A reporting entity must not commence to provide a designated service to a customer unless it has established on reasonable grounds: the customer's identity; the identity of any person on whose behalf the customer receives the service; the identity and authority of any person acting on the customer's behalf; for a non-individual customer, the identity of its beneficial owners; whether the customer, a beneficial owner, a person it acts for or a person acting for it is a politically exposed person or a person designated for targeted financial sanctions; the nature and purpose of the business relationship or occasional transaction; and any matter the Rules add (source of wealth and funds for PEPs and certain enhanced CDD cases, the chief executive where there is no beneficial owner, nested services matters). Each service provided in Australia without compliance is a separate civil penalty contravention. Customers already identified under the former applicable customer identification procedure before 31 March 2026 are taken to satisfy s 28 (Rules 6-42).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.