Is an annual review an obligation?

Not as such. The Act requires a review of the risk assessment when a trigger occurs and at least once every 3 years (s 26D), a review of the policies at least once every 3 years (s 26F(3)(d)) and an independent evaluation at least once every 3 years (s 26F(4)(f)). The compliance officer must report to the governing body at least once every 12 months (Rules 5-7), unless the business is an individual or one person holds both roles. Many firms still diarise a yearly check, and the annual compliance report makes a natural point to do it.

What are the penalties for getting it wrong?

Most obligations on this page are civil penalty provisions. A court can order up to 100,000 penalty units (A$36.4 million) for a body corporate, or 20,000 penalty units (A$7.28 million) for anyone else, at the A$364 penalty unit that applies from 1 July 2026 (s 175(4)–(5)). Failing to enrol can also lead to an infringement notice of 60 penalty units (A$21,840) for a body corporate or 12 penalty units (A$4,368) for anyone else (ss 184 and 186A).

Do we need a training register?

Your policies must deal with training: initial training when someone starts and ongoing training after that, suited to their role and the risks they handle (s 26F(4)(e); Rules 5-9). You must keep records reasonably necessary to show you met your program obligations (s 116). A register of who was trained, on what and when is the simplest way to show it.

AML/CTF obligations checklist for tranche 2 firms

How to use this checklist

For each row, ask: could we show this to AUSTRAC today, on paper? If not, that is a gap. If you have gaps, start with risk assessment and policies: they must be documented before you start providing a designated service to a client.¹

The "In our kit" column names the document in our kit that records each item. You can also build each record yourself from AUSTRAC's free program starter kits. AUSTRAC links on this page open in a new window. AUSTRAC has not reviewed or endorsed this checklist.

Scope and enrolment

Scope and enrolment
Obligation	When	Law	In our kit
Decide which of your services are designated services	Before anything else	s 6	01
Enrol with AUSTRAC, if you were already providing a Table 5 or 6 service before 1 July 2026 (and no other designated service)	Was due 29 July 2026 past	Sch 3 item 12	23
Enrol, if you started later	Within 28 days of your first designated service	s 51B(1)	23
Tell AUSTRAC about changes to your enrolment details	Within 14 days of the change	s 51F	23

Late enrolment does not lapse: the obligation continues, and each day after the deadline is a separate contravention.² AUSTRAC said on 28 August 2026 that it had begun issuing section 167 notices to businesses that appear to be providing designated services without enrolling.³ You enrol directly with AUSTRAC; our enrolment guide explains how.

Compliance officer and governing body

Compliance officer and governing body
Obligation	When	Law	In our kit
Designate a compliance officer: management level, enough authority and resources, resident of Australia, fit and proper	Within 28 days of your first designated service	s 26J s 26K Rules 5-14	06
Notify AUSTRAC of the compliance officer	Within 14 days of designating them	s 26M	06, 23
Governing body oversees risk and compliance	Ongoing	s 26H	05
Compliance officer reports to the governing body (not needed where one person holds both roles, or the business is an individual)	At least once every 12 months	Rules 5-7	21

If your business is an individual, such as a sole principal, that individual is the governing body.⁴

Risk assessment and policies

Your AML/CTF program is your ML/TF risk assessment plus your AML/CTF policies.⁵ Our program guide lists what the policies must cover, and the risk assessment guide walks through the method.

Risk assessment and policies
Obligation	When	Law	In our kit
Carry out the ML/TF risk assessment (services, clients, channels, countries, AUSTRAC information)	Before your first designated service	s 26C s 26E	02
Review the risk assessment	On a significant change, on AUSTRAC information, after adverse evaluation findings, and at least once every 3 years	s 26D Rules 5-1	02, 20
Develop and maintain AML/CTF policies	Before your first designated service	s 26F	03, 04
Follow your own policies	Always	s 26G	03, 04
Review the policies	At least once every 3 years, and after a risk-assessment review	s 26F(3)(c) s 26F(3)(d)	03, 20
A senior manager approves the risk assessment, the policies and every update	Each time, including every update	s 26P	24
Tell the governing body in writing of each risk-assessment update	As soon as practicable	s 26P	24
Document the program	Before your first designated service; updates within 14 days	s 26N Rules 5-15	24

People

People
Obligation	When	Law	In our kit
Personnel due diligence: skills, knowledge, expertise and integrity of people in AML/CTF roles	Before they start and during their engagement	s 26F(4)(d) Rules 5-8	07
Training suited to each person's role and risks	On starting, then ongoing	s 26F(4)(e) Rules 5-9	08

Client due diligence

Client due diligence
Obligation	When	Law	In our kit
Initial due diligence: who the client is, who acts for them, beneficial owners, politically exposed person and sanctions status, nature and purpose	Before you start the designated service	s 28	09 to 12
Delayed due diligence, where the Rules allow it (real estate: the earlier of 28 days after exchange and 3 days before the agreed settlement day)	Within the Rules window	s 29 Rules 6-32	04
Ongoing due diligence: monitor for unusual activity, re-rate risk on a change, keep client information current	Throughout the relationship	s 30	14
Simplified due diligence, only if the client's risk is low	Where your policies allow it	s 31 Rules 6-16	04
Enhanced due diligence: high risk; a suspicious matter where you keep acting; a foreign politically exposed person; a link to a jurisdiction where the Financial Action Task Force has called for enhanced due diligence; unusual services	When a trigger applies	s 32 Rules 6-20	13
Clients you already had on 1 July 2026 (pre-commencement customers): monitor for changes that make them medium or high risk	Ongoing	s 36 s 30(2)(d)	15
Relying on another business's client checks: written agreement or documented reasons	Before you rely on them	s 37A s 38 Rules 6-29 Rules 6-31	04

A senior manager must approve acting for a foreign politically exposed person, and for a domestic or international organisation one where the risk is high.⁶

Reporting to AUSTRAC

Reports to AUSTRAC
Obligation	When	Law	In our kit
Suspicious matter report	Within 3 business days of forming the suspicion; 24 hours for terrorism financing; 5 business days where some, but not all, of the information may be privileged and the privilege belongs to someone else	s 41(2) Rules 9-1	16, 17
Threshold transaction report: A$10,000 or more in physical currency	Within 10 business days of the transaction	s 43 s 5	17
Annual compliance report, in AUSTRAC's approved online form	First period 1 July 2026 to 30 June 2027; lodge between 1 July and 30 September 2027	s 47 Rules 9-9	18
Safeguards against tipping off a client about a report	Always	s 123 Rules 5-13	03

Where you reasonably believe all of the information behind a suspicion is privileged, you may refuse to give the report.⁷ The compliance report is a report in the approved form, not a statutory declaration.⁸

Records

Keep records in English, or in a form readily convertible into English.⁹

Records and how long to keep them
Record	Keep for	Law	In our kit
Records to reconstruct each transaction	7 years from when the record is made	s 107	19
Documents a client gives you about a transaction	7 years after they are given	s 108	19
Client due diligence records	7 years after the relationship ends or the one-off transaction is completed	s 111	19
Program records: risk assessment, policies, approvals, training, evaluations	7 years after the record stops being relevant	s 116	19

Independent evaluation

Your program must be independently evaluated at least once every 3 years, with a written report to your governing body and to the senior manager who approves the program.¹⁰ If your enrolment was due on 29 July 2026, the first evaluation must happen before a date set by the last two digits of your enrolment identifier.¹¹

First independent evaluation, by enrolment identifier
Last two digits of your enrolment identifier	Evaluate before
Both odd (for example 35)	30 June 2029
Odd, then even (for example 36)	31 December 2029
Both even (for example 46)	30 June 2030
Even, then odd (for example 47)	31 December 2030

Our kit's evaluation plan is document 22 and the reporting calendar is document 18. We do not carry out evaluations, because we write program documents. Every date on this page is also on our key dates page.

What getting it wrong can cost

Most of these are civil penalty provisions

A court can order a civil penalty of up to 100,000 penalty units (A$36.4 million) for a body corporate, or 20,000 penalty units (A$7.28 million) for anyone else. Those figures use the A$364 penalty unit that applies from 1 July 2026.¹²

AUSTRAC has said it will take "a pragmatic and proportionate approach" as businesses move to the new requirements, but expects them to keep "actively managing their ML/TF risks and work towards full compliance".¹³ That is a statement of approach, not an exemption. If you have gaps, write down a plan to close them and work through it.

Where we fit

Your sector: accounting practices, real estate agencies, conveyancers and legal practices.
The documents: our kit has a document for each row above, built on AUSTRAC's starter kits.
Set-up with us: the set-up service fills in the documents with you. We do not act as your compliance officer, lodge reports for you or carry out your evaluation.
More: the other guides and every source we use on the sources page.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. AUSTRAC pages are guidance, not law.

AML/CTF Act ss 26E, 26F(8) and 26N; AML/CTF Rules 2025 (F2025L01026), rule 5-15. legislation.gov.au/C2006A00169/latest/text
AML/CTF Act s 51B(2B) and (2C). Enrolment for firms already providing the service: AML/CTF Amendment Act 2024 (C2024A00110), Schedule 3, item 12. legislation.gov.au/C2024A00110/latest/text
AUSTRAC, "AUSTRAC issues notices to non-enrolled businesses", published 28 August 2026. Guidance, not law.
AML/CTF Act s 5, definition of "governing body".
AML/CTF Act s 26B.
AML/CTF Rules 2025, rule 5-5(1). legislation.gov.au/F2025L01026/latest/text
AML/CTF Act s 41(2A). Where some of the information is privileged, the report must be accompanied by an LPP form: s 41(3)(aa).
AML/CTF Act s 47(3); AML/CTF Rules 2025, rule 9-9.
AML/CTF Act ss 111(2)(b) and 116(1)(b).
AML/CTF Act s 26F(4)(f); AML/CTF Rules 2025, rule 5-10.
AML/CTF Transitional Rules 2026 (F2026L00393), s 17. legislation.gov.au/F2026L00393/latest/text
AML/CTF Act s 175(4) and (5). Crimes (Amount of a Penalty Unit) Instrument 2026 (F2026N00424), s 5: a penalty unit is A$364. 100,000 × A$364 = A$36.4 million; 20,000 × A$364 = A$7.28 million. legislation.gov.au/F2026N00424/latest/text
AUSTRAC, "Changes to AML/CTF obligations: What you need to do", published 1 July 2026. Guidance, not law.

AML/CTF obligations checklist