Learn more

Beyond the basics: tackling complex client due diligence under Tranche 2

Beyond the basics: tackling complex client due diligence under Tranche 2

As Australia’s Tranche 2 AML/CTF reforms draw closer, law firms are entering a new era of client due diligence (CDD).

The days of simply seeing a passport or requesting certified copies are over. Under the proposed changes, legal professionals must take reasonable steps to identify and verify not just individual clients, but also beneficial owners and controlling parties, even when those structures are complex or cross borders.

That’s precisely where things get challenging.

 

The hidden risks behind complex client structures

Many legal clients, especially in commercial, property or private wealth matters, come with multi-layered ownership structures involving trusts, nominee arrangements or offshore entities.

While these structures aren’t inherently suspicious or illegal, they can be easily misused to conceal the true identity of individuals behind a transaction.

Criminal networks frequently exploit this complexity to:

  • Conceal the source of funds
  • Mask the true ultimate beneficial owner (UBO)
  • Hide UBOs involved in criminal or illicit activity
  • Distance illicit activity from enforcement scrutiny

In its report on major banks, the governing body in Australia for anti-money laundering and counter-terrorism financing (AML/CTF), AUSTRAC, assessed that non-individual customers pose a higher risk of money laundering and terrorism financing, precisely because of their ability to obscure ownership, the source of funds or the purpose of transactions.

Three common tactics used to hide true ownership

1. Layering entities across jurisdictions

A multi-layered ownership structure is already complex. But what if ownership and control are not only spread across several levels, but also across several jurisdictions?

For example, a company incorporated in Australia may be owned by a trust in the Philippines, which is controlled by an entity in the U.K. Each jurisdiction has its own privacy laws and disclosure requirements. This tactic makes it extremely difficult to trace ownership back to the individuals who ultimately control or benefit from the Australian company, particularly when local registers don’t necessarily provide public or reliable access to data.

2. Trusts and nominees to separate UBOs from legal owners

Trusts are often used for legitimate asset protection or estate planning, but in the wrong hands, they can provide a convenient mask for the actual owner. When a nominee or trustee holds assets on someone else’s behalf, it creates a layer of separation between the legal and beneficial owner.

This becomes even more confusing when the trustee is swapped frequently or located in a low-transparency jurisdiction.

3. Shell companies to add complexity without substance

Shell companies are entities with no physical presence, staff or real business operations that can be used to hold assets or move funds. However, they can also be used to obscure ownership.

When one shell company owns another, and that entity is controlled by a trust or nominee in another jurisdiction, tracing the UBO becomes a near-impossible task without sophisticated tools.

Often, these three tactics are used in combination, multiplying the complexity, confusion and risk. Unfortunately, manual due diligence processes fall short when trying to unravel such intricate structures.

Why this matters for law firms under Tranche 2

Under Tranche 2, legal professionals providing certain regulated services will need to:

  • Identify and verify the true UBOs (initial CDD).
  • Assess the purpose and nature of the client’s activity.
  • Monitor client risk on an ongoing basis throughout the client relationship (ongoing customer due diligence, or OCDD).

Failure to identify the real person behind a transaction can expose your firm to serious consequences, including audits, civil penalties and reputational damage.

How technology can unravel complex ownership

This is where technology-enabled identity verification (IDV) plays a critical role.

Rather than relying on fragmented, manual processes, law firms can use intelligent, automated tools to streamline CDD, reduce fraud risk and meet their Tranche 2 obligations, even for complex client structures.

Today’s advanced IDV platforms bring together a suite of technologies that work in tandem to uncover the true identity behind even the most layered arrangements.

These platforms don’t just verify identity; they analyse patterns, flag discrepancies, and connect data points across borders, jurisdictions and document types, providing a comprehensive solution for complex client due diligence.

Here’s how they do it:

  • Biometric authentication: Match a live selfie to an official photo ID, ensuring that the person presenting the document is genuinely who they claim to be, and not a proxy, impersonator or "straw man".
  • AI-powered document analysis: Automatically extract and verify key data from passports, driver’s licences, corporate records, and trust deeds, even across different jurisdictions, helping flag forgeries or inconsistencies that manual review might miss.
  • Real-time watchlist checks: Instantly screen individuals and entities against the most up-to-date politically exposed persons (PEP) lists, sanctions and adverse media databases. For clients with offshore connections, this is crucial in identifying hidden risks.
  • Discrepancy detection: Cross-reference information from multiple sources, such as corporate registries, government records, and credit bureaus, to identify inconsistencies or red flags more quickly.
  • Tamper-resistant processes: Protect against fraud by minimising human error and document manipulation.
  • Audit-ready records: Store detailed, time-stamped logs of every verification decision to support AUSTRAC audits and Tranche 2 obligations. These records provide a clear audit trail, making it easier for your firm to demonstrate compliance during audits.

By embedding these tools into your onboarding workflow, your team doesn’t need to spend hours chasing documents and manually checking and understanding structures.

Instead, they can focus on interpreting the insights the system surfaces, such as a suspicious link to a high-risk jurisdiction or a mismatch between stated and verified ownership.

Delivering security without compromising experience

Importantly, digital verification doesn’t mean adding more hoops for legitimate clients. Quite the opposite. Clients can complete identity checks on any device, from anywhere, eliminating the need for in-person appointments, physical paperwork, or lengthy email trails. For international clients, directors or UBOs, this creates a much smoother and faster experience while still meeting your firm’s regulatory obligations.

Final thoughts

From July 1 2026, Tranche 2 will demand more from legal professionals, especially when it comes to verifying high-risk or complex clients. But complexity doesn’t have to mean compromise.

By integrating advanced IDV technology into your onboarding and compliance processes, your firm can confidently fulfil its obligations, mitigate fraud risk and maintain a high standard of client service.

Need help simplifying your AML/CTF compliance?

Partnering with a trusted provider like GBG can ensure you meet all regulatory requirements while minimising disruption to your client experience. Contact our team of experts today to learn more about how we can help.