Do you know who your clients really are?

The article is relevant to members in Australia and was current at the time of publication.

According to the Australian Taxation Office (ATO), attempts by fraudsters to impersonate taxpayers, misuse stolen identity information and pressure tax professionals into acting on fraudulent instructions is on the increase. This growing threat highlights the importance of vigilance in client verification. 

“We have seen an increase in identity crime enabled fraud and scaled fraud attempts on our digital systems regularly,” says Claire Miller, ATO’s Acting Chief Digital Officer. “Across the tax and super systems, global threats, organised crime and data breaches continue to increase the risk and drive a growing prevalence of attempted attacks.

“Data breaches allow fraudsters to effectively steal people’s identity,” Miller adds. “They can pose as legitimate taxpayers when they have enough data. They can impersonate people’s identities and take over their ATO accounts.”

Know your client requirements 

Knowing your client is a key requirement of Australia’s expanded anti-money laundering and counter-terrorism financing (AML/CTF) reforms, which come into effect on 1 July this year.  The obligations extend beyond identity checks and document collection.

Accountants who offer “designated services” such as helping clients buy, sell or transfer real estate or legal entities, should already be enrolled with AUSTRAC. 

Jodie Smith, Best Practice Program Manager CPA Australia, says for practices with strong governance processes, much of the groundwork around client due diligence and risk assessment has already been done.

“Members with systems of quality management and risk management frameworks in place would have identified some of these risks in other areas and know their clients sufficiently well, so most of the obligations will be fairly straightforward,” she says.

However, Smith adds that non-compliance comes with serious risks. “At the most serious end of the spectrum, firms that fail to properly identify clients who are linked to money laundering or terrorism financing could face heavy penalties, including potential jail time,” she says.

Beyond compliance and legal risks, it makes sense to identify your clients for both practical and precautionary reasons. Weak due diligence can lead to accepting high-risk or inappropriate clients, or missing money laundering red flags such as complex company structures. Gaps in client knowledge can also undermine audit quality. 

Not knowing your clients and having inadequate documentation can also lead to debt recovery issues if your clients are not who they say they are. And, as client identity and verification processes are increasingly tied to digital systems, you can also expose your practice to cybersecurity threats. 

If you do not take the required steps to identify your clients, your practice may also be misused for financial crime. AUSTRAC estimates that serious and organised crime costs the Australian economy about A$68 billion a year.

You can potentially expose your practice to huge risks if a client is involved in criminal activity or receives proceeds of crime or money laundering,” Smith says.

“Knowing your client is not just an onboarding task, it requires ongoing monitoring throughout an entire engagement to look for suspicious behaviour,” Smith adds. “This helps you from being caught up in illegal activities.”

Meeting your obligations 

Under changes to the AML/CTF Act, accountants must enrol with AUSTRAC, provide annual compliance reports, and report suspicious transactions, cash transactions exceeding A$10,000 and instructions to transfer value into or out of Australia.

You are also required to create an “AML/CTF program” that includes the policies, procedures and controls you use to identify, mitigate and manage money laundering and terrorism financing risks.

In 2022, the Tax Practitioners Board (TPB) and the ATO published mandatory verification requirements. Accountants need to undertake Proof of Identity checks before providing tax agent or BAS services to new clients and on an ongoing basis for existing clients.

The requirements are closely aligned in terms of the types of identity verification, but while the ATO’s requirements are primarily for tax and BAS agents who use the ATO’s online services, the TPB’s apply to all tax practitioners, regardless of whether they use the ATO’s online services or not.

Neville Birthisel, Advisor Policy and Advocacy CPA Australia, says TPB verification requirements are closely aligned with those of AUSTRAC.

“Work is underway between the TPB and AUSTRAC to reduce duplication and clarify where obligations align,” he says. “The goal is to make clear what practitioners are already doing, and what needs to be added.

“For example, under AML/CTF, you need to have identified all the beneficiaries of a trust regardless of whether they’re getting a distribution or not, whereas under TPB, it’s only required if they’re getting a distribution.”

AUSTRAC has published a AML/CTF program starter kit for small accounting firms to help them build on their current process for identifying clients. 

“It includes onboarding templates you can use to compare against existing processes,” Birthisel says. “In many cases, it’s a matter of adding a handful of extra steps rather than starting from scratch.

“If you’re already meeting your TPB obligations, you’re well on the way to complying with AML/CTF,” he adds. “Knowing your clients is pretty fundamental for any competent, ethical practice.”