After the register

1 · The register is the form; ongoing due diligence is the obligation

In none of the three markets is getting onto the register the obligation. In each, it is the precondition for a set of standing duties that are far harder to evidence, and in each the duty that bites is the same one: keeping due diligence on existing customers current.

• Australia: AUSTRAC enrolment, obligations from 1 Jul 2026; Ongoing CDD under s30 of the AML/CTF Act; a documented, up-to-date ML/TF risk assessment; Transitional relief for initial CDD to 31 Mar 2029. Ongoing CDD applies now

• Singapore: ACRA registration of corporate service providers from 9 Jun 2025; revised MAS notices from 1 Jul 2025; Ongoing monitoring of every business relationship, keeping CDD data up to date by review, “particularly for higher risk categories” (CSP Regulations reg 32 and 16; MAS Notice 626 para 6.24); No relief. When a notice is revised, banks apply the new measures to existing customers “based on its own assessment of materiality and risk” (Notice 626 para 6.38)

• UK: Companies House identity verification from 18 Nov 2025; Ongoing monitoring, including “keeping the documents or information obtained for the purpose of applying customer due diligence measures up-to-date” (MLR 2017 reg 28(11)); No relief. CDD applies to existing customers at appropriate times on a risk-based approach, and when relevant circumstances change (reg 27(8))

Read across the row and the three regimes say much the same thing in different words. Singapore’s CSP Regulations put it most plainly: due diligence is performed “taking into account any CDD measures previously performed, the time when CDD measures were last performed, and the adequacy of documents, data or information previously obtained” (reg 29). The age and quality of what you already hold is part of the obligation, not a history lesson.

2 · The relief that looks like a reprieve is only half of one, and only in one market

The single most consequential misreading right now concerns existing customers.

In Australia, an existing reporting entity enrolled on 30 March 2026 may keep using its previous customer identification procedures instead of the new initial-CDD obligations until 31 March 2029. Read quickly, that sounds like three years before anyone has to touch the back book. Read the rule itself and it covers initial CDD only. It does not touch ongoing CDD, which applies now: monitoring transactions and behaviour, refreshing KYC when needed and reassessing the customer’s ML/TF risk. You cannot honestly reassess the risk of an entity customer you have never really identified, and for a company, trust or layered structure that means knowing who owns and controls it.

In Singapore and the UK there is no equivalent relief at all. MAS Notice 626 requires a bank, whenever the notice is revised, to apply the new measures to its existing customers on its own assessment of materiality and risk, taking into account when measures were last applied and how adequate the data is. The 1 July 2025 revision widened who counts as a relevant party to a trust and tightened verification of beneficial owners against reliable sources. That is a revision, and the existing book is in scope of it. The UK Money Laundering Regulations require CDD on existing customers at appropriate times on a risk-based approach, and whenever a customer’s circumstances relevant to its risk assessment change, with a change in the identity of a beneficial owner named as a trigger (reg 27(9)).

• Australia: Deferred to 31 Mar 2029 for enrolled existing entities; Applies now

• Singapore: No deferral; risk-based on revision (Notice 626 para 6.38); Applies now

• UK: No deferral; risk-based and on changed circumstances (reg 27(8)); Applies now

The only reprieve on offer, in one market, covers re-onboarding customers you already hold. It leaves untouched the duty you do have in all three: keeping those customers’ risk current, which quietly needs the same ownership data a full re-verification would.

3 · The register is getting better, which means your file can be compared against it

The UK change deserves particular attention, because it alters the benchmark rather than the obligation.

Until last November, the Companies House register recorded whoever a company said its directors and controllers were. From 18 November 2025 those people must prove who they are, and existing ones must do so within a twelve-month transition. At the same time, UK firms are already required, when carrying out CDD and ongoing monitoring on an existing customer, to take an excerpt of the register and report any material discrepancy between it and the beneficial ownership information they hold (reg 30A, with the ongoing limb in force since 1 April 2023).

Put those together and the direction is clear. As the register becomes verified, the gap between it and a firm’s own customer file becomes both easier to see and a reportable fact. A file that was never reconciled is not a neutral position; it is a list of discrepancies that has not been found yet.

Singapore points the same way from the other end. A registered corporate service provider must verify the identity of every beneficial owner “using reliable and independent sources” (CSP Regulations reg 21), and may not hand ongoing monitoring to a third party (reg 32(3)). What the provider knows about its clients is its own responsibility, not something borrowed from a register or an introducer.

4 · For the newly in-scope, the entire book is a legacy book

For the roughly 80,000 businesses AUSTRAC estimates fall within Tranche 2, the law firms, accountants, conveyancers, real-estate agents and trust and company service providers now regulated for the first time, the problem takes its sharpest form. Behind every new matter sits a client book that was never subject to CDD at all: years of company incorporations, trust formations and property transactions arranged for clients whose beneficial ownership was never resolved, because there was never an obligation to resolve it. The moment a designated service is provided to one of those clients again, the relationship is live under the regime.

Singapore’s corporate service providers face a version of the same thing. The 2024 Act brought every business providing corporate services into one registration and AML/CFT regime, prohibited acting as a nominee director by way of business unless the appointment is arranged by a registered provider, and set penalties of up to S$100,000 per breach of the AML/CFT obligations. A nominee director arrangement or a company secretarial client of long standing is exactly the kind of relationship where the ownership picture was built years ago, if it was built at all.

In both cases the task is remediation-shaped before it is software-shaped: a defined population of entities to identify, risk-rate and evidence, arriving by statute rather than by penalty.

5 · How the supervisors have said they will judge it

The three regulators describe the first period differently, but none of them describes it as a grace period for the back book.

• AUSTRAC has said it does not expect perfection on day one and will be proportionate where a business is making a genuine effort. The same statements draw a hard line around wilful non-enrolment and wilful blindness, say supervision will increase through the initial period to 2027, and make clear the test is whether a programme operates in daily practice rather than existing “only on paper”. The reforms also gave the AUSTRAC CEO new power to restrict or prohibit high-risk products, services or delivery channels.

• The FCA fined a large UK building society £44m in December 2025 for, among other failings, “ineffective systems for keeping up-to-date due diligence and risk assessments” for its personal current account customers. The breach period ran back to 2016. Out-of-date customer files are not a paperwork point in the UK; they are what the penalty was for.

• ACRA and MAS have put the obligation in the text itself: registration conditional on training and fit-and-proper tests, ongoing monitoring of every relationship, and the existing book explicitly in scope of each revision to the banks’ notice.

Proportionate is not the same as absent in any of the three. The firms that get the benefit of the doubt are the ones that can show due diligence working on real customers, which brings the question back to the data it works on.

6 · Ongoing due diligence is, at root, an ownership-data problem

Reassessing a customer’s risk, keeping their KYC current, screening them against sanctions and PEP lists, monitoring their activity, reconciling what you hold against a register: every one of these duties consumes the same input, a clean, current, machine-readable picture of who the customer is and who ultimately owns and controls it.

Where that picture is broken, a name not standardised, an ownership chain not resolved, a controlling party offshore or below a threshold, no amount of programme documentation makes the obligation deliverable, and the analyst inherits the gap as noise: false-positive screening alerts, monitoring flags nobody can triage, risk ratings that cannot honestly be refreshed. None of the three regimes created this dependency. Each has now made it a standing duty with a supervisor testing whether it is met in practice.

What to be sceptical of

Four claims circulate in all three markets that don’t survive checking:

1. “We’re on the register, so we’re compliant.” Enrolment with AUSTRAC, registration with ACRA and verification at Companies House are each preconditions. In every case the obligation is the programme that runs afterwards, on real customers.

2. “The legacy book can wait.” Australia’s transitional relief covers initial CDD for existing customers only, and ongoing CDD applies now. Singapore and the UK offer no equivalent relief: MAS applies revisions to existing customers on materiality and risk, and the UK regulations apply CDD to existing customers on a risk basis and on changed circumstances.

3. “The public register does the beneficial-ownership work for us.” In the UK the register is what you compare your file against and report discrepancies from, not a substitute for it. In Singapore beneficial owners must be verified using reliable and independent sources, and ongoing monitoring cannot be handed to a third party. A register is an input, not a verification.

4. “Regulator-ready” or “regulator-endorsed” tooling. No regulator in any of the three markets approves vendors or methods. A claim of endorsement is the quickest way to lose a compliance reader who checks.

What to do about it now

Four things, none of which require buying anything:

1. Read your own risk assessment back. All three regimes require a documented risk assessment kept up to date. Does yours honestly name the segments of your client book where you cannot currently see beneficial ownership? If it is silent on that, it is not yet the document a reviewer will test.

2. Date your existing customer book. For each segment, when was due diligence last performed, and how good was what you got? Singapore writes those two questions into the rule; Australia and the UK require the same judgement on a risk basis. The answer tells you where ongoing CDD is already overdue, relief or no relief.

3. Compare your file to the register before someone else does. For entity customers, check what you hold against the public register, particularly in the UK as verified identities flow in. Every material discrepancy is either a data fix or a report, and it is better found by you.

4. Prepare for a programme review, not a form check. Assume you will be asked to show due diligence, screening and monitoring working on real customers, not to produce the policy. Rehearse that walk-through against your actual book, not your intended one.

There is no authoritative guide to how the first period after these changes will be supervised; this is a reading of what the rules and the regulators’ own statements actually require, from the public record, so a reader can draw their own line.

Sources

• AUSTRAC: About the AML/CTF reforms: summary of changes for current reporting entities

• AUSTRAC: Ongoing customer due diligence; AML/CTF Act 2006 s30

• AUSTRAC: Transitioning existing customers (initial-CDD transitional relief, 31 Mar 2026 to 31 Mar 2029); AML/CTF transitional rules 2026

• AUSTRAC: Update to regulatory expectations for implementation of the AML/CTF reforms; regulator statement of expectations, May 2026; CEO speeches, 2025 and 2026

• AUSTRAC: enrolment timetable and ~80,000 Tranche 2 entities estimated in scope

• ACRA: Corporate Service Providers Act 2024 (in force 9 Jun 2025): registration, nominee directors, penalties

• Corporate Service Providers Regulations 2025 (S 292/2025), regs 16, 19, 21, 29 and 32

• MAS: Notice 626 (28 Mar 2024, last revised 30 Jun 2025), paras 6.19 to 6.24 and 6.38

• MAS: revised AML/CFT notices and guidelines, effective 1 Jul 2025

• UK: Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regs 27(8) and (9), 28(11) and 30A(2A)

• Companies House: identity verification, in force 18 Nov 2025, twelve-month transition for existing directors and PSCs

• FCA: final notice and press release, £44m fine on a building society for financial crime control failings, 12 Dec 2025

Scope figures are AUSTRAC’s own estimate of entities in scope, not a count of completed enrolments. Every obligation cited is drawn from the regulators’ own guidance, the Acts, Regulations and Notices, or government reform materials in each market.

Published by Dligence as part of the “What Good Looks Like” series. Dligence is a compliance-data company; this paper is analysis of the public regulatory record, is not legal advice, and no part of it implies regulatory endorsement of any provider or method.