Maintain a written AML/CTF program
Every reporting entity needs a documented AML/CTF program — an ML/TF risk assessment plus AML/CTF policies.
Who must comply
All AUSTRAC reporting entities.
What triggers it
Becoming a reporting entity.
When due
Before providing the first designated service. Maintained on an ongoing basis, with independent evaluation at least once every 3 years.
Evidence required
ML/TF risk assessment, AML/CTF policies, governing body / senior manager approval records, compliance officer designation and AUSTRAC notification, training records, independent evaluation report.
Max penalty
Civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention. Separate criminal offences also apply.
Effective from
1 July 2026
Who must comply with this? The applicability test by industry, business structure and size.
Summary
Under the reformed AML/CTF Act (in force for existing reporting entities from 31 March 2026 and for Tranche 2 entities from 1 July 2026), a reporting entity's AML/CTF program is an ML/TF risk assessment plus AML/CTF policies that mitigate and manage those risks — this replaced the former Part A / Part B structure. The policies cover customer due diligence, ongoing CDD, transaction monitoring, reporting, record keeping, personnel due diligence and training, governance and senior manager approval, and the designation of an AML/CTF compliance officer. The whole program must be independently evaluated at least once every 3 years, at a frequency set in your policies; for newly regulated entities the first evaluation is due between 30 June 2029 and 31 December 2030, depending on the AUSTRAC account number. The risk assessment must be in place before a designated service is provided.
Enforced by
Source legislation
Industries
Topics
Related
- CWLTHEnrol with AUSTRAC as a reporting entityTranche 2 entities must enrol with AUSTRAC within 28 days of first providing a designated service (29 July 2026 for services from 1 July 2026).
- CWLTHCustomer due diligence (KYC) on every customerIdentify and verify every customer (and beneficial owner) before providing a designated service.
- CWLTHSuspicious matter, threshold, and IFTI reporting to AUSTRACLodge SMRs, TTRs ($10K+ cash), and IFTI reports via AUSTRAC Online.
- CWLTHDesignate an AML/CTF Compliance OfficerReporting entities must designate an eligible AML/CTF compliance officer at management level and notify AUSTRAC.
- CWLTHDetect + enhance due diligence on Domestic + Foreign PEPsAML/CTF Rules require detection + EDD on Politically Exposed Persons (foreign + domestic + international organisation).
- CWLTHIndependent review of AML/CTF programReporting entities must have their whole AML/CTF program independently evaluated at least once every 3 years.
Reading
Frequently asked questions
- Who must comply with a written AML/CTF program?
- All AUSTRAC reporting entities.
- What triggers a written AML/CTF program?
- Becoming a reporting entity.
- When is a written AML/CTF program due?
- Before providing the first designated service. Maintained on an ongoing basis, with independent evaluation at least once every 3 years.
- What is the maximum penalty for a written AML/CTF program?
- Civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention. Separate criminal offences also apply.
- What evidence is required for a written AML/CTF program?
- ML/TF risk assessment, AML/CTF policies, governing body / senior manager approval records, compliance officer designation and AUSTRAC notification, training records, independent evaluation report.
Source: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance. Rules Mate is not a law firm. Always verify against the live regulator source before acting.