Stop Photocopying Your Customers’ IDs — The Rules Have Changed
Australian venues must now adopt a “sight and record” approach to customer identification. Here’s what that means for your venue.
From 31 March 2026, you should no longer photocopy, scan, or photograph patron ID documents. Sight the document, record the details, return the document. That’s it.
What’s Actually Changed?
Two things happened at the same time:
1. The AML/CTF Act Was Overhauled
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) received Royal Assent on 10 December 2024. It’s the biggest shake-up of Australia’s AML/CTF framework since the original Act in 2006.
For existing reporting entities — including pubs and clubs with gaming machines — the reforms commence on 31 March 2026.
The Act’s record-keeping provisions (sections 112–113) require you to record:
- The customer’s personal details (name, date of birth, address)
- The type of document you sighted (e.g. driver’s licence, passport)
- The document number and expiry date
- What steps you took to verify the customer’s identity
- The outcome of your verification
What the Act does NOT require: a photocopy, scan, or digital image of the ID document itself.
2. The Privacy Commissioner Drew a Line
The Office of the Australian Information Commissioner (OAIC) published updated guidance specifically for AML/CTF reporting entities ahead of the 31 March 2026 commencement.
— Privacy Commissioner Carly Kind
Under the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth):
You can only collect personal information that is reasonably necessary for your functions. If sighting the ID and recording the details is sufficient, copying it is not reasonably necessary.
You must destroy or de-identify personal information when it’s no longer needed. Full ID copies sitting in filing cabinets or on shared drives are a breach waiting to happen.
What Should Your Venue Do Now?
Adopt the sight and record approach:
- Sight the original ID document in person
- Record only the minimum necessary details: full name, date of birth, residential address, document type, document number, expiry date
- Record your process — note that you sighted the document, when you sighted it, and the outcome of your verification
- Do not photocopy, scan, or photograph the ID document
- Keep your records for 7 years after the customer relationship ends (this hasn’t changed)
What About IDs You’ve Already Copied?
The OAIC guidance states that the previous allowance to keep full ID document copies applies to documents collected before the reforms. From 31 March 2026, the practice should cease.
For existing copies, review whether you still have a lawful reason to retain them. If not, securely destroy them. This is a good time to audit your filing cabinets, shared drives, and any cloud storage for old ID scans.
Why This Actually Helps Your Venue
Less Breach Liability
Every stored ID is a liability. Fewer documents means less damage if your systems are compromised.
Simpler Processes
Recording details is faster than photocopying. Your staff spend less time on admin.
Patron Trust
Customers are increasingly uncomfortable handing over ID copies. Sight-and-record is less intrusive.
Key Dates
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), sections 112–113 — legislation.gov.au
- Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) — Parliament of Australia
- Privacy Act 1988 (Cth), Australian Privacy Principles 3, 6, and 11 — legislation.gov.au
- OAIC, Privacy guidance for reporting entities under the AML/CTF Act — oaic.gov.au
- OAIC, Privacy Essentials Checklist for AML/CTF reporting entities — oaic.gov.au
- OAIC, ID scanners guidance — oaic.gov.au
- AUSTRAC, Record-keeping overview (Reform) — austrac.gov.au
Ready to simplify your ID verification process?
ComplyIQ handles sight-and-record identification, risk assessment, and compliance reporting — all in one platform built for pubs and clubs.