Can each staff member share an info@ inbox, or do they need individual emails?
Each staff member needs an individual email and individual mobile number, to ensure traceability for reporting to AUSTRAC.
Each staff member must have an individual email and individual mobile number. Two reasons this is non-negotiable:
- MFA is mobile-based. SMS one-time codes and authenticator apps both rely on the mobile being tied to a specific user. A shared inbox can't receive MFA codes meaningfully - whoever opens the email first gets the code.
- Training records are user-bound. AUSTRAC's training expectations require evidence that each individual has completed their required modules. A shared account can't credibly demonstrate this - it would be one set of training records claimed for multiple people, which doesn't satisfy the audit standard.
Sharing info@ also defeats:
- Audit traceability for CDD actions (who did what, when).
- Permission segregation by role.
- Privacy and Cyber Security processes in place
- Tipping-off controls (the CO needs to be the sole user with visibility on SMR drafts and submissions).
The right setup: each user has their own login (individual email), individual mobile for MFA, individual training record. Costs nothing extra within the user cap. info@ inboxes remain useful for external email forwarding and general communication, just not as a platform login.