This content is general in nature and provided for educational purposes only. It is not legal or compliance advice and does not take into account your organisation's specific circumstances. It does not certify compliance with any law or regulation. Before acting on this information, you should seek advice from a qualified professional.
Last updated 15 October 2026
For newly regulated businesses, there was a lot to get ready before 1 July: mapping designated services, building an AML/CTF program, appointing a compliance officer, and rolling out training.
Much of that work is visible. Customer due diligence, risk assessments, transaction monitoring, and the record-keeping needed to support all of it day to day.
But there's another side to the regime that sits behind all of that: the people doing the work.
Personnel Due Diligence is about the people performing AML/CTF-related roles. It applies before they start, on an ongoing basis, and to people already in those roles today.
It's easy to miss. There's no customer in front of you. No transaction to assess. No obvious moment that prompts the question.
And even where it hasn't been missed entirely, it's often assumed that training covers it. It doesn't. AUSTRAC's guidance makes clear that training and Personnel Due Diligence are two separate components of your program. Completing one does not satisfy the other.
So what does Personnel Due Diligence (PDD) actually require?
In practice, PDD means identifying the roles that require due diligence, assessing whether the people performing those roles have the skills, knowledge, expertise and integrity required, applying checks proportionate to the role and its risk, and keeping records of the assessments and decisions.
It starts with your roles, not your people
The first step isn't running checks on anyone. It's working out which roles in your business carry AML/CTF functions, and therefore require due diligence.
AUSTRAC's guidance describes this as mapping the roles in your business that perform AML/CTF-related work, then identifying which of those carry higher risk. For example, a partner managing trust structures carries different risk to a receptionist who greets visitors and takes calls. But that same receptionist, if they’re the one processing onboarding paperwork or handling customer due diligence checks, carries a different risk profile entirely.
Job title isn't the test. What the role actually does is. Your PDD process needs to reflect that distinction.
It applies to everyone in those roles - not just new hires
This is the part that catches most businesses off guard.
AUSTRAC's guidance is explicit on this point. For newly regulated entities, the expectation is that due diligence checks are conducted on current personnel in AML/CTF-related roles, not just new hires going forward. This may involve considering what checks have already been done, identifying any additional checks needed, making sure your records can show them, and updating or running new checks where needed.
If your business enrolled earlier this year and hasn't yet assessed the people already sitting in those roles, it's worth addressing that gap now.
Personnel Due Diligence also applies if someone moves into a higher-risk position, or when a role changes in a way that increases exposure. It's an ongoing obligation, not a one-time exercise.
The checks need to be proportionate to the risk
AUSTRAC's guidance doesn't prescribe a single list of checks that applies to every role in every business. It expects a risk-based approach, which means the depth of your due diligence should reflect the risk level of the role.
One of AUSTRAC’s published examples shows what that looks like: a small firm applies a baseline set of checks to every hire, then adds more for higher-risk roles, such as adverse media and sanctions screening, a bankruptcy check and an ASIC directorship check.
The key point: your policies need to define what applies to which roles, and why.
"We ran a reference check" is not a PDD framework. It's one check, applied without a documented rationale.
Records matter as much as the checks themselves
AUSTRAC's published examples of good practice are specific on this point. A well-run PDD process includes clear records of the checks conducted, any adverse findings, and an audit trail of the decisions made for each person.
That last part is important. If a check comes back with something concerning and you make a decision to proceed, the reasoning behind that decision needs to be documented.
Not because AUSTRAC expects perfection (their published regulatory expectations are explicit that they don't), but because an undocumented decision is indistinguishable from no decision at all.
What poor practice looks like
AUSTRAC’s examples page includes an illustrative poor practice scenario: a fictional business with AML/CTF personnel due diligence and training policies in place, but a generic process applied regardless of the risks and responsibilities of individual roles.
The business mapped the roles requiring due diligence but didn't identify higher-risk roles or tailor its checks accordingly. As a result, it relied on interviews, reference checks and a standard self-attestation for all new hires, without conducting additional background or criminal history checks for higher-risk personnel.
In the scenario, the business failed to identify that a personnel member with previous adverse media links to a criminal organisation had been hired, and only became aware when that person was arrested. Its review then found they had processed a series of suspicious transactions linked to suspected money laundering.
The business had policies. It just hadn't built a functioning, risk-based process behind them.
The gap most businesses have
Training helps your people understand their AML/CTF responsibilities. Personnel Due Diligence is about making sure the people carrying them out are suitable to do so.
Many businesses have completed training without yet building the second into a documented, repeatable, risk-based process with records that would hold up under scrutiny.
That's not a criticism. The obligation is new, the guidance is detailed, and the operational reality of turning a regulatory requirement into a day-to-day business process is harder than it looks on paper.
AUSTRAC has also been clear that, during implementation of the reforms, it does not expect perfection on day one. It expects businesses to make genuine efforts to meet their obligations.
If you're not sure where your business sits on this, that's the right question to be asking.
Want to see what a proportionate, risk-based PDD process looks like for your business?
See how Clearhouse approaches Personnel Due Diligence →
Or skip straight to a conversation.
Book a complimentary 15-minute conversation →