TABLE OF CONTENTS


Overview


This article explains what the notice means and what section 35C requires. It is not legal advice, and First AML cannot tell you whether a notice is required in a particular case. That depends on your own AML/CTF programme. If you are not the person in your business who decides what counts as verified, send the verification report to your compliance officer and ask them. 

When you run a KYC check on an individual in Australia, First AML checks their details against a range of data sources. Some of these are credit header data: the identity details (name, date of birth, address) held by credit reporting bodies such as Equifax, Experian and illion. Credit header data does not include credit scores, account balances, or repayment history.

If one of these credit reporting bodies does not return a match, a notice appears on the individual's verification report. This article explains what that notice means, how to decide whether you need to act, and how to notify the individual if you do.

What a credit header mismatch means


A mismatch means one credit reporting body could not match the details you submitted to a record it holds. It does not mean:

  • the verification has failed

  • the individual has given you false information

  • anything has changed about the individual's credit history, credit score or creditworthiness

A credit reporting body is one of several sources behind each check. The individual can still be verified through the remaining sources.


Why mismatches happen


  • No credit footprint. The individual has no record with that credit reporting body at all. This is common for people under 25, recent migrants, and anyone who has never held credit, a utility account, or a phone contract in their own name.

  • A name change. A marriage, divorce or deed poll change that the credit reporting body has not picked up.

  • A recent address change. Credit header records can lag a move by months.

  • A difference in how the name is recorded. A middle name, a hyphen, or a preferred name used instead of a legal name.

  • A data entry difference. The details entered do not match the individual's identity documents.


What to do


1. Check the overall verification result first


Open the individual's verification report and look at the summary at the top, not the individual data sources.


2. Decide whether section 35C applies


Section 35C of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 sits in Division 5A of Part 2. It applies only where all three of the following are true: 

  • you made a verification request in relation to the individual

  • an assessment was provided in relation to that individual

  • you are unable to verify the individual's identity, having regard to that assessment

The first two are always true when this notice appears. The third is a judgement you make, not one the platform makes for you.

What counts as verified is set by your own AML/CTF programme, and it differs between businesses:

  • If your programme treats the individual as verified on the strength of the other data sources that matched, section 35C is not triggered. You can disregard the notice and proceed.

  • If your programme requires this data source to match before you will treat someone as verified, then you are unable to verify them, section 35C is triggered, and you need to send the written notice at step 3. This can be the case even where the verification report shows an overall pass.

This notice is a prompt to consider the question. It is not First AML's determination that a notification is required.


3. If section 35C applies, send a written notice


Section 35C requires the notice to do three things:

  • state that you are unable to verify their identity having regard to the assessment

  • name the credit reporting body that provided the assessment

  • offer them an alternative way to verify their identity

The verification report shows which sources returned no match, so you can name the correct credit reporting body.

Use the template below.


4. Keep a copy


Keep a copy of what you sent, so you can evidence that you met the obligation if you are asked. A copy of the sent email is enough. You can also save it against the case so it sits alongside the rest of the case record.

How long you keep it is set by your own record-keeping policy. If you are not sure what that is, check with your compliance officer.


5. Verify the individual another way


Options include collecting a certified copy of an identity document, re-running the check with details exactly as they appear on the individual's ID, or verifying against a different document type.



Possible Email template: section 35C notice


Use this when you have been unable to verify the individual. Replace everything in square brackets.

Subject: We need another way to verify your identity

Dear [First name],

Thank you for providing your details so we can verify your identity.

As part of this process, we asked [name of credit reporting body] to check the details you gave us against the information they hold. Having regard to their assessment, we have not been able to verify your identity.

This has no effect on your credit report, your credit score or your creditworthiness. It usually means the details held by the credit reporting body are out of date, or that they hold no record for you. This is common if you have recently changed your name or address, or have not held credit in your own name.

A request may be sent through to you to provide additional documents as an alternative form of identity verification. 

Reviewing the information held about you

You can also ask the credit reporting body for a copy of the personal information they hold about you, and ask them to correct anything inaccurate or out of date. This is free.

  • Equifax: www.equifax.com.au, 13 83 32

  • Experian: www.experian.com.au, 1300 783 684

  • illion: www.illion.com.au, 1300 734 806


Kind regards,
[Name]
[Business name]



Frequently asked questions


Does a credit header mismatch fail the KYC check?
No. The overall result depends on how many sources matched across name, date of birth and address. An individual can pass with a credit header mismatch.

Does this affect the individual's credit score? 
No. Checking credit header data for identity verification is not a credit enquiry and does not appear on a credit report.

Do I have to notify the individual every time this notice appears? 
Not necessarily. Section 35C applies only where you are unable to verify the individual's identity. If the other data sources satisfy your AML/CTF programme, no notice is required. If your programme requires the credit header source to match, a notice is required.

My AML/CTF programme requires credit header data to match. Does that change things? 
Yes. If your programme will not treat an individual as verified unless this source matches, then a mismatch means you are unable to verify them and section 35C applies, even where the verification report shows an overall pass. Section 35C turns on whether you can verify the individual, and that threshold is set by your programme.

Why does one credit reporting body show both a match and a no match? 
Credit reporting bodies maintain more than one database. Equifax, for example, holds separate consumer, commercial and public credit databases, and an individual can appear in one but not another.

Do I need to record that I sent the notice? 
Keep a copy so you can evidence that you met the obligation. A copy of the sent email is enough. How long you keep it is set by your own record-keeping policy, so check with your compliance officer.