AU Entity Intelligence + Multi-Jurisdiction Sanctions

KYC API for Australia

Australian entity verification and sanctions screening, built to integrate

The problem

KYC in Australia is not a single API call to a single register. Verifying that an entity is real requires cross-referencing the Australian Business Register and the ASIC Company Register. Confirming it is sanctions-clean requires screening against five separate lists maintained by five separate regulators across four jurisdictions. Both steps need to produce a timestamped, auditable record that holds up under AUSTRAC review. Rolling this by hand means four or five sequential HTTP calls to different government sources, none of which share an authentication model or a response format.

The result for most teams is either a brittle internal integration that breaks on register format changes, or a compliance gap where only one or two lists get checked because wiring the rest was too much work. Neither is acceptable under the AML/CTF Act 2006.

What KYC actually requires in Australia

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) requires reporting entities to collect and verify customer identification information before providing a designated service. For a business customer, that means confirming the entity exists, is currently registered, and that the name and ABN or ACN on file match what the customer provided. The ABR is the authoritative source for ABN status and current entity name. ASIC is the authoritative source for company registration status, company type, and ACN.

Customer due diligence (CDD) under the AML/CTF Rules also requires screening against relevant sanctions lists before a business relationship commences. AUSTRAC guidance identifies DFAT's consolidated list, the UN Security Council list, and other applicable lists as part of a complete sanctions check. Screening only OFAC satisfies US regulatory expectations but leaves a gap in Australian CDD obligations, specifically DFAT, EU, and UN designations.

Both verification and sanctions steps must produce records that demonstrate what was checked, when, against which data sources, and what version of those sources was current at the time. That audit trail requirement is what distinguishes a logged API call from an informal web search. Every response from the Tech Compass API includes a request ID, a timestamp, and data lineage metadata identifying the source register and its last update date.

How the APIs work together

The recommended integration pattern for Australian KYC runs two calls per onboarding event. The first call goes to the AU Entity Intelligence endpoint with the customer's ABN or ACN. The response confirms whether the entity is currently registered, returns the current legal name and entity type from ASIC's 4.4 million record register, and cross-checks ABN status against the ABR in real time. If the entity is not found or the registration is not current, you stop here and flag for review. If it passes, you proceed to the sanctions screen.

The second call goes to the Multi-Jurisdiction Sanctions endpoint with the entity name. This screens against all five lists in one request: the OFAC SDN list (19,000-plus entries, updated daily), the UN Security Council consolidated list, the EU Financial Sanctions Files, the UK FCDO/OFSI list, and the DFAT Australian consolidated sanctions list (11,000-plus entries). A clear result across all five means you have a documented, timestamped sanctions check covering the key lists for Australian AML compliance. A match returns the specific list, the matching record, and the fields that triggered the match.

Two optional additions extend the workflow. If your organisation uses per-screen OFAC billing and operates a USD account, the standalone OFAC Sanctions Screening product provides the same SDN coverage with dedicated metered or volume-bundle pricing. If you need ongoing monitoring after initial onboarding, Compliance Monitoring (CMaaS) watches your entity list for OFAC SDN changes daily and FSANZ food recall alerts every two hours, starting from a base of 100 monitored entities.

Which plan you need

  • AU Entity Intelligence (P2) — Free tier. Verify any Australian entity by ABN or ACN against ABR and ASIC.
  • Multi-Jurisdiction Sanctions (P7) — Professional or Professional+. Screens OFAC, UN, EU, UK FCDO, and DFAT in one call.

P2 and P7 together cover the core KYC workflow. Start free and upgrade when you are ready to add sanctions screening.

Further reading

Frequently asked questions

What is the difference between this and the AML Customer Onboarding solution?
The AML Customer Onboarding solution is workflow focused and targets compliance teams running a specific onboarding sequence. This page is aimed at developers and technical leads who need to understand what APIs satisfy KYC obligations under the AML/CTF Act 2006, how to integrate them, and what each endpoint returns. The underlying products are the same. The framing is different.
Does entity verification work for individuals as well as businesses?
The AU Entity Intelligence API looks up registered entities by ABN or ACN. It confirms registration status, entity type, and current details for companies and other registered bodies. It does not look up individuals who are not registered entities. For individual beneficial owners, combine entity lookup with a sanctions screen against the person's name.
How does this satisfy AUSTRAC customer due diligence requirements?
AUSTRAC CDD under the AML/CTF Act 2006 requires that you identify and verify the customer, collect beneficial ownership information where applicable, and screen against relevant sanctions lists. The AU Entity Intelligence API provides a verified, timestamped record of the entity's registration status drawn from ABR and ASIC. Multi-Jurisdiction Sanctions covers the key lists for Australian AML compliance: OFAC, UN, EU, UK FCDO, and DFAT. Each call returns data lineage and a request ID suitable for inclusion in your compliance audit trail.
What happens when a sanctions screen returns a match?
The API returns the matching record with the list source, match fields, and a request ID. What you do with that match is a compliance decision your team makes. The API does not block transactions or trigger automated actions. Most teams pass the result to a case management queue for human review. The logged response is the audit trail.
Get started free View API docs