part of your AML obligations on autopilot without adding tools or headcount.