AML and KYC checks: why lenders verify you

Before a loan settles, almost every borrower is asked to prove who they are and to explain where some of their money has come from. To someone in a hurry these identity checks can feel intrusive or repetitive, but they exist for clear legal reasons. This lesson explains why lenders run anti-money laundering checks, what documents they commonly request, how companies and trusts are looked through to the real people behind them, and how to tell a genuine request from a scam that borrows the same language.

Why lenders check identity and source of funds

The legal obligation

Australia's anti-money laundering and counter-terrorism financing regime, built around the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, places obligations on businesses that provide certain financial services. Lending money in the course of a business is generally one of them, which means banks, non-bank lenders and many private lenders are covered.

Those businesses are usually expected to:

• identify and verify their customers before providing the service;
• understand the nature and purpose of the business relationship;
• identify the individuals who ultimately own or control a customer that is an entity;
• keep monitoring customers and transactions over time;
• report certain matters and transactions to the regulator;
• keep records of what they did.

Together these steps are often called AML/KYC, short for anti-money laundering and know your customer.

The regulator

AUSTRAC, the Australian Transaction Reports and Analysis Centre, is the Commonwealth agency that regulates these obligations and acts as the country's financial intelligence unit. It publishes guidance for the businesses it regulates and can take action when they fall short. The rules are periodically reformed, and the range of businesses covered has been changing, so lenders and other professionals involved in property transactions may ask for more than they did in the past. AUSTRAC's own website is the place to check the current position.

Beyond the law

Lenders have commercial reasons to verify you too. Checking identity helps prevent someone impersonating a property owner to borrow against their home, ensures security documents are signed by the right people, and supports accurate registration of a mortgage. In that sense the checks protect borrowers as well as the financial system.

Documents lenders usually request

Exact requirements differ between lenders, and the list below is a general guide rather than a set standard. Our lesson on documents lenders ask for covers the wider loan file, and the preparation checklist helps you gather everything in one place.

For individuals:

• photo identification such as a passport or driver licence;
• a second form of identification, which may include a birth certificate, citizenship certificate or a government card;
• evidence of residential address, such as a recent utility bill or council rates notice;
• in some cases, evidence of a change of name.

Lenders may verify these electronically against official records, sight originals in person, or accept copies certified by an authorised person. Ask which method the lender uses before you post anything.

For source of funds or wealth:

• bank statements showing how a deposit or contribution accumulated;
• a contract of sale or settlement statement if funds come from selling another asset;
• a signed gift letter and the giver's statements if family money is involved;
• business financial statements where the funds come from trading income.

Companies, trusts and beneficial owners

When the borrower is not an individual, the lender needs to look through the structure. A beneficial owner is a real person who ultimately owns or controls the entity, directly or indirectly. Lenders identify those people so a loan cannot be used to hide who is really behind a transaction. Our lesson on borrower structures explains why people borrow through these entities.

For a company, expect to provide the company name and registration details, a current company extract, identification for each director, and details of the shareholders who own or control it. Where another company is a shareholder, the lender may follow the chain until it reaches individuals.

For a trust, expect to provide a copy of the trust deed and any amendments, details of the trustee and, if it is a corporate trustee, the company documents above. Lenders may also ask who holds powers such as the appointor role, and about the beneficiaries or classes of beneficiaries. A discretionary trust and a bare trust are treated differently, so be clear about which you have.

The legal test for who counts as a beneficial owner is set by the law and AUSTRAC guidance; this lesson does not set out any ownership percentage. If your structure is layered or offshore, allow extra time and ask your accountant or lawyer to prepare a simple ownership diagram.

A worked description

Consider a hypothetical family trust buying a commercial property with a private loan. The trustee is a company with two directors. The lender asks for the trust deed, a company extract for the trustee, identification for both directors, and details of who can appoint or remove the trustee. It also asks where the equity contribution is coming from. The family supplies bank statements showing the funds arriving from the sale of an earlier property, together with the settlement statement for that sale. Because everything is provided at once and the documents tell a consistent story, verification is completed well before settlement.

How your information should be handled

Identity documents are valuable to criminals, so it is reasonable to ask how a lender protects them. Lenders and brokers covered by Australian privacy law must handle personal information in line with that law, which includes telling you why they collect it, who they may share it with and how you can access it. Anti-money laundering rules also require lenders to keep certain records for a period, so a lender may not be able to delete your documents on request. Ask for the lender's privacy policy, and prefer secure portals over email attachments. If a broker or lawyer is collecting documents on the lender's behalf, ask who will hold the copies once the loan settles.

Recognising scams that imitate identity checks

Criminals know borrowers expect identity requests, so they copy them. Common signs include:

• an unexpected email, text or call saying your loan cannot proceed until you verify your identity;
• a link to a document upload site that is not on the lender's official domain;
• requests for passwords, banking logins or one-time security codes;
• a fee to complete verification, often payable to a personal account or in cryptocurrency;
• pressure to act within hours, or a claim that settlement will collapse otherwise;
• changed bank details for paying a deposit or fees.

Genuine lenders and their lawyers may ask for documents, but they do not need your passwords and should not ask you to send money to prove who you are. Before responding, contact the lender using details from its official website, the ASIC register or your existing loan papers. Our guide on scams and red flags covers other warning signs, and Privet's scams warning explains how people sometimes impersonate legitimate businesses. Report suspected scams to Scamwatch. If you think your identity documents have been misused, contact the organisations that issued them promptly, and see the Office of the Australian Information Commissioner for information on privacy and data breaches.

Common mistakes

• Leaving identity until the last week. Certified copies and entity searches take time.
• Sending documents over insecure channels. Ask the lender for its secure upload method.
• Inconsistent names or addresses. Mismatches between documents trigger extra questions.
• Unexplained deposits. Be ready to explain any large or unusual transfer.

What to ask

1. Which identity documents do you need, and do you verify electronically, in person or by certified copy?
2. What information do you need about the owners and controllers of my company or trust?
3. What evidence of the source of my funds will you accept?
4. How will my documents be stored and protected?
5. What is your official contact method, so I can confirm any request is genuine?

You can also check that a lender holds the licences it claims using our guide on how to check a lender.