efex
AML/CTF and the Privacy Act · Accounting
Obligations commenced 1 July 2026

Managing identity records across AML/CTF, privacy and professional obligations

AML/CTF requirements affect what client identity information your firm must collect, verify and retain. These records may also be subject to obligations under privacy legislation, tax practitioner regulations and professional standards. As a result, how identity records are stored, accessed, retained and disposed of is just as important as their collection.

Start the checklist now to understand how your firm's systems and controls support the secure management, protection and retention of client identity records.

  • Hold securely
  • Restrict access
  • Manage retention
  • Prepare for breach response
  • Evidence the controls
Start here
When you verify a client's identity, what happens to the document?
Start the checklist

13 questions, about 3 minutes. No client files or documents are required.

Services that may be captured

Your practice may already verify some clients, but the new rules capture specific accounting services.

Company or trust formation and restructures
Managing client money, accounts or assets
Acting on the buying or selling of a business
Providing a registered office or nominee arrangements

If any of these apply, here is what the legislation now requires of your practice.

WHAT THE LEGISLATION SAYS — YOUR NEW REQUIREMENTS

AML/CTF, privacy, tax file number and professional obligations all affect how identity and tax records are managed.

The AML/CTF reforms require many accounting practices to identify clients, verify information and retain records. Depending on the services your practice provides, those same records may also be subject to privacy, tax file number and professional confidentiality requirements.

In short: Identity and tax records may now be subject to multiple obligations at the same time, affecting how they are collected, stored, accessed, retained and disposed of.

AML/CTF Act

Administered by AUSTRAC

The AML/CTF Act requires captured accounting practices to identify clients, verify information and retain records that demonstrate compliance for seven years.

  • Identify and verify clients
  • Record how identification was carried out
  • Retain required records for seven years
  • Protect suspicious matter reporting information from disclosure
Up to $36.4m maximum civil penalty per contravention of the AML/CTF Act, for a body corporate

Read the legislation: AML/CTF Act 2006 (current compilation) · Amendment Act 2024

Privacy Act and the TFN Rule

Administered by the OAIC

Privacy obligations govern how personal information, including tax file number information, is collected, stored, accessed and disposed of.

  • Protect information from loss and unauthorised access
  • Limit collection to what is reasonably necessary
  • Apply the TFN Rule to the collection, storage, use, disclosure, security and disposal of tax file number information
  • Destroy or de-identify information when no longer required, unless retention is required by law
Up to $50m maximum penalty for serious or repeated interference with privacy, for a body corporate — or 30% of adjusted turnover if greater

Read the legislation: Privacy Act 1988 · Privacy (Tax File Number) Rule 2015

Professional obligations

Tax Practitioners Board and APES 110 Code of Ethics

Tax practitioners must verify client identity in line with Tax Practitioners Board requirements and keep client information confidential under the professional code.

  • Verify client identity before providing tax agent or BAS services
  • Keep sufficient evidence that the verification was completed
  • Maintain client confidentiality under APES 110
  • Restrict access to client information to authorised personnel

Read the guidance: TPB proof of identity requirements · APES 110 Code of Ethics

ATO record-keeping

Administered by the ATO

Tax records must be kept for the periods set by the tax law, generally five years, and secured against unauthorised access.

  • Keep tax records for the periods required by the tax law
  • Keep records accurate, complete and retrievable
  • Secure taxpayer information against unauthorised access
  • Report identity-related compromises to the ATO where required

Read the guidance: ATO record-keeping for business

What this means for your practice

AML/CTF is not simply about collecting identity, tax and client records. The same records may be subject to AML/CTF, privacy, tax file number and professional obligations at the same time. The common thread across all of them is the need for secure storage, controlled access, appropriate retention and evidence of compliance.

Here is a practical sequence for putting that in place.

Action plan

What your business needs to do now

Ten practical steps to ensure your business is ready.

Steps 1–5 are for you and your advisor, steps 6–10 relate to your IT systems. Complete the short checklist to understand where your firm stands against steps 6–10. It's only 13 questions, and takes just 3 minutes to complete. If you'd rather have one of our specialists review your systems with you, book a no obligation consultation with us today.