What an AI Onboarding Agent May Do Before KYC Verification Completes
Section 6-12(5) of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (F2025L01026) gives a reporting entity 20 business days after commencing a designated service to complete initial customer due diligence under that section’s delayed-verification circumstance. Inside that window an AI onboarding agent can collect KYC information and explain requirements. It cannot conclude verification: s 28(1) of the AML/CTF Act 2006 binds the reporting entity.
- The Rules were registered on the Federal Register of Legislation on 29 August 2025 and commenced 31 March 2026 (Compilation No. 1).
- AUSTRAC states that “From 1 July 2026, new anti-money laundering and counter-terrorism financing (AML/CTF) laws will apply to designated services commonly provided by” legal professionals, accountants, conveyancers, real estate professionals, and dealers in precious metals, stones and products.
- The period is not uniform: s 6-14(3) allows 5 business days, s 6-32(4) the earlier of 28 days after exchange of contracts and 3 days before the initially agreed settlement day, and ss 6-13 and 6-15 specify no period at all.
- Reliance on another entity’s work (Division 8, ss 6-29 to 6-31) does not move record-keeping: ss 37A(2) and 38 deem compliance for “this Act (other than Part 10)”, and Part 10 is the record-keeping Part.
This is general information about published rules, not legal or compliance advice.
Delayed verification is a conditional exemption under section 29
Section 28(1) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 is the default: a reporting entity must not commence to provide a designated service if it has not established on reasonable grounds each matter in s 28(2) — from the customer’s identity through beneficial owners, politically exposed person and sanctions status, to the nature and purpose of the relationship. Section 28(1) is a civil penalty provision, and s 28(9) makes each designated service a separate contravention.
Section 29 is the only provision that lets a reporting entity commence before it complies with s 28(1), and it has six cumulative limbs: circumstances specified in the Rules apply (a); the entity determines on reasonable grounds that starting early is “essential to avoid interrupting the ordinary course of business” (b); it has policies to comply with s 28(1) as soon as reasonably practicable and within any period the Rules specify (c); it determines on reasonable grounds that the additional risk is low (d); it implements policies to mitigate and manage that risk (e); and it meets any further requirements in the Rules (f).
Paragraphs (b) and (d) are judgements a reporting entity makes about its own business. An automated agent does not make them; it operates inside a decision an accountable human has written into the AML/CTF program.
The five delayed-verification sections and the conditions attached to each
Four sit in Part 6 Division 2; s 6-32 sits in Division 9. Note s 6-12(2): section 6-12 does not apply where s 6-13, 6-14 or 6-32 applies, so the general gate is residual.
| Rule | When it is available | Deadline to complete initial CDD | Hard stop while verification is outstanding |
|---|---|---|---|
| s 6-12 — various designated services in Australia | Australian establishment, and ss 6-13, 6-14 and 6-32 do not apply | 20 business days after commencing to provide the service (s 6-12(5)) | No transferring or facilitating the transfer of money, property or virtual assets for the customer, and none made available to them other than held on deposit (s 6-12(4)) |
| s 6-13 — opening an account and deposit | Item 1 of table 1 in s 6 of the Act, or item 3 where the transaction is a deposit to the account, or reasonably incidental; Australian establishment | None in the Rules — only the s 29(c)(i) “as soon as reasonably practicable” test | Same money-out bar as s 6-12, at s 6-13(2) |
| s 6-14 — certain financial market transactions | Item 33 of table 1; security, derivative or FX contract on a declared financial market; trade must be performed rapidly due to market conditions | 5 business days (s 6-14(3)) | No physical currency or virtual assets to fund it; no parting with disposal proceeds, no resale or transfer of the asset, no recredit or refund of the purchase price (s 6-14(2)) |
| s 6-15 — service provided in a foreign country | Foreign establishment whose FATF-implementing law permits establishing s 28(2) matters after the service | No period in the Rules | Must have complied with that country’s law on collecting and verifying KYC information (s 6-15(2)) |
| s 6-32 — real estate transactions | Brokering (table 5 item 1) where the entity has already commenced for the other side of the deal, or assisting a buyer or transferee (table 6 item 1); Australian establishment | Earlier of 28 days after exchange of contracts and 3 days before the initially agreed settlement day (s 6-32(4)) | The s 29 conditions; s 6-33 sets the route if relying on another participant |
Section 6-12 carries a pre-condition the others do not. Under s 6-12(3) the entity must already have taken reasonable steps to establish an individual customer is who they claim to be, identified their ML/TF risk, collected KYC information for the s 28(2) matters other than those in s 6-23(2), and established on reasonable grounds the matters in s 28(2)(a) and (c). What it defers is the rest: beneficial owners, PEP and sanctions status, nature and purpose, and the s 28(3)(d) verification against reliable and independent data.
That distinction decides the agent’s design. Under s 6-13 an account can be opened first. Under s 6-12 a newly regulated firm cannot start until identity is already established on reasonable grounds, so a conversational agent that “starts the file” has a narrower runway than the banking pattern most vendors demonstrate.
What an autonomous agent may run before verification completes
| Task | Before initial CDD is complete | Basis |
|---|---|---|
| Explain which documents and information are required, in the customer’s language | Yes | Not a step under Part 2 |
| Collect KYC information conversationally and write it to the file | Yes, as the entity’s agent | s 37(1)-(2) — agency principles apply to ss 28(3)(c) and (d) |
| Capture consent, disclosures and a timestamped interaction record | Yes | Feeds Part 10 record-keeping, retained by the entity |
| Book the verification appointment; chase a missing document | Yes | Operational, outside Part 2 |
| Decide that starting early is essential to avoid interrupting the ordinary course of business, or that the additional ML/TF risk is low | No | ss 29(b) and 29(d) — reporting entity determinations |
| Conclude that s 28(2) matters are established on reasonable grounds | No | s 28(1), a civil penalty provision |
| Release funds, or move money, property or virtual assets for the customer | No | ss 6-12(4), 6-13(2), 6-14(2) |
The model is a collection and escalation layer: the agent gathers, explains, prompts and logs; a verification engine and an accountable human close the file. Our earlier piece on AI onboarding agents for banks covers the customer-experience side of the same split. This page is the rule numbers behind it.
Reliance under Division 8: what stays with you
Sections 37A and 38 let a reporting entity treat another person’s collection and verification as its own. Division 8 of Part 6 sets the price.
For an agreement or arrangement under s 37A, s 6-29(1) requires that the other party is a reporting entity or is regulated by foreign laws giving effect to the FATF Recommendations; that it has measures to ensure compliance with Part 2 and Part 10 of the Act, or the foreign equivalent; that it is appropriate to the entity’s ML/TF risks; that it lets the entity obtain all the KYC information collected before the service commences, or within the s 29(c) period where delayed verification applies, and copies of the verification data immediately or as soon as practicable on request; and that it documents each party’s responsibilities, including record-keeping. Section 6-30(2) requires reassessment at intervals of not more than two years, s 6-30(3) requires one on any significant change, and s 37B(1)(c) of the Act requires a written record of each assessment within 10 business days.
Section 6-31 covers reliance without an agreement, for s 38(e): the entity must have reasonable grounds to believe it can obtain the KYC information and verification data on the same timings, and must document why it concluded the requirements are met.
Two things do not move. Reliance is deemed compliance for the Act “other than Part 10”, so record-keeping stays where it was. And the note to s 37(1) is explicit: “The reporting entity (and not its agent) will be liable to civil penalties for contraventions of this Part for providing designated services to its customers without complying with paragraphs 28(3)(c) and (d) in respect of its customers.”
How this maps to a deployed agent
Zian’s niched Bank Registration Onboarding (KYC) agent runs on the same platform as its Customer Support Agent, which handles enquiries 24/7 in 30+ languages across phone, SMS, email and WhatsApp. That covers the conversation, the document chase, the appointment and the transcript — not the verification decision.
Three configuration points follow. Bind the agent to the delayed-verification section the service sits under: the deadline differs by a factor of four between s 6-14 and s 6-12. Give it a hard escalation trigger on anything touching s 29(b) or s 29(d). And make it write to the entity’s Part 10 system of record through the platform’s API and CRM integrations, with private model deployment on customer infrastructure where data residency is the constraint.
Zian does not hold, and does not claim, any AML/CTF certification, accreditation or regulatory approval. No vendor discharges a reporting entity’s obligation. Zian is in partnership-application beta.
Frequently asked questions
Which businesses came into the AML/CTF regime on 1 July 2026?
AUSTRAC’s announcement of 26 March 2026, Newly regulated businesses: get ready for the reforms, states that from 1 July 2026 the new AML/CTF laws apply to designated services commonly provided by legal professionals, accountants, conveyancers, real estate professionals, and dealers in precious metals, stones and products. The Rules commenced earlier, on 31 March 2026.
Can an AI agent complete KYC verification?
No. Section 28(1) of the AML/CTF Act 2006 obliges the reporting entity, and is a civil penalty provision. Section 37 allows an agent to carry out collection and verification under paragraphs 28(3)(c) and (d), but the note to s 37(1) states that the reporting entity, and not its agent, is liable for contraventions. An AI agent collects and escalates.
How long does delayed verification last?
It depends on the section. Section 6-12(5) specifies 20 business days after commencing the service; s 6-14(3) specifies 5 business days; s 6-32(4) specifies the earlier of 28 days after exchange of contracts and 3 days before the initially agreed settlement day. Sections 6-13 and 6-15 specify no period, leaving the s 29(c)(i) “as soon as reasonably practicable” test.
If another firm verified the customer, do we still need records?
Yes. Sections 37A(2) and 38 of the Act deem compliance for “this Act (other than Part 10)”. Part 10 is the record-keeping Part, so it is carved out of the deeming. Section 6-29(1)(e) of the Rules separately requires the arrangement to document each party’s responsibilities, including record-keeping.
Does delayed verification apply to a real estate agency?
Only in the circumstances in s 6-32. Subsections (1) and (2) cover brokering under item 1 of table 5 where the agency has already commenced that service for the other side of the transaction; subsection (3) covers assisting a buyer or transferee under item 1 of table 6. All still require every limb of s 29 of the Act.
Designing the escalation path
The boundary is legible: collect and explain before verification, escalate the judgements, never conclude. If you are scoping an onboarding agent against it, Apply For Partnership.