Do banks and ADIs need to maintain a written AML/CTF program?

Maintain a written AML/CTF program. Under the reformed AML/CTF Act (in force for existing reporting entities from 31 March 2026 and for Tranche 2 entities from 1 July 2026), a reporting entity's AML/CTF program is an ML/TF risk assessment plus AML/CTF policies that mitigate and manage those risks — this replaced the former Part A / Part B structure. The policies cover customer due diligence, ongoing CDD, transaction monitoring, reporting, record keeping, personnel due diligence and training, governance and senior manager approval, and the designation of an AML/CTF compliance officer.

Trigger: Becoming a reporting entity.

Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 27 of those industries the answer for "Maintain a written AML/CTF program" is no. Banks & ADIs is one of the 8 where the answer is different: yes.

The deciding fact for banks and ADIs: Authorised deposit-taking institution — AML/CTF reporting entity.

About the industry: Authorised deposit-taking institutions regulated by APRA under the Banking Act 1959.

Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires an AML/CTF designated service).

Each cell is the engine's outcome for a business in banks & adis with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.

When due

Before providing the first designated service. Maintained on an ongoing basis, with independent evaluation at least once every 3 years.

Evidence to keep

ML/TF risk assessment, AML/CTF policies, governing body / senior manager approval records, compliance officer designation and AUSTRAC notification, training records, independent evaluation report.

Maximum penalty

Civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention. Separate criminal offences also apply.

Regulator

AUSTRAC

Jurisdiction

Commonwealth (national)

• Customer due diligence (KYC) on every customer: Yes
• Designate an AML/CTF Compliance Officer: Yes
• Detect + enhance due diligence on Domestic + Foreign PEPs: Yes
• Enrol with AUSTRAC as a reporting entity: Yes
• Suspicious matter, threshold, and IFTI reporting to AUSTRAC: Yes
• Independent review of AML/CTF program: Yes
• All 32 answers for banks & adis

• Real estate agents: Yes
• Accountants & bookkeepers: Yes
• Lawyers & solicitors: Yes
• Conveyancers: Yes
• Trust & company service providers: Yes
• Precious metals & stones dealers: Yes
• Gambling & wagering: Yes