CleanID Verification — Privacy Notice

Operated by Waive Pty Ltd (ABN 25 618 672 683)

Before your verification begins, please read this notice carefully. Your accounting firm has requested that you complete an identity verification check using CleanID, a compliance platform operated by Waive Pty Ltd (ABN 25 618 672 683). This notice explains what information we collect, why we collect it, who we share it with, and your rights. You will be asked to give your express consent before any verification search is conducted.

1. Who Is Collecting Your Information

Three parties are involved in your verification:

Your accounting firm (Reporting entity)
The firm that engaged you for services. They are required by law to verify your identity before providing certain designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).

Waive Pty Ltd — CleanID (Platform operator)
Waive operates CleanID, the technology platform that processes your verification. Waive is not your accounting firm’s client service provider and does not use your information for any purpose other than operating the platform.

GBG (Equifax-owned, trading as greenID) (Verification provider)
GBG provides the identity verification technology, including document verification (DVS), biometrics, and PEP/sanctions screening. GBG stores verification data in Australia and retains records in accordance with their own privacy policy.

2. Why Your Information Is Being Collected

Your accounting firm is a reporting entity under the AML/CTF Act. From 1 July 2026, accountants providing designated services (including trust and company administration, SMSF setup, and related services) are legally required to verify the identity of their clients before providing those services.

This is called Customer Due Diligence (CDD) and it is mandatory. Your firm cannot provide designated services to you until initial CDD has been completed.

The information collected during your verification is used to:

  • Confirm that you are who you say you are
  • Satisfy your firm’s obligations under the AML/CTF Act and AML/CTF Rules 2025
  • Screen your identity against sanctions lists and politically exposed persons (PEP) registers
  • Generate a verification record that your firm is required to retain for 7 years
  • Comply with the DVS Participation Agreement between Waive Pty Ltd and the Commonwealth Attorney-General’s Department

Legal basis for collection
Collection is authorised under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (ss. 28–32) and the AML/CTF Rules 2025 (F2026C00274). Collection is also reasonably necessary under the Privacy Act 1988 (Cth) (APP 3) to fulfil your firm’s legal obligations.

3. What Information Is Collected

3.1 Personal Information

We collect the following personal information from you directly during the verification process:

  • Full legal name
  • Date of birth
  • Current residential address
  • Identity document details (type, document number, expiry date, issuing state/country)
  • Email address (for sending your secure verification link)

3.2 Identity Document Images

If you use the document capture feature, images of your identity documents (for example, your driver licence or passport) are transmitted to GBG for verification against government records. Waive does not retain copies of document images after the verification is complete. GBG retains images in accordance with their data retention policies.

3.3 Biometric Information (if applicable)

If your accounting firm has enabled biometric verification, the following sensitive information is also collected:

  • A photograph or video of your face (selfie or video capture)
  • Liveness detection data (to confirm you are a real person and not a photograph or video replay)
  • A facial match score comparing your selfie to your identity document photograph

Biometric data is classified as sensitive information under the Privacy Act 1988 (Cth). Your express consent to biometric collection will be sought separately before this step is initiated. You may decline biometrics; your firm will determine whether an alternative verification method is available.

3.4 Verification Outputs

The following outputs are generated and retained by CleanID as part of your verification record:

  • DVS match result (match / no match / system error) for each document checked
  • PEP and sanctions screening result
  • Overall risk classification assigned by the platform
  • Timestamps for each step in the verification process
  • Reviewer decisions and notes (if manual review is required)

4. Document Verification Service (DVS)

The Document Verification Service (DVS) is a national online system operated by the Commonwealth Attorney-General’s Department. It allows authorised organisations to verify that the details on an identity document match the information held by the government issuer.

When you submit your identity document details through CleanID, a match request is sent through GBG (an Approved Gateway Service Provider) to the DVS Hub. The DVS Hub checks your details against records held by the issuing agency (for example, the relevant state or territory roads authority for a driver licence, or the Department of Home Affairs for a passport).

The DVS returns a match result only. It does not return the underlying government record or any additional personal information. Waive is bound by the DVS Participation Agreement, which prohibits use of DVS data for any purpose other than identity verification for the purposes set out above.

Important limitation: A DVS match result is not conclusive proof of identity and cannot be used as the sole evidence of your identity in any criminal or civil proceeding.

5. Who Your Information Is Shared With

Your personal information is shared only as follows:

GBG / greenID (Australia)
Performs DVS checks, biometric matching, liveness detection, and PEP/sanctions screening on behalf of your firm. GBG stores identity data in Australia. GBG is bound by the Australian Privacy Principles and the DVS Participation Agreement.

Your accounting firm
Receives the verification result (match/no match, risk classification, screening outcomes). Your firm is the reporting entity responsible for the underlying AML/CTF obligation and retains the verification record for 7 years.

AUSTRAC
If your firm forms a suspicion about money laundering or terrorism financing, it may be required to submit a Suspicious Matter Report (SMR) to AUSTRAC. An SMR may reference your verification record. Your firm is legally prohibited from telling you if an SMR has been submitted about you (tipping-off prohibition, AML/CTF Act s.123).

Commonwealth Attorney-General’s Department (DVS Hub)
Receives match requests transmitted via GBG as part of the DVS process. Governed by the Identity Verification Services Act 2023 (Cth).

Australian sanctions list issuers and PEP data providers
Your name, date of birth, and other details are screened against current sanctions and PEP lists. Screening is performed by GBG using data from authorised list providers.

Waive does not sell your personal information. Waive does not use your identity data for marketing, profiling, or any purpose other than operating the CleanID platform in accordance with its contractual and regulatory obligations.

6. Offshore Disclosure

Your verification data is processed primarily in Australia through GBG’s Australian infrastructure. The following offshore elements apply:

GBG / Australia
Primary identity verification processing. Australian hosted. No offshore transfer for standard DVS and biometric checks.

Waive infrastructure (Australia)
CleanID platform data storage and audit records. Hosted in Australia.

Third-party sub-processors (if applicable)
GBG may use sub-processors in connection with specific background data sources. Refer to GBG’s privacy policy at gbg.com for details of any offshore transfers by GBG.

7. How Long Your Information Is Retained

CDD verification record (CleanID)
7 years from the end of the business relationship between you and your accounting firm, or 7 years from the date of the last transaction (whichever is later). Required by AML/CTF Act s.113.

Identity document images
Not retained by Waive after verification is complete. Retained by GBG in accordance with GBG’s own retention policy.

Biometric data
Retained by GBG only for the period required to complete the verification and any associated review. Not retained by Waive.

Screening results (PEP/sanctions)
Retained as part of the CDD record for 7 years.

Audit logs (timestamps, decisions)
Retained for 7 years as part of the immutable audit trail in CleanID.

8. Your Rights

8.1 Access and Correction

You have the right to request access to, or correction of, the personal information held about you in CleanID. Requests should be directed to your accounting firm in the first instance, as they are the reporting entity responsible for your verification record.

If you need to contact Waive directly regarding your personal information, you may do so at the contact details in section 10.

8.2 Consent and Consequences of Declining

Your express consent is required before each verification search is conducted. You may decline to provide consent. However, if you do:

  • Your accounting firm may be unable to provide you with designated services under the AML/CTF Act
  • Your firm may be required to treat you as an unverified client, which may affect the services available to you
  • In some circumstances, your firm may be required to consider whether to submit a report to AUSTRAC

Declining verification is your right. The consequences above are a function of your firm’s legal obligations, not a penalty imposed by Waive or CleanID.

8.3 Complaints

If you have a concern about how your personal information has been handled during the CleanID verification process, you may:

  • Contact your accounting firm directly
  • Contact Waive at support@waive.com.au
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992
  • Contact GBG regarding the handling of your identity documents and biometric data via GBG’s privacy complaints process at gbg.com

9. Tipping Off Prohibition

Important legal restriction: If your accounting firm submits a Suspicious Matter Report (SMR) to AUSTRAC in connection with your verification or your business relationship, your firm is prohibited by law from disclosing this to you. This is the tipping-off prohibition under s.123 of the AML/CTF Act. Waive and CleanID are also subject to this prohibition. Neither your firm nor Waive will be able to confirm or deny whether an SMR has been submitted about you.

10. Contact Information

Waive Pty Ltd (CleanID operator)
support@waive.com.au

GBG (identity verification provider)
gbg.com/en-ap/privacy-policy

Office of the Australian Information Commissioner
www.oaic.gov.au | 1300 363 992

11. Updates to This Notice

Waive may update this notice from time to time to reflect changes in law, regulation, or platform functionality. The current version will always be available at the CleanID verification portal. The version applicable at the time your verification was conducted is recorded in your verification audit log.

Version 1.0 | Issued June 2026 | Operated by Waive Pty Ltd ABN 25 618 672 683