AML/CTF program — formerly Part A and Part B, explained

What an AML/CTF program is now

A reporting entity providing a designated service must have, and comply with, an AML/CTF program under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). The AML/CTF Amendment Act 2024 reformed what that program contains. The reformed obligations applied to existing reporting entities from 31 March 2026 and to newly regulated Tranche 2 entities (real estate, lawyers, conveyancers, accountants, trust and company service providers, and dealers in precious metals and stones) from 1 July 2026. If you are newly regulated, see the AUSTRAC enrolment walkthrough.

Under the reformed Act, an AML/CTF program is made up of:

• an ML/TF risk assessment — identifying and assessing the money laundering, terrorism financing and proliferation financing risks you may reasonably face, by reference to your customers, designated services, delivery channels and jurisdictions;
• AML/CTF policies — the documented policies, procedures, systems and controls that mitigate and manage those risks, including customer due diligence, ongoing CDD, transaction monitoring, reporting, record keeping, personnel due diligence and training;
• governance — senior manager approval of the risk assessment and policies, and oversight by the governing body; and
• an AML/CTF compliance officer at management level, designated and notified to AUSTRAC.

The program must be kept up to date and reviewed when your business or risk environment changes. AML risk-based approach (AUSTRAC) explains how the risk assessment drives everything else.

The former Part A / Part B structure

Before the reform, an AML/CTF program had two parts. Part A (the "general" program) held the ML/TF risk assessment and the systems and controls built on it: employee due diligence, risk awareness training, transaction monitoring, the AML/CTF compliance officer, board oversight and independent review. Part B set out the applicable customer identification procedures (KYC), including beneficial owner and politically exposed person (PEP) checks.

That structure no longer applies. Many businesses still hold programs written in the Part A / Part B format, and AUSTRAC's reformed guidance expects them to be rebuilt around the risk assessment and AML/CTF policies rather than simply relabelled. A legacy structure often means reformed requirements are missing, not just renamed.

How Part A and Part B map to the reformed program

Independent evaluation and AUSTRAC oversight

The former independent review of Part A has been replaced by an independent evaluation of the whole AML/CTF program, at least once every 3 years and at a frequency set in your AML/CTF policies. The evaluator can be internal or external, but must be independent of the program (for example, not involved in developing it). The evaluation tests whether you appropriately identified, assessed, mitigated and managed your ML/TF risks and complied with your policies. For newly regulated Tranche 2 entities, the first evaluation is due between 30 June 2029 and 31 December 2030, depending on the last two digits of your AUSTRAC account number. Source: AUSTRAC — Step 5: Conduct an independent evaluation.

AUSTRAC can also, by written notice, require an external audit where it suspects non-compliance. AUSTRAC compliance report (ACR) annual reporting provides a snapshot of compliance activity.

Failing to have and comply with an AML/CTF program is a civil penalty contravention. The maximum is 100,000 penalty units for a body corporate ($36.4M at $364 per unit for conduct from 1 July 2026) and 20,000 penalty units ($7.28M) for others — maximum per contravention.