VerifiOnce, the digital identity product created through a joint venture between VerifiMe and VO, featured in Dynamic Business this week, in a piece on how Tranche 2 has handed thousands of small businesses a new job: looking after their clients' most sensitive identity information. It's a point worth unpacking.

Enforcement is no longer hypothetical

On 30 September, AUSTRAC confirmed it had begun issuing infringement notices to real estate, accounting and jewellery businesses it believes failed to enrol within 28 days of providing a designated service. The notices were issued at $21,840 for companies and $4,368 for individuals, and AUSTRAC has said they can accrue daily. It has also said more notices will follow where needed.

If you provide a designated service, enrolment is the starting line. Customer due diligence comes next, and that's where the privacy risk sits.

Two regulators, one onboarding process

Customer due diligence means collecting identity information. For many smaller firms, that also brings Privacy Act obligations for the first time.

The Privacy Act's small business exemption (annual turnover under $3 million) does not apply to personal information collected for AML/CTF purposes. That's the information it covers: your AML/CTF client records, not every part of your business. We set out what the OAIC expects in Privacy Is Now Part of Your AML/CTF Obligations.

More data held means more risk

Every passport photo emailed in, every licence scan saved to a shared drive, is something you now need to secure, account for and eventually destroy. It's also exactly what cyber criminals look for.

Multiply that across a single property transaction (agent, conveyancer, broker, accountant) and the same person's documents can end up sitting in several systems at once, each one a potential point of failure.

The OAIC's guidance points the same way:

• Collect only what is reasonably necessary.
• Don't keep copies of identity documents for AML/CTF record-keeping. Keep the relevant details and the verification outcome instead.
• Destroy or de-identify information once you no longer need it.

Data minimisation isn't just a compliance box. It's the simplest way to shrink your exposure if something goes wrong.

Where VerifiOnce fits

VerifiOnce is the digital identity product created through the VerifiMe and VO joint venture. It lets a customer verify their identity once and choose to share that result with the next business that needs it. The receiving business gets a record of which details were verified, how and when, rather than a fresh set of document photos. The customer approves every share.

That reduces the number of repeated identity documents circulating between businesses. It doesn't replace your own obligations: you still apply your own risk assessment, keep your own records and decide whether you need anything more. Read our introduction to VerifiOnce.

Four things to do

1. Read the article in Dynamic Business 
2. Check your status. If you provide a designated service, make sure you're enrolled with AUSTRAC.
3. Audit your onboarding. Are you storing ID copies you don't need? Stop, and set a destruction schedule.
4. Question your provider. Ask where your clients' data is held, who can access it and how long it's kept.

Want a client verification process that satisfies AUSTRAC and the OAIC, without stockpiling identity documents? Talk to the VerifiMe team or email hello@verifime.com.

This article is general information only and is not legal or compliance advice. Speak to a lawyer specialising in AML/CTF and privacy law about your business's obligations.