AML Compliance Guide
Log in Create Free Account

AML/CTF program for Financial adviserss — 2026 AUSTRAC Guide

If your financial advice business provides a designated service from 1 July 2026, you must have a written AML/CTF program that matches the money laundering, terrorism financing and proliferation financing risks in your advice practice. For financial advisers, that means a program built around how you onboard clients, give advice, handle rollovers or investment instructions, use platforms, and deal with higher-risk clients such as PEPs. If you do not comply, AUSTRAC can take enforcement action, civil penalties can reach $33.5 million per contravention, and intentional breaches can also attract criminal penalties.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Your AML/CTF program is not a template you download and forget. It is the written system that explains how your firm identifies risk and how you will control it in day-to-day advice work. It has two parts: first, your written ML/TF risk assessment; second, the policies, procedures, systems and controls you will use to manage those risks. For a financial advice practice, that usually covers client onboarding, identity checks, beneficial owner checks for company and trust clients, sanctions screening, escalation of unusual investment behaviour, suspicious matter reporting, record keeping, and staff training. Senior management must approve the program, and you must complete the risk assessment before you finalise the program.

Deadline and sequence

Enrol with AUSTRAC first if you are a reporting entity, then complete your written ML/TF risk assessment, then finalise your AML/CTF program. The program must be finalised by 31 December 2026.

What a financial advice practice should do

  • Map exactly which services in your practice are designated services. Do not assume every advice activity is captured.
  • Write a risk assessment covering your customers, services, delivery channels and geography. Include factors such as remote onboarding, use of attorney or third-party instructions, offshore connections, complex structures, SMSFs, trusts and company clients.
  • Set your customer due diligence rules: what ID you collect for individuals, how you verify companies through ASIC, how you identify trustees and beneficial owners, and when simplified or enhanced due diligence applies.
  • Build sanctions screening into onboarding and ongoing reviews, including checks against the DFAT autonomous sanctions list and the UN Security Council consolidated list.
  • Create escalation rules for red flags relevant to advice businesses, such as unexplained source of wealth, pressure to move funds quickly, unusual rollover patterns, inconsistent client instructions, or investment activity that does not fit the client profile.
  • Document who approves high-risk clients, who files SMRs, how records are stored for 7 years after the relationship ends, and how staff training is delivered and refreshed.

A common mistake in advice firms is treating the AML/CTF program as a back-office compliance document with no connection to client service. AUSTRAC expects the program to reflect how your business actually operates. If you use paraplanners, client service officers, outsourced administration, dealer group systems, platform providers or external onboarding technology, your program must say who does what and how you supervise it. Outsourcing does not remove your responsibility. Another mistake is copying a banking-style program that ignores advice-specific risks like beneficial ownership through family trusts, politically exposed persons, or clients using advisers to add credibility to unusual transactions.

Practical tips for small advice firms

  • Use your existing fact-find and onboarding pack to gather AML/CTF information instead of creating a separate client process.
  • Add a risk-rating step before advice is implemented, not after funds move.
  • Create a short internal checklist for advisers: ID verified, beneficial owner identified, sanctions screened, PEP considered, source of funds concerns reviewed.
  • Train everyone who speaks to clients or handles instructions, not just authorised representatives.
  • Review the program whenever your practice changes materially, such as adding offshore clients, new referral channels, or a new service involving movement of client money.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Do I need an AML/CTF program if I only provide personal advice and never hold client money?
You need an AML/CTF program if your business provides a designated service. Whether you hold client money is relevant to risk, but it is not the only trigger. Start by mapping your actual services against the designated services that apply to financial advisers.
Can I use my licensee's or dealer group's AML documents instead of creating my own?
You can use group documents, templates or shared systems, but your business still needs a program that fits how your own practice operates. If your client base, onboarding process, referral sources or service model differ, your program must reflect that. AUSTRAC will look at what your firm actually does, not just what is in a head office manual.
What if most of my clients are low-risk retirees with simple portfolios?
Your program can be proportionate to a lower-risk client base, but it still must be written and complete. You may be able to apply simplified due diligence in genuinely low-risk situations, such as some listed companies or government bodies, but you still need rules for identifying when a client is higher risk. Even a mostly low-risk advice practice needs clear escalation procedures.
How much will it cost to put an AML/CTF program in place?
AUSTRAC enrolment is free, but preparing the program will still take time and usually some cost. The main cost drivers are documenting your risk assessment, adjusting onboarding systems, training staff and getting legal or compliance help if your structure is complex. For a small advice firm, keeping the program tightly aligned to your real services will usually keep costs down better than overbuilding it.
When should I update the program after it is finalised?
Update it whenever your business changes materially. For a financial advice practice, that includes starting remote-only onboarding, taking on overseas-connected clients, adding trust or company structuring work, changing platform arrangements, or introducing outsourced onboarding or administration. You should also refresh staff training whenever the program is updated.

Related guides