A provider timeout, exhausted allowance or unsupported document does not establish a clear result about the customer. It establishes a limit in the checking process. Keep that distinction visible, decide what work must wait and use another method only where it genuinely meets the required matters. A continuity procedure should prevent invented passes, repeated charges and staff quietly bypassing controls under deadline pressure.
Record what failed without changing its meaning
Identify the check type, customer reference, request time and technical outcome. Separate not submitted, awaiting result, technical failure, unsupported and an actual adverse result. Avoid putting sensitive documents or raw provider messages into a general incident log. Assign someone to determine whether the original request reached the provider before retrying. A successful payment or a created request identifier is not evidence that identity or screening was completed.
Decide the lawful service boundary
Identify which CDD matter depends on the unavailable result and whether it can be established using another permitted method. Apply the practice's policies and relevant customer-type requirements. If required matters remain unmet, restrict the affected work; a service outage does not itself create a delayed-CDD permission. Keep customer communication factual and helpful, explaining the outstanding step and available process without disclosing protected internal reporting material.
Use a real alternative rather than a manual pass
For example, a digital service may not support the customer's document. An authorised reviewer might assess other reliable, independent evidence under the applicable procedure. Record what was examined, the source, the reviewer and how the conclusion was reached. Do not tick verified simply because a staff member looked at an uploaded image. Identity, authority, beneficial ownership, sanctions and risk are separate matters; an alternative for one does not complete the others.
Reconcile the outstanding requests after recovery
Check for late results, duplicate submissions and charges, and connect every retained result to the correct customer and original request. Reconsider decisions if later information conflicts with an interim assessment. Record the incident's scope, controls used and any remediation, then review supplier arrangements and access to evidence. A restored status page should close the technical incident only after pending casework has been reconciled and ownership of unresolved files is clear.
Official sources
Confirm the current rules against these primary sources, last checked .
Questions
Does provider unavailable mean customer failed?
No. It is a process outcome. Keep it distinct from a genuine verification failure or a supported adverse finding.
Can staff always replace a provider with a manual check?
No. The alternative must meet the applicable law and the practice's approved procedures, with appropriate evidence and authority.
Should every failed request be retried immediately?
First determine whether it was submitted and whether a result is pending. Uncontrolled retries can create duplicate casework or charges without resolving the original uncertainty.
General information for Australian professionals, not legal advice. It does not replace the AML/CTF Act, the Rules or AUSTRAC guidance. See our editorial standards.
Keep reading
- Identity verification options4 min
The verification paths Australian reporting entities can use under AML/CTF: document-based checks, electronic identity providers and the Document Verification Service.
- When initial CDD is incomplete3 min
Distinguish a missing document, inconsistent information and an unresolved identity question before allowing a designated service to proceed.
- Outsourcing versus CDD reliance3 min
Identify whether another business performs AML functions, supplies a tool or provides CDD for lawful reliance, then document responsibilities and records access.