AML Compliance Guide
Log in Create Free Account

AML/CTF program for Bookkeeperss — 2026 AUSTRAC Guide

If your bookkeeping practice provides a designated service from 1 July 2026, you must have a written AML/CTF program. For bookkeepers, that usually matters where your work goes beyond routine data entry or payroll and moves into activities captured under the AML/CTF Act, such as certain services connected with companies, trusts, client money or transactions. If you do not put a compliant program in place by 31 December 2026, AUSTRAC can take enforcement action, with civil penalties up to $33.5 million per contravention and criminal penalties for intentional breaches.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Your AML/CTF program is the rulebook for how your bookkeeping business will spot and manage money laundering, terrorism financing and proliferation financing risk. It must be in writing, approved by senior management, and include 2 parts: your ML/TF risk assessment and the policies, procedures, systems and controls you will use to manage those risks. You cannot write a useful program by copying a generic template. A bookkeeper’s program needs to reflect the actual way you take on clients, access accounting platforms, receive source documents, deal with trusts and companies, and handle requests involving movement of funds or changes to ownership and control.

Deadline and sequence

First enrol with AUSTRAC by 29 July 2026 if you are newly regulated, or within 28 days of first providing a designated service if you start later. Then complete your written ML/TF risk assessment. Your AML/CTF program must be finalised by 31 December 2026.

What a bookkeeper needs to do

  • Map exactly which of your services are designated services and separate them from work that is generally not designated, such as tax return preparation alone or ordinary bookkeeping that does not trigger the Act.
  • Prepare a written ML/TF risk assessment covering your customer types, services, delivery channels and geography. For bookkeepers, this may include remotely onboarded clients, clients with complex trust or company structures, cash-heavy businesses, and clients operating across borders.
  • Write procedures for customer due diligence, beneficial owner checks, sanctions screening, suspicious matter escalation, record keeping, and staff training. Make the procedures fit the systems you actually use, such as Xero, MYOB, practice management software and document collection tools.
  • Have senior management approve the program and assign responsibility for keeping it current. If your practice is small, that will usually be the principal or owner.
  • Review and update the program whenever your business changes materially, such as adding higher-risk clients, handling different transaction types, or expanding into trust and company work.

A common mistake for bookkeepers is assuming every bookkeeping client automatically makes the practice a reporting entity. That is wrong. The trigger is whether you provide a designated service, not your job title. Another common error is treating the AML/CTF program as a document you write once and file away. If you start servicing property developers, dealers in precious metals, foreign-owned businesses or complex family trusts, your risk profile changes and the program must change too. Bookkeepers also need clear internal rules about when staff must stop and escalate unusual instructions, such as repeated requests to reclassify transactions without supporting documents, unexplained third-party payments, or attempts to hide the true controller of a client entity.

Practical tips for small bookkeeping practices

  • Build your procedures around your client onboarding checklist so AML/CTF steps happen before any designated service is provided.
  • Use separate workflows for sole traders, companies and trusts, because beneficial owner checks are different for each.
  • Document who can approve higher-risk clients, including PEPs and clients linked to high-risk countries.
  • Keep evidence of every review, update and staff training session, not just the final program.
  • If you outsource onboarding or admin support, spell out who does the checks and who remains responsible. The practice stays accountable to AUSTRAC.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

I only do BAS, payroll and data entry. Do I still need an AML/CTF program?
Not necessarily. You only need an AML/CTF program if your bookkeeping business provides a designated service under the AML/CTF Act. A bookkeeping practice should first check whether any of its actual services are designated, because routine bookkeeping work on its own will not always trigger the regime.
Can I just buy a template program online and use that?
You can use a template as a starting point, but it will not be enough on its own. Your program must match your real services, client base, systems, delivery channels and risk profile. If it reads like it was written for a law firm or real estate agency, it is not fit for a bookkeeping practice.
What if I am a sole trader with no staff?
You still need a written AML/CTF program if you provide a designated service. In a sole trader practice, senior management approval usually means you approve it yourself as the owner. You also still need documented procedures, records and updates when your services or risks change.
How much will it cost to put a program in place?
AUSTRAC enrolment is free, but building the program will still take time and may involve adviser, software or training costs. The cost depends on how complex your client base and services are. A small bookkeeping practice with straightforward domestic clients will usually spend less than a firm dealing with trusts, foreign ownership or higher-risk industries.
What happens if my services change after I finish the program?
You must update the ML/TF risk assessment and the AML/CTF program whenever your business changes materially. For bookkeepers, that could mean taking on cash-intensive clients, adding trust or company-related services, onboarding clients remotely, or starting work involving international payment instructions. The program is a working document, not a one-off compliance task.

Related guides