Do trust and company service providers need to maintain a written AML/CTF program?
A computed answer from the Rules Mate applicability engine, with the exact condition, the outcome for every structure and size, and the primary source.
Short answer: Yes
Yes. This obligation applies to trust and company service providers whatever their structure or size. The deciding fact: Tranche 2 industry (Trust & company service providers) — AML/CTF reporting entity from 1 July 2026.
The obligation in brief
Maintain a written AML/CTF program. Under the reformed AML/CTF Act (in force for existing reporting entities from 31 March 2026 and for Tranche 2 entities from 1 July 2026), a reporting entity's AML/CTF program is an ML/TF risk assessment plus AML/CTF policies that mitigate and manage those risks — this replaced the former Part A / Part B structure. The policies cover customer due diligence, ongoing CDD, transaction monitoring, reporting, record keeping, personnel due diligence and training, governance and senior manager approval, and the designation of an AML/CTF compliance officer.
Trigger: Becoming a reporting entity.
Why trust & company service providers get a different answer
Rules Mate runs its applicability engine across 9 business structures and 6 size bands for each of the 35 industries it maps. For 27 of those industries the answer for "Maintain a written AML/CTF program" is no. Trust & company service providers is one of the 8 where the answer is different: yes.
The deciding fact for trust and company service providers: Tranche 2 industry (Trust & company service providers) — AML/CTF reporting entity from 1 July 2026.
About the industry: Entities providing trust or company formation, registered agent, or nominee services. Tranche 2 captured.
Compare a professional services (general) business with 6–19 employees structured as a Pty Ltd company: the obligation does not apply (Requires an AML/CTF designated service).
Answer by business structure and size
Each cell is the engine's outcome for a business in trust & company service providers with that structure and size, assuming it sells to consumers and small businesses and holds customer contact details. "Check" means the obligation turns on a fact the industry does not settle.
| Structure | No employees | 1–5 employees | 6–19 employees | 20–99 employees | 100–499 employees | 500+ employees |
|---|---|---|---|---|---|---|
| Sole trader | Yes | Yes | Yes | Yes | Yes | Yes |
| Partnership | Yes | Yes | Yes | Yes | Yes | Yes |
| Trust | Yes | Yes | Yes | Yes | Yes | Yes |
| Pty Ltd company | Yes | Yes | Yes | Yes | Yes | Yes |
| Public company | Yes | Yes | Yes | Yes | Yes | Yes |
| Not-for-profit (unregistered) | Yes | Yes | Yes | Yes | Yes | Yes |
| Registered charity | Yes | Yes | Yes | Yes | Yes | Yes |
| Super fund | Yes | Yes | Yes | Yes | Yes | Yes |
| Foreign company | Yes | Yes | Yes | Yes | Yes | Yes |
Designated services that catch trust & company service providers
| AML/CTF Act reference | Service | Customer for due diligence |
|---|---|---|
| s 6 table 6 items 5–9 | Selling shelf companies; creating or restructuring companies and trusts; acting as, or arranging for someone to act as, a director, secretary, trustee, partner or corporate power of attorney; acting as a nominee shareholder; providing a registered office or principal place of business address | Varies: for company creation, the proposed beneficial owners and directors; for an express trust, the trustee, settlor and beneficiaries; for nominee and officer services, the nominator |
- Lawyers and accountants who provide the same services are caught by the same items; the obligation follows the service, not the job title.
AUSTRAC has not published a starter kit for trust and company service providers. A TCSP has to build its ML/TF risk assessment and policies without one.
What the obligation requires
- When due
- Before providing the first designated service. Maintained on an ongoing basis, with independent evaluation at least once every 3 years.
- Evidence to keep
- ML/TF risk assessment, AML/CTF policies, governing body / senior manager approval records, compliance officer designation and AUSTRAC notification, training records, independent evaluation report.
- Maximum penalty
- Civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention. Separate criminal offences also apply.
- Regulator
- AUSTRAC
- Jurisdiction
- Commonwealth (national)
Other obligations where trust & company service providers differ from the norm
- Customer due diligence (KYC) on every customer: Yes
- Designate an AML/CTF Compliance Officer: Yes
- Detect + enhance due diligence on Domestic + Foreign PEPs: Yes
- Enrol with AUSTRAC as a reporting entity: Yes
- Suspicious matter, threshold, and IFTI reporting to AUSTRAC: Yes
- Independent review of AML/CTF program: Yes
- All 15 answers for trust & company service providers
Other industries with a non-default answer
Questions
- Do trust and company service providers need to maintain a written AML/CTF program?
- Yes. This obligation applies to trust and company service providers whatever their structure or size. The deciding fact: Tranche 2 industry (Trust & company service providers) — AML/CTF reporting entity from 1 July 2026.
- Is the answer the same for every industry?
- No. For 27 of the 35 industries Rules Mate maps, the answer is no. Trust & company service providers is one of 8 industries with a different answer.
Related
Sources
- AUSTRAC: official source
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006
- AUSTRAC guidance
- AUSTRAC: Professional designated services (table 6)
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (compilation in force 1 Jul 2026)
Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.