How to create an AML/CTF program

Check which of your services are a "designated service" listed in Schedule 1 of the AML/CTF Act — not your industry as a whole. A law firm might trigger obligations only when it manages client money in a transaction; a real estate agency only when it facilitates a sale or purchase.

Identify and assess your money laundering, terrorism financing and proliferation financing (ML/TF) risk across your customer types, services, delivery channels (face-to-face vs remote) and geography — proliferation financing is an explicit requirement under AUSTRAC's reformed program guidance. This is Step 2 of AUSTRAC's program-development process, and the foundation everything else responds to: your policies exist to control the risks this step identifies.

Your compliance officer must be at management level, ordinarily resident in Australia, and a fit and proper person — they don't need to be a dedicated hire. The standing rule is to appoint one within 28 days of providing a designated service and notify AUSTRAC within 14 days of the appointment. If you're newly regulated under Tranche 2, the AML/CTF Transitional Rules 2026 instead give you until 29 July 2026 to notify AUSTRAC of your compliance officer.

AUSTRAC abolished the old prescriptive two-part "Part A / Part B" program structure on 31 March 2026. You no longer have to split your program into a risk-based Part A and a customer-identification Part B — you can organise it however works for your business, as a single consolidated document or several, provided it addresses governance, your risk assessment, ongoing CDD, third-party reliance, personnel due diligence and training, and independent evaluation, and is approved by senior management.

This is the largest single step. AUSTRAC requires every program to address governance, the ML/TF risk assessment, ongoing customer due diligence, third-party reliance (if any), and personnel due diligence and training, with a periodic independent evaluation on top. If you're a lawyer, accountant, or real estate agent newly regulated under Tranche 2, AUSTRAC's sector-specific Program Starter Kits are built around exactly these requirements and are a faster starting point than a generic template.

AUSTRAC no longer mandates a specific document structure, but most businesses still find it practical to separate a risk assessment, a policy document (your governance structure and high-level commitments), and a process document (the operational procedures staff actually follow for CDD, reporting, training and escalation) — or to combine these into one consolidated program if that suits your size.

Your program isn't valid until approved by senior management or your governing body — and that body needs to receive reports on program performance and risk from your compliance officer at least once every 12 months. Once approved, deliver AML/CTF risk-awareness training tailored to each role, and record who's completed it and when retraining is due.

Your policies must require a periodic independent evaluation of the program, conducted by someone who wasn't responsible for the function being evaluated. AUSTRAC sets a maximum interval of 3 years, but a higher-risk or larger business may need to review more often. The AML/CTF Transitional Rules 2026 stagger the deadline for your first evaluation after the reforms, so check the current transitional timeline rather than assuming the 3-year clock starts today.