Deeper checks for higher-risk customers

When your program's risk assessment says it does. The common triggers are:

• Politically exposed persons
• Customers in high-risk jurisdictions or industries
• Unusual transaction patterns
• Anything an analyst escalates on judgement

The trigger rules are yours to define, and that is not a gap in the regime: a risk-based program requires you to make those decisions instead of having them prescribed. What AUSTRAC expects is that the depth of checking matches the rating your own program assigned, consistently, and that both the rating and the response are evidenced.

Five, and each returns separately so a finding can always be traced to where it came from:

• Australian court records — more than 40 million listings
• Adverse media coverage
• Global PEP and sanctions lists, across 268+ countries
• ASIC company data
• Social intelligence, drawn from 980 million-plus social and employment records

Keeping the sources separate, instead of merging them into a single risk figure, is deliberate. An analyst reviewing a case needs to know whether a concern rests on a court judgement or on a news article, because those warrant very different weight.

Coverage spans Australian civil and criminal listings across jurisdictions, and each result includes the court, the matter type and the listing date.

Those three fields are what make a finding usable. They let an analyst locate the underlying record instead of acting on a bare name match, which for common names is essential: a listing without identifying context is as likely to mislead as to inform.

Be clear that a court listing records that a matter was before a court, not necessarily how it concluded. That is precisely why the listing is a starting point for review, not a finding in itself.

It identifies the individuals who ultimately own or control a corporate customer, so the due diligence reaches the people instead of stopping at the entity.

This matters because a company is a poor subject for enhanced due diligence on its own. Entities do not have court histories or adverse media profiles in any meaningful sense; the people behind them do. Mapping ownership to linked entities and controlling individuals is what makes the rest of the search worth running.

It also surfaces the structures built specifically to obscure that link: layered holdings, nominee arrangements, and clusters of entities sharing officers.

Findings queue as a case with the evidence attached, instead of arriving as alerts an analyst has to research from scratch.

An analyst records the outcome (retain, restrict or exit) and the decision trail stays on the customer file alongside the evidence it was based on.

That structure matters because the output of enhanced due diligence is a decision, not a report. A process that surfaces concerns without recording what was concluded leaves you with the worst of both: you knew about the risk and cannot show what you did about it.

Yes. Keeping a high-risk customer can be entirely the right call, and enhanced due diligence is not a process designed to produce exits.

What makes the decision defensible is the record: what was checked, what was found, who reviewed it, what they concluded, and on what basis. A documented decision to retain a customer after a thorough review is a strong position. An undocumented one is indistinguishable from not having looked.

The same applies to restriction, which is often the proportionate answer: retaining the relationship with tighter limits, closer monitoring, or additional approval requirements.

The customer stays under monitoring. New court listings, media coverage or list matches re-open the review instead of waiting for the next scheduled check.

This is the difference between due diligence as an event and as a state. A customer cleared in March may be the subject of proceedings in July, and a program that revisits them at the next annual review has a five-month gap during which the file says they are fine.

WatchEye holds the risk tier, triggers enhanced due diligence when a customer crosses a threshold, and keeps monitoring after the review has closed.

The checks draw on public records and licensed data, used for due diligence purposes permitted under the AML/CTF Act and the Privacy Act, and your permitted purpose is confirmed during account setup, not assumed.

That confirmation step is the control. Court records, adverse media and social intelligence are available at this depth because access is limited to organisations conducting due diligence for a recognised purpose, and use is bounded by that purpose.

In practice it means these searches support a customer risk decision. They are not available for marketing, and they are not a general-purpose background service.