How to Run Tranche 2 AML Checks for Your Xero Clients

Which of your Xero clients need checks

Not every contact in Xero is a customer for AML/CTF purposes. Xero holds everyone you bill, plus suppliers, one-off contacts and old files. Tranche 2 obligations attach to designated services you provide, not to the fact that a name is in your accounting file. A client you only prepare a tax return for may sit outside the regime. The same client becomes in scope the day you set up a trust for them or hold their funds.

So the first job is scoping, not importing. Work out which of your service lines are designated services (AUSTRAC publishes the list for professional services), then decide which Xero customers receive one of them. The Tranche 2 scope check is a quick way to start, and the accountants guide walks through the service lines in detail.

A practical rule: use your Xero customer list as the candidate list, then keep only the clients who receive a designated service. Record the reasoning for the ones you leave out, in a short note. If AUSTRAC asks why a client was not checked, a dated scoping note is far better than an unexplained gap.

Why the Xero list is a good starting point, and what it is missing

Your Xero contacts already hold much of what onboarding asks for: the legal or trading name, an ABN where you have recorded one, an email address, a phone number and an address. Starting from that list saves retyping, and retyping is where errors come in. An ABN with a transposed digit, or a name spelt two ways across your systems, can cause trouble later when you try to match records.

What Xero does not do is just as important. It does not verify that the person is who they say they are. It does not look for politically exposed persons or sanctions matches. It does not identify the individuals who own or control a company or trust. It does not keep the evidence of what you checked, when and with what result. Xero is accounting software, and it is not designed to be your customer due diligence record. You need a separate AML tool, and the closer it sits to your client list, the less double handling you have.

The workflow, from first contact to ongoing monitoring

Whatever tool you use, the sequence is the same. Here is what a Tranche 2 practice needs to be able to show for each in-scope client.

1. Onboard the client for the service

Record who the client is, the service you are providing and why, and how you will verify them. The trigger should be the service, not just a new file. An existing client who asks for a new trust deed is a new onboarding event.

2. Verify identity

For individuals and sole traders, that means checking an identity document and, for people you do not meet, confirming that the person presenting it is the person on it. Many practices do this remotely by sending the client a secure link to scan their ID and take a selfie. Read more about identity verification and electronic ID verification.

3. Identify beneficial owners and controllers

For companies and trusts, you also need to identify the individuals who ultimately own or control the client, and verify them. This is the step that most often takes longer than expected, particularly for trusts with corporate trustees. AUSTRAC has guidance on initial customer due diligence for a trust.

4. Screen for PEPs and sanctions

Screen every identified person against sanctions lists and for politically exposed person status. See AUSTRAC's pages on politically exposed persons and targeted financial sanctions. A match is not proof of wrongdoing; it is a prompt for a person to look and record a decision. AML screening tools return the matches and keep the record.

5. Rate the risk

Combine what you learned with your written risk assessment: the service, the client type, the way they came to you, and where the money or owners are. Record the rating and the reason, and what extra steps a higher rating triggers.

6. Keep the records

Keep the evidence of each check: what was checked, when, how and the result, along with who reviewed it. Check AUSTRAC's record keeping guidance for how long you must keep them.

7. Monitor on an ongoing basis

Due diligence does not end at onboarding. Clients should be re-screened, and reviewed when something changes: a new owner, a change of activity, a new service. Monitoring is where a manual process tends to fall over, because nobody remembers to do it in the second year.

Doing it manually, or with an integration

Both approaches can work. The difference is in how much work sits with your people, and how much risk that carries.

A fair way to choose: if you have a handful of in-scope clients and a disciplined process, a manual approach can be enough. As the number grows, or when several people touch client files, the connected route is less likely to leave gaps. Whatever you pick, check that the tool does the verification and screening itself, and that you can see where its data comes from. An integration is a convenience, not a substitute for the checks.

How it works with ScreenlyyID

ScreenlyyID Compliance integrates with Xero on the Solo and Practice plans. An owner or the compliance officer connects Xero from the Integrations page, and ScreenlyyID reads your customer contacts. You choose which of them are clients, say which service you provide and how they will verify, and import them. Nothing is emailed to anyone when you import, and no checks start until you start them from the client file.

The connection is read-only. ScreenlyyID asks Xero for permission to read contacts and organisation settings, and nothing else, and it never writes anything back to Xero. If a contact you imported later changes in Xero, ScreenlyyID flags it as changed rather than overwriting the client record, because the record is your due diligence evidence. From there, the client verifies by secure link, and ScreenlyyID screens the people involved and keeps the record. See the Xero set-up guide for the exact steps, and pricing for the plans.

The integration is not on the Xero App Store yet; you connect it from inside ScreenlyyID.

Existing clients and new clients

Your Xero list is mostly existing clients, and AUSTRAC treats them differently from people you onboard from now on. See its guidance on transitioning existing customers for what applies to yours. In practice, most firms sort the list into three groups: clients receiving a designated service now, clients who may ask for one soon, and clients who are plainly out of scope. Start with the first group. Because a Xero contact carries no record of which services you provide, you will need to add that yourself when you import, and a tool that asks for the service at that point makes the scoping decision visible rather than leaving it in someone's head.

New clients are simpler. Onboard them for the service from day one, create the Xero contact as you normally would, and make the AML check part of the same engagement checklist as the engagement letter.

A sensible order of work for the first month

1. Week one: scope your services and write down which are designated. Export or review your Xero customer list and mark the in-scope clients.
2. Week two: set up your tool and import the first group of clients. Tidy missing or invalid ABNs as you go, because a clean ABN makes ownership checks faster.
3. Week three: start verifying. Send secure links, work through the results and clear any screening matches with a recorded decision.
4. Week four: review what was found, record the risk ratings and set the re-screening schedule. Add the AML step to your onboarding checklist for new clients.

The timing will vary with how many clients are in scope and how many are companies or trusts. The point is the order: scope first, then import, then verify, then monitor.

Common mistakes when starting from Xero

• Importing everyone. A bulk import of every contact creates files for people you never needed to check. Import the in-scope clients.
• Treating Xero as the record. If a contact is edited in Xero after you verified a client, your accounting file and your due diligence file no longer match. Keep the verified details with the evidence.
• Missing or wrong ABNs. Contacts often have no ABN, or one with a typo. Check these before relying on them to match records.
• Forgetting the second year. Put re-screening and review dates in the system on day one.

This article is general information, not legal advice. The AML/CTF Act, the Rules and AUSTRAC guidance are the authority, and they change, so confirm the current position on austrac.gov.au.