Verify a client's identity and take their AML onboarding form

1Order the check

In Diract Searches, or Tools, then Searches in an Australian law firm's workspace, click Order a search, open People, and choose Verification of Identity (VOI), AML Customer Due Diligence, or VOI and AML onboarding for both from one link.

Type your client's name and email, and a mobile if you want the link texted too. If they sign for a company or a trust, choose it and type its name, its ACN or ABN and their role.

Choose the Matter it is for, or type Your reference, then click Place order. On card billing, click Pay now; on a monthly account it is added to the month's invoice.

2Your client does it on their phone

The link opens a page on their phone. For a VOI they choose which documents they have, photograph each one live with the phone's camera, take a selfie and record a short video reading out a code shown only then.

Each passport and driver licence photo is read as it is taken. A passport's machine readable lines have to check out, an Australian passport has to be issued by Australia, and a document past its own expiry date is refused and asked for again, apart from an Australian passport that expired within the last two years.

Each photo is also checked for a screen, monitor, phone or tablet in it. A picture of a document shown on another device is pointed out to your client, who is asked to photograph the document itself, and to you when you review it.

For an AML form they answer the onboarding questions, tick the statements and sign. The questions follow AUSTRAC's onboarding forms: whether the work is buying or selling a property or other legal work, any finance and lender for a purchase, any cash or virtual assets, a sole trader's business, and for a company, partnership, association or trust what it does, what governs it, who controls it and where their authority to act comes from. What you typed on the order is already filled in for them to check: their name, the company or trust, its ACN or ABN and their role, the kind of company or trust when the business register knows it, and their name as a director or trustee when that is the role you gave. They can change any of it.

3Review it and decide

You get a notification when it comes back. Open the order to see each photo with when and where it was taken, the selfie, the video, how alike the selfie and the documents' photos are, and anything worth a second look, such as a name that does not match.

For a VOI, sign under the certification and click Sign and verify, or write a Note and click Not verified. For an AML form, tick the checklist, rate the risk and click Complete the checklist.

On the checklist, choose The work is Conveyancing or Other legal work (it starts on what your client said), then answer each of AUSTRAC's Risk factors Yes or No. A high factor answered Yes makes the risk High and two medium ones make it at least Medium, and the checklist will not complete with a lower rating.

If something is missing or unclear, click Ask the client for more under More information, write what you need and click Send request. Your client is emailed a link of its own (and texted it, where the order has their mobile) to write an answer and send photos or PDFs. You are emailed when they answer, and their answer and files show under the request.

Under Politically exposed persons and sanctions, Search DFAT's Consolidated List says when DFAT last updated the list and when Diract last checked DFAT for a newer one. Click a name the check already has, such as the client or their company, or type any other name and click Search. Compare each listing that comes close with what you know of them, then click None of these is them (or Confirm: not on the list when nothing comes close) or Possible match. Each answer is listed under Searches recorded and printed on the AML report with the date of the list. Answering every search with no possible match ticks Checked each of them against DFAT's Consolidated List for you.

If the panel says Diract has not heard from DFAT for a day, a listing made since may be missing from Diract's copy, so check DFAT's own list as well from the link it gives.

The order then holds a PDF report, and a copy is filed to the matter when the order was placed for one.

4How your client's documents are kept

Every photo, the selfie, the video, both signatures, the details read from each document, the date of birth, the AML form, the checklist and the report are each encrypted with a key of their own (AES-256) before they are stored. A photo is encrypted on your client's phone, before it is sent.

Those keys are held by Amazon's key management service (AWS KMS) in Sydney, apart from the database and the file storage, so a copy of either holds nothing anybody can read. A key is only used for your firm's own work on that check: reading a photo as it is taken, the face comparison, you opening the check, and the report you download. Every use is logged by Amazon.

When the 90 days are up, the keys to the identity documents are destroyed with them, so no copy left in a backup can be opened again.