Know when to verify
Apply the TPB process to new clients and existing clients when the practitioner has reason to doubt their identity or the authenticity of information previously supplied.
Accountants guide · TPB + Tranche 2
TPB, Tranche 2 and client phone instructions.
The practical difference is timing: proof of identity at the start does not authenticate the returning voice that changes a refund account months later.
Two controls, two moments
Onboarding answers “who is this?” Ongoing verification asks “is this instruction really theirs?”
Australian tax practitioners already have a client-verification obligation. TPB(GS) 42/2022 explains the proof-of-identity process that registered tax agents and BAS agents should use before providing services, including when an existing client gives the practitioner reason to doubt information previously relied upon.
From 1 July 2026, businesses providing designated Tranche 2 services enter the AML/CTF regime. AUSTRAC's framework is broader than a proof-of-identity moment: it includes a risk-based program, customer due diligence, ongoing due diligence, reporting and records.
Neither framework turns a familiar voice, a convincing email thread or an incoming caller ID into reliable evidence. Firms need an operational bridge between regulatory identity work and the everyday instruction that arrives after onboarding.
01 · The existing baseline
What TPB(GS) 42/2022 asks practitioners to do
The practice note is the authoritative source. In practical terms, it expects an appropriate client-verification process, professional judgement about risk and a record capable of showing what was done.
Choose an appropriate method
Use a method suited to the service and risk. The TPB guidance describes visual, electronic and in-person or remote approaches, with safeguards for remote verification.
Keep a contemporaneous record
Record that the check occurred, which method was used, who performed it and the outcome. Retain enough evidence to show the firm's process without unnecessarily copying identity documents.
Respond to doubt
Do not press ahead when documents, answers or circumstances are inconsistent. Resolve the discrepancy, escalate it and consider whether the engagement can safely continue.
The TPB's client-verification process page and proof-of-identity FAQs add practical context, including how remote checks can be performed and how practitioners should handle records. The point is not to collect the largest possible identity file. It is to apply a reasonable method, protect personal information and retain evidence of the process and outcome.
A Vericode check record shows which staff member sent a code to which number on file, when, and whether the caller read it back. Whether that belongs in your client records is your call. It is not TPB-endorsed, certified or approved, and it does not replace professional judgement.
02 · From 1 July 2026
What Tranche 2 adds for relevant accounting services
The AML/CTF regime does not simply repeat the TPB check. It asks reporting entities to understand customer risk over a relationship and apply controls to designated services. Firms must first determine whether and how the law applies to their work.
A risk-based program
Relevant services need controls, governance, training and review calibrated to the firm's money-laundering and terrorism-financing risk.
Customer due diligence
CDD requires regulated businesses to identify and verify customers and relevant representatives, understand risk and apply enhanced measures when circumstances demand them.
Ongoing due diligence
Customer information and risk are not frozen at onboarding. Firms need to monitor the relationship, keep information current and respond to unusual behaviour or changed circumstances.
Reporting and records
The broader regime includes reporting and record-keeping duties. Scope depends on the designated service, so firms should use AUSTRAC guidance and qualified advice for implementation.
Ongoing due diligence is especially important to the comparison. It requires attention to whether behaviour, information and risk still fit what the firm knows. But it should not be reduced to “verify every phone call”, and a contact check is not complete CDD. A firm needs to define its own risk triggers, decision rights and evidence within the wider program.
AUSTRAC Tranche 2 obligations fact sheet03 · The channel gap
The fraud arrives between the formal checks.
A criminal compromises a client's mailbox or gathers enough personal context to sound credible. They call during a busy period, say the old refund account has closed and offer a replacement. The request may contain the client's real tax details. Those details demonstrate access to information, not control of the client's trusted phone.
Repeating an onboarding identity-document check may still miss the problem. The attacker can quote the file, and collecting another document through the same suspect channel keeps the decision inside the compromised conversation. The useful control is independent: pause, return to a contact point that predates the instruction and run your identity, authority and payment checks before changing anything.
This is not a claim that every routine interaction requires a code. It is a case for pre-agreed triggers around changes to bank details, authorities, contact points and other consequential instructions.
The load-bearing rule
Never use the contact details supplied by the instruction you are trying to verify. Return to the trusted mobile number already held by the firm. If that number must change, verify the change through an independently established path before relying on it.
04 · One verification habit
Make high-risk instructions earn an independent pause.
A single habit can support both disciplines without pretending they are the same obligation: establish the trusted contact at onboarding, then return to it when a later instruction crosses a documented risk threshold.
- 01
Capture a trusted mobile number during onboarding and confirm who may give instructions for the client.
- 02
Treat a new phone number, changed refund account, unexpected representative, urgency or unusual request as a verification trigger.
- 03
Pause the instruction and return to the trusted mobile number already held in the practice system, not a number supplied in the request under review.
- 04
Send a one-time SMS code to that mobile number and ask the person reached to read it back before staff act.
- 05
Record the instruction, trigger, verification result, professional judgement, escalation and final decision together.
- 06
Review exceptions and failed checks after peak periods so the firm's written procedure reflects how work actually happens.
Write the triggers into the procedure and train reception, bookkeeping, tax and partner teams on the same stop rule. Give staff a safe escalation path when the trusted number is unavailable or the client cannot complete the check. An exception should create more review and evidence, not quiet permission to bypass the control.
05 · Evidence, precisely scoped
Prove the contact check without overstating what it proves.
Known target
Staff highlight a phone number already visible in a browser-based practice system, tax portal or email client, then send a one-time code by SMS.
Human response
The person reads the code back. Verification messages are sent through Australian SMS provider MobileMessage, using Vericode's ACMA-registered sender ID, VERICODE.
Reviewable result
Each authorised-contact check creates a timestamped, hash-chained record of who requested it, the masked target, method and outcome. Compliance-authorised users can export the result as PDF or CSV.
That record evidences the verification event. Vericode stores the data needed to dispatch and evidence a verification: recipient details, message and provider metadata, timestamps, actors, outcomes and audit events. The product is not a document repository and does not require customers to upload client matter files to complete a verification.
Customer and verification data (recipient details, messages and verification records) is hosted in Australia. Staff sign-in is handled by our identity provider, WorkOS, in the United States; see the subprocessor information below.
The result does not prove identity-document validity, bank-account ownership, complete CDD or regulatory compliance. Link it to the firm's source instruction, risk assessment, decision and any further steps in the client file.
Sources
Tax Practitioners BoardTPB(GS) 42/2022: proof-of-identity requirements for client verificationTax Practitioners BoardClient-verification process for tax practitionersTax Practitioners BoardProof-of-identity and client-verification FAQsAUSTRACAML/CTF obligations fact sheet for Tranche 2 reporting entities
Public guidance is cited for context. No TPB or AUSTRAC endorsement of Vericode is implied.
Close the operational gap
Keep the trusted contact useful after onboarding.
Build TPB and AML/CTF processes with qualified advice, then give staff a repeatable way to challenge consequential instructions and preserve the result.
General information only. This guide is not legal, tax, AML/CTF compliance or professional advice. Confirm obligations using TPB and AUSTRAC guidance and seek advice for your firm's circumstances.