Knowing who sent an email is different from knowing whom they represent and what they can authorise. Accounting practices often deal with directors, employees, family members and external advisers. For a designated service, make the relationship explicit. A representative's successful identity check does not by itself prove authority, and an authority document does not establish every other matter required for the customer's CDD.
Draw the customer and representative relationship
Start with the service and its customer definition. Record the legal person receiving the service, the individual communicating with the practice and the role they claim. Do not assume the invoice recipient, shareholder, bookkeeper and customer are interchangeable. Where one person acts for several entities, keep a separate authority link for each relevant entity and matter. This is especially useful when a group uses one shared accounts email address.
Record the scope and basis of authority
AUSTRAC's individual-customer guidance addresses both a representative's identity and authority, including applicable simplified-verification conditions. Apply the customer-type rules and your risk-based policies rather than inventing a universal document list. In practical terms, note what the person can instruct, the document or independent information supporting that power, any expiry or limits, and who checked it. Escalate conflicting instructions instead of selecting the most convenient signatory.
Distinguish ordinary administration from a new decision
For example, a long-standing payroll contact may be authorised to send employee changes but not to direct a company restructure or dispose of a business asset. Before acting on the new instruction, ask the customer through an established channel to confirm the authority and its extent. Do not use a new phone number supplied in the disputed instruction as the only confirmation source. Record the response and remaining concerns.
Keep authority current at material changes
A departed director, revoked power or replaced trustee can make an old authority record unsafe. Include changed representatives and unexpected instructions in review triggers. Keep the identity and authority conclusions separately visible, with the evidence supporting each. Tell the team what work is paused while authority is unresolved, and record who may approve resumption. This avoids a completed KYC badge being mistaken for an unrestricted right to instruct.
Official sources
Confirm the current rules against these primary sources, last checked .
Questions
Is an email from the customer's domain enough?
It may be relevant information, but a domain alone does not establish the person's role, authority or the extent of the instruction.
Must every representative supply the same documents?
No. Apply the relevant customer-type provisions, any available conditions for simplified verification and your documented risk-based procedure.
Can a professional adviser confirm their own authority?
Treat self-asserted authority as a claim to assess. Obtain appropriate supporting information and consider independence when selecting corroboration.
General information for Australian professionals, not legal advice. It does not replace the AML/CTF Act, the Rules or AUSTRAC guidance. See our editorial standards.
Keep reading
- Entity CDD for tax practices4 min
A practical CDD workflow for tax practices onboarding companies, partnerships, trusts and SMSFs for designated services under Australia's AML/CTF regime.
- Corporate trustees and control maps3 min
Keep company shareholders and directors separate from trust roles when tracing the people relevant to an accounting client's designated service.
- Correcting a customer record3 min
Correct inaccurate customer information, reassess affected checks and retain the necessary history without treating an audit log as a reason to leave bad data in use.