Question 1

What is myID and how does it affect business onboarding in Australia?

Accepted Answer

myID (formerly myGovID) is the Australian Government's digital identity credential, operated by the ATO. The Standard and Strong strength levels provide IP 2-equivalent assurance for remote identity verification. Under the Digital ID Act 2024, AUSTRAC reporting entities can rely on accredited myID verifications for CIP without retaining underlying documents, simplifying compliance.

Question 2

Who must comply with the AML/CTF Act from mid-2026 under Tranche 2?

Accepted Answer

Tranche 2 of the AML/CTF reform extends obligations to real estate agents (buyers and sellers above AUD 10,000), lawyers (for property transactions, business formations), accountants, trust and company service providers, and dealers in precious metals and stones. These entities must register with AUSTRAC and implement a compliant AML/CTF program.

Question 3

What biometric standards does AUSTRAC require for remote identity verification?

Accepted Answer

AUSTRAC's updated guidance requires liveness detection equivalent to ISO/IEC 30107-3 Level 2 PAD (Presentation Attack Detection) for remote biometric verification. The biometric check must be performed in conjunction with document verification via the DVS to achieve the reliability standard required by the AML/CTF Rules.

Question 4

Does the Privacy Act 1988 apply to biometric data collected for identity verification?

Accepted Answer

Yes. Biometric data is sensitive information under the Privacy Act 1988, Schedule 1 (Australian Privacy Principles). Collection requires explicit consent (APP 3), use is restricted to the stated purpose (APP 6), and retention must be limited to what is necessary (APP 11). High-risk deployments require a Privacy Impact Assessment.

Question 5

How does Australia's TDIF compare to the EU's eIDAS 2.0?

Accepted Answer

Both frameworks define identity assurance levels (IP/IAL vs. LoA) and enable cross-sector identity sharing. Key differences: TDIF is voluntary (no mandate for businesses to accept myID, unlike eIDAS 2.0's EUDIW acceptance mandate); TDIF relies on existing documents (passport, driver's licence) via DVS rather than cryptographic native identity credentials; eIDAS 2.0 introduces selective disclosure via EUDIW, while TDIF is developing VC capabilities more gradually.

Question 6

Is biometric verification required for KYC compliance in Australia?

Accepted Answer

Biometric verification is not universally mandatory for AML/CTF compliance under the AML/CTF Act 2006. AUSTRAC's rules permit a range of electronic verification methods, including biometric facial matching, document verification via DVS, and credit bureau data checks. Biometric verification becomes the practical standard in remote digital onboarding for higher-risk customer segments — particularly where in-person identification is not practicable and the risk profile demands Level of Assurance IP3 or above under the TDIF framework.

Question 7

What is the difference between biometric verification and identification under Australian privacy law?

Accepted Answer

Both biometric verification (1:1) and identification (1:N) involve the processing of sensitive information under the Privacy Act 1988 (Cth) and require consent under APP 3.3 in commercial contexts. The key distinction is one of risk and proportionality: 1:N identification against large databases presents substantially greater privacy risks and is subject to more rigorous scrutiny by the OAIC. Large-scale biometric identification programs — such as the Drivers Licence Matching Initiative — have attracted significant public and regulatory debate in Australia precisely because of this distinction.

Question 8

Does biometric processing always require explicit consent under the Privacy Act?

Accepted Answer

Consent under APP 3.3 is the primary lawful basis for collecting sensitive information, including biometric data, in commercial contexts. However, the Privacy Act provides exceptions — for example, for law enforcement, health service providers and certain public interest activities. In practice, Australian businesses deploying biometric verification for customer onboarding must obtain informed, voluntary consent. The OAIC's guidance emphasises that consent must be genuine — individuals must have a real choice, and consent obtained as a non-negotiable condition of service may not satisfy the requirement. A PIA should assess whether consent is freely given in the specific deployment context.

Question 9

What is liveness detection and why is it necessary in Australia?

Accepted Answer

Liveness detection verifies that the biometric sample comes from a physically present person, rather than a photograph, mask or deepfake. Without this layer, a facial verification system can be defeated by a printed photo. ISO/IEC 30107-3 Levels 1 and 2 are the market reference standards for presentation attack detection. AUSTRAC's 2024 guidance on managing machine learning fraud — including biometric spoofing risks — effectively makes certified liveness detection an operational requirement for regulated entities using remote biometric verification for customer identification.

Question 10

How should biometric templates be handled under the Privacy Act 1988?

Accepted Answer

Biometric templates must be encrypted at rest and in transit, stored separately from identity data where feasible, and deleted as soon as the processing purpose is fulfilled — in accordance with APP 11 (security) and APP 13 (correction, which implies templates should be accurate and current). Retention periods must be defined before deployment and recorded in the organisation's privacy management plan. If a data breach involves biometric templates, assessment under the NDB scheme is required immediately. Because a compromised biometric template cannot be changed, the OAIC expects a higher standard of security controls for biometric data than for standard personal information.

Data

Digital Identity Trends 2026: The Future of Online Verification and e-ID in Australia

Biometric Verification: Fingerprint, Facial and Voice

Document Fraud in Australia 2026: Data & Trends

Document Fraud Statistics and Trends 2026: Australian

Manual Document Validation: True Cost (TCO)

RegTech 2026: Regulatory Technology Guide in Australia

Document Fraud 2026: Statistics and Detection

Compliance Automation ROI: Benchmarks by Industry

Fraud & Validation Costs in Australia: The Data

Document verification ROI calculator: TCO analysis and payback period

AI vs Manual Document Verification: ROI Comparison

Compliance Fines and Penalties: What Australian

Cost of Compliance: True Cost of Manual Checks