Why must AML/CTF program templates be customised?

• The program is an ML/TF risk assessment plus AML/CTF policies that mitigate and manage those risks. This replaced the structure formerly split into Part A and Part B, from 31 March 2026 for existing reporting entities and 1 July 2026 for Tranche 2.
• The risk assessment must consider the nature, size and complexity of your business, your customers, the services you provide, how you deliver them, and the countries you deal with.
• The policies must cover every mandatory topic in s 26F: customer due diligence, reporting, record keeping, personnel due diligence, training, governance and senior manager approval, the AML/CTF compliance officer, and independent evaluation.
• The program must be in place before you provide your first designated service, and approved by a senior manager (s 26P).
• Failing to comply with your own AML/CTF policies is a contravention in its own right (s 26G), so a policy you do not follow creates exposure rather than reducing it.

AUSTRAC's free starter kits include a Customise guide. AUSTRAC says that if your business does not meet every "who the starter kit is for" criterion, you cannot rely on the starter kit to meet its regulatory expectations. Where a business does fit and builds its program from the kit, AUSTRAC says its engagement will focus on how you apply the program.

• Does the AUSTRAC starter kit fit my firm?

1. Replace every placeholder: business name, AUSTRAC account number, compliance officer name, senior manager approval and date.
2. Rewrite the risk assessment for your actual services, customer types, delivery channels and countries; delete scenarios that do not occur in your business.
3. Choose between the options a template offers (for example, whether you accept cash, rely on third parties for customer identification, or deal with trusts) and remove the ones you do not use.
4. Align the processes to how your staff actually onboard clients, escalate unusual activity and keep records, because s 26G tests you against them.
5. Set an independent evaluation frequency of no more than 3 years, with a documented reason.
6. Record who lodges the annual compliance report and when (the first is due by 30 September 2027).

Program contraventions are civil penalty provisions with a maximum of $36.4M per contravention for a body corporate and $7.28M for an individual (100,000 and 20,000 penalty units at $364). AUSTRAC has said it expects "effort, not perfection" from newly regulated businesses in 2026–27, while taking early enforcement action against businesses that fail to enrol or are complicit in money laundering.