Part 10: Get the basics right - International companies

In our previous article, we covered how to identify politically exposed persons (PEPs), sanctions targets and adverse media links - three key indicators that help assess whether your client is who they claim to be and what risks they might pose. This time, we turn to another core area where risk often hides in plain sight: international companies.

Many Australian law firms act for overseas companies or local subsidiaries of foreign entities. Whether it’s a buyer in a property transaction, a commercial landlord, or the trustee of a fund, international companies can present real money laundering and terrorism financing (ML/TF) risks if not properly understood.

This article will help you meet your Tranche 2 obligations when working with international companies. We’ll walk through how to identify them, what red flags to look for and the extra steps needed to verify legitimacy and beneficial ownership when overseas structures are involved.

What makes a company ‘international’?

For AML/CTF purposes, a company is considered international if:

• It was incorporated outside of Australia
• It has one or more directors, shareholders or beneficial owners based overseas
• It operates in, receives funds from or sends funds to another jurisdiction, especially one identified as high-risk

It doesn’t matter if your client is based solely in Australia or has an ABN. If there’s a cross-border element to the company’s structure, ownership or source of funds/wealth, you’re dealing with an international client from a compliance standpoint.

Why do international companies carry a higher risk

Most overseas companies are legitimate. But international structures can be used to obscure the source of funds/wealth, disguise the true owner or route money through low-transparency jurisdictions.

Common risks include:

• Complex ownership chains that make it difficult to identify who ultimately controls or owns the company
• Shell companies with no real business activity
• Registration in high-secrecy jurisdictions that do not share company details or beneficial ownership information
• Nominee arrangements where someone appears to control a company but is acting on behalf of someone else
• Use of trusts, partnerships, charitable foundations or bearer shares to further obscure control

If you don’t take reasonable steps to understand the company and its owners, you risk inadvertently assisting money laundering or terrorist financing and breaching your AML/CTF obligations.

What designated service are you providing?

When assisting with international companies, particularly in a transaction involving their sale, purchase or transfer, you’re likely providing a designated service under Item 2 of Table 6 in the Second Exposure AML/CTF draft rules.

This includes assisting a person in planning or executing a transaction, or acting on their behalf in a transaction, to sell, buy, or transfer a body corporate or legal arrangement.

This covers not just transactional execution but also the planning stage, such as reviewing contracts, structuring share transfers or conducting due diligence on a proposed acquisition.

You’re not providing a designated service under this item if:

• The transaction is the result of a court or tribunal order
• The interest being transferred is less than 25%, meaning no change in beneficial ownership
• The activity has no geographic link to Australia

Practical steps to verify international companies

1. Obtain and review incorporation documents

Start with official documents from the company’s country of incorporation. This could include:

• Certificate of incorporation
• Articles of association or similar constitutional documents
• Company extract or registry search

Tip: Check if the registry is publicly available. Some jurisdictions, like the UK and Singapore, have open databases. Others, like the British Virgin Islands (BVI) or Seychelles, do not.

2. Understand the ownership and control structure

If your AML software doesn’t auto-generate entity structures with UBOs and shareholding levels, ask for one, making sure it shows:

• The legal owners (shareholders)
• The controlling individuals (directors and beneficial owners)
• Any nominee relationships, trusts or holding companies

Under the draft AML/CTF rules, you must identify anyone who owns or controls 25% or more of the entity or who exercises effective control, even if they don’t meet the 25% threshold.

If the ownership is layered across multiple companies, repeat the process until you reach natural persons with 25% or more indirect or direct ownership and control.

3. Screen all individuals and entities involved

As covered in the previous article, screen each beneficial owner, director and authorised representative for:

• PEP status
• Sanctions listings
• Adverse media links (optional but highly recommended)

Make sure the screening includes global coverage and is refreshed periodically.

If any of the following are a foreign PEP, or a high-risk domestic or international organisation PEP, you must apply enhanced due diligence:

• The customer
• Any beneficial owner of the customer
• Any person on whose behalf the customer is receiving the service (for example, a trust beneficiary)

This includes:

• Establishing their source of funds and source of wealth on reasonable grounds
• Obtaining senior management approval before you provide the designated service as per AUSTRAC guidance

You must also seek senior approval to continue providing a designated service if an existing customer or related person becomes a foreign PEP or a high-risk PEP after onboarding.

Enhanced due diligence (EDD) must be applied in these cases, regardless of the country in which the foreign PEP is seeking the service.

You can commence to provide the service before establishing a source of funds and wealth, but all other due diligence obligations must be completed beforehand.

4. Assess country risk

Some jurisdictions present higher ML/TF risks, especially those that:

• Lack of AML/CTF regulations
• Are subject to sanctions
• Are classified as high-risk by FATF
• Are known for secrecy or tax evasion

Use FATF and AUSTRAC high-risk country lists to inform your client’s risk rating.

Example: A UK-based company owned by a Monaco-based holding company, which in turn is owned by a BVI trust, would likely require enhanced due diligence due to both complexity and jurisdictional risk.

5. Apply enhanced due diligence where required

Where the ML/TF risk is high, due to the country, client type, complexity or red flags, apply enhanced due diligence (EDD). This includes:

• Obtaining additional information on the source of funds and wealth
• Verifying ownership and control using multiple data points
• Obtaining senior management approval to onboard
• Conducting more frequent or detailed ongoing monitoring

EDD is required where risks are high; it’s not optional.

Red flags to watch for

Be alert to warning signs that something may not be right:

• The company has no website or online presence
• There is reluctance to provide ownership information
• Ownership includes multiple layers of entities in high-secrecy jurisdictions
• Documents are inconsistent, incomplete or unverifiable
• The client uses nominee shareholders or bearer shares
• There are unexplained changes in ownership or control before the transaction
• Payments are made from unrelated third parties overseas

Any one of these red flags doesn’t prove wrongdoing, but should trigger further investigation and documentation.

For a deeper understanding of red flags and risk, read: A quick start guide to AML/CTF risk assessments and red flags.

Summary: Treat these checks as part of client care

When dealing with international companies, it’s not enough to verify the legal entity. You need to:

• Understand who ultimately owns or controls it
• Assess whether any part of the structure or jurisdiction raises red flags
• Confirm whether a designated service under Item 2 of Table 6 is triggered
• Apply enhanced due diligence when the risk is high
• Seek senior manager approval for high-risk PEPs before proceeding
• Document your decision-making thoroughly

Taking shortcuts can expose your firm to legal, financial and reputational risk, especially in cross-border matters where money flows are harder to trace.

As always, remember the golden ABCD rules from Amy Bell at Teal Compliance:

• Assume nothing: Just because a company looks legitimate doesn’t mean it is.
• Believe no one: Don’t rely on client statements without supporting evidence.
• Confirm everything: Independently verify documents, identities and ownership.
• Document it all: Record what you found, what you checked, what you decided and why.

In the next instalment of Money and matters, we’ll look at how to conduct source of funds and source of wealth checks – two steps that help complete the risk picture once the structure is understood.