What an AML/CTF program must include

Two parts, not three

The Act says an AML/CTF program "comprises: (a) the reporting entity's ML/TF risk assessment; and (b) the reporting entity's AML/CTF policies".¹ That is the whole structure.

• The risk assessment identifies and assesses the risks of money laundering, terrorism financing and proliferation financing your firm may reasonably face in providing its designated services. s 26C
• The policies are your "policies, procedures, systems and controls" for managing those risks and meeting your obligations. s 26F

Governance is not a separate part. The compliance officer, the governing body's information and the approvals are matters your policies must deal with.² Both parts must suit the nature, size and complexity of your business, so a small practice can have a short, plain program.³

Part one: the risk assessment

In your risk assessment you must have regard to the kinds of services you provide or plan to provide, the kinds of clients, how you deliver the services, the countries you deal with, information AUSTRAC gives you about your risks, and any matters in the Rules.⁵

Three rules sit around it:

• You must not start providing a designated service to a client unless your risk assessment meets these requirements. s 26E
• You must review it when something significant changes, when AUSTRAC tells you about new risks, and in any event at least once every 3 years. s 26D
• A senior manager must approve it and every update. s 26P

Our risk assessment guide walks through the method AUSTRAC describes, step by step.

Part two: the policies

Your policies must manage and mitigate the risks your assessment identifies, make sure you meet your obligations under the Act and the Rules, and suit the size of your business.⁶ The Act and the Rules then list the matters they must deal with. This is the checklist for a policy document.

Proliferation financing. You do not need separate policies for proliferation financing if you reasonably assess that risk as low and your money laundering and terrorism financing policies manage it appropriately. If you rely on this, the burden of showing it is on you, so record your reasons in the risk assessment.⁷

Approvals your policies must require

Your policies must make sure a senior manager approves the step before you:⁸

• start acting for a client if the client, a beneficial owner, or a person the client acts for is a foreign politically exposed person (always);
• start acting where that person is a domestic or international organisation politically exposed person and the client's risk is high;
• enter a written agreement to rely on another business's client identification and verification under s 37A.

If an existing client becomes a politically exposed person in those circumstances, a senior manager must decide whether you continue.⁸ For politically exposed persons you must also establish their source of wealth and source of funds: always for a foreign one, and for a domestic or international organisation one where the risk is high.⁹

The sanctions policy must refer to the Autonomous Sanctions Act 2011 and the Charter of the United Nations Act 1945, which the Rules name.¹⁰ We have not summarised how those Acts work. AUSTRAC points businesses to the lists published by the Department of Foreign Affairs and Trade on its risk assessment page.

Tipping off

It is an offence to disclose that a suspicious matter report has been, or must be, made, where the disclosure would or could reasonably be expected to prejudice an investigation. The penalty is imprisonment for 2 years or 120 penalty units, or both.¹¹ Your policies must set out the safeguards that stop this happening.¹²

Lawyers and qualified accountants have a narrow exception. They may disclose information about a client's affairs in good faith to dissuade the client from conduct that is, or could be, an offence.¹¹ It is an exception to the offence, not a general permission to discuss a report.

Who does what

1. Governing body

   Oversees how the firm identifies and assesses its risks and whether it complies with its policies and the law, and takes reasonable steps to make sure it does. If your business is an individual, that individual is the governing body. s 26H s 5

2. Compliance officer

   Oversees day-to-day compliance and speaks to AUSTRAC for the firm. Must be employed or engaged at management level, with enough authority and resources, a resident of Australia and a fit and proper person. Designate one within 28 days of your first designated service and notify AUSTRAC within 14 days of designating them. s 26J s 26K s 26L s 26M Rules 5-14

3. Senior manager

   Approves the risk assessment, the policies and every update. The governing body must be told in writing of each update to the risk assessment as soon as practicable. s 26P

In a small practice one person may hold all three roles. Where the compliance officer is the same individual as the governing body, or the business is an individual, the Rules 5-7 reports to the governing body do not apply.¹³

Write it down before your first client

You must document your risk assessment and your policies before you first provide a designated service to a customer. Each later update must be documented within 14 days.¹⁴ You must not start providing a designated service until your policies exist, and once they exist you must follow them.¹⁵ AUSTRAC can ask for the documents.¹⁶

Independent evaluation

Your program must be independently evaluated at least once every 3 years. The evaluation covers the steps you took in your risk assessment, the design of your policies, whether you follow them, and whether you are managing your risks. The evaluator gives a written report to your governing body and to the senior manager who approves the program.¹⁷

For firms whose enrolment was due on 29 July 2026, the first evaluation must happen before a date set by the last two digits of the enrolment identifier.¹⁸

Because we write program documents, we do not carry out independent evaluations. The set-up service plans the evaluation with you and you choose the evaluator.

The free option: AUSTRAC's starter kits

AUSTRAC publishes free program starter kits for accountants, conveyancers, jewellers, the legal profession and real estate. The release we checked is 1.1, dated 10 June 2026.¹⁹ Each kit has suitability criteria. For the accountant and real estate kits they include 15 or fewer personnel, mostly Australian-resident individual clients, no overseas property, no fully remote self-service options and not being part of a large reporting group. For a practice outside the profile, the accountant kit says "you cannot rely on the starter kit to meet AUSTRAC's regulatory expectations of an appropriate AML/CTF program for your practice". AUSTRAC also says its guidance "isn't a substitute for legal advice".²⁰ Check the criteria for your sector on AUSTRAC's program starter kits page before you choose.

AUSTRAC links on this page open in a new window. AUSTRAC has not reviewed or endorsed this guide.

Where we fit

• Your sector: accounting practices, real estate agencies, conveyancers and legal practices.
• The documents: our kit is built on AUSTRAC's starter kits. The risk assessment, the policies and the approval record are documents 02, 03 and 24, with the section behind each obligation written in.
• Set-up with us: the set-up service works through your program with you. We do not act as your compliance officer or senior manager.
• More: the risk assessment guide, the other guides and every source we use on the sources page.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.