Who must maintain a written AML/CTF program?

Every reporting entity needs a documented AML/CTF program — an ML/TF risk assessment plus AML/CTF policies.

Under the reformed AML/CTF Act (in force for existing reporting entities from 31 March 2026 and for Tranche 2 entities from 1 July 2026), a reporting entity's AML/CTF program is an ML/TF risk assessment plus AML/CTF policies that mitigate and manage those risks — this replaced the former Part A / Part B structure. The policies cover customer due diligence, ongoing CDD, transaction monitoring, reporting, record keeping, personnel due diligence and training, governance and senior manager approval, and the designation of an AML/CTF compliance officer. The whole program must be independently evaluated at least once every 3 years, at a frequency set in your policies; for newly regulated entities the first evaluation is due between 30 June 2029 and 31 December 2030, depending on the AUSTRAC account number. The risk assessment must be in place before a designated service is provided.

Applies when the business has an AML/CTF designated service. Where the business has aml adjacent, check whether you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).

How the regulator frames it: All AUSTRAC reporting entities.

What triggers it: Becoming a reporting entity.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (8 of 35: yes; 27 of 35: no).

Structure does not change the answer in the 8 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 8 industries it can reach: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. Tranche 2 industry (Real estate agents) — AML/CTF reporting entity from 1 July 2026.
• Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: does not apply. Requires an AML/CTF designated service.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business holds an Australian financial services licence (AFSL): it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business issues financial products or gives financial product advice: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business holds an Australian credit licence (ACL): it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business provides credit to customers: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business deals in crypto-assets or runs a digital currency exchange: it then applies (digital currency exchange / virtual asset services — AML/CTF reporting entity).
• The business receives large physical cash payments: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business makes or receives international funds transfers: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).

The engine shows this obligation as "check whether this applies" when a business has aml adjacent. It then applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3). That fact is not something Rules Mate can infer from industry, structure or size.

When due

Before providing the first designated service. Maintained on an ongoing basis, with independent evaluation at least once every 3 years.

Frequency

Ongoing

Evidence to keep

ML/TF risk assessment, AML/CTF policies, governing body / senior manager approval records, compliance officer designation and AUSTRAC notification, training records, independent evaluation report.

In force from

1 July 2026

Status

Current

Priority

Critical

Maximum penalty: Civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention. Separate criminal offences also apply.

Independent review. Authority: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ss26F(2), 26F(4)(f), 26H, 116 (compilation C62, in force 1 Jul 2026); AML/CTF Rules 2025 (F2025L01026) r5-10; AML/CTF Transitional Rules 2026 (F2026L00393) Part 7; AUSTRAC "Step 5: Conduct an independent evaluation" (last updated 31 Mar 2026).

Frequency: At least once every 3 years, at the frequency set in your AML/CTF policies (documented rationale). Transitional first-evaluation deadlines (30 Jun 2029 to 31 Dec 2030) depend on the last two digits of your AUSTRAC account number and on when you first provided the designated service.

Who can perform it: An evaluator who is independent: internal (for example internal audit) or external, but not your AML/CTF compliance officer or compliance team, and not anyone who developed the program or assessed your ML/TF risk. No mandatory qualifications. The evaluator reports in writing to your governing body and the senior manager who approves the program. Separately, AUSTRAC can require an external audit by an AUSTRAC-authorised auditor by written notice (ss161-162).

• AUSTRAC v SportsBet Pty Ltd (2024): Smaller online gambling operators are not exempt from AUSTRAC's program-design scrutiny. The ML/TF risk assessment must be live and reassessed regularly.
• AUSTRAC v Entain (Ladbrokes / Neds parent) (2024): Wagering operators under AUSTRAC sustained focus + significant penalty exposure.
• AUSTRAC v SkyCity Adelaide (2024): Mid-tier casinos under same AUSTRAC scrutiny as majors; remediation expectations high.

If this obligation applies to you, so do these 7: the engine uses the same rule for each.

• Enrol with AUSTRAC as a reporting entity
• Customer due diligence (KYC) on every customer
• Suspicious matter, threshold, and IFTI reporting to AUSTRAC
• Independent review of AML/CTF program
• Designate an AML/CTF Compliance Officer
• Detect + enhance due diligence on Domestic + Foreign PEPs
• Lodge the AUSTRAC annual compliance report (AML/CTF Act s 47)

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

• Comply with Australian sanctions law + screening (DFAT): applies to 100% of the same businesses (4.4× the overall rate)

Rules Mate tracks 8 published obligations tagged "aml ctf", 6 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority and carries criminal liability, and is an ongoing duty.

Regulated by Australian Transaction Reports and Analysis Centre.

AUSTRAC: Anti-money laundering and counter-terrorism financing regulator and financial intelligence unit. Administers the AML/CTF Act, including Tranche 2 expansion from 1 July 2026.

• Australian Transaction Reports and Analysis Centre

AML/CTF Act: Federal AML/CTF regulation.

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006

Free tools that help with this obligation:

• AML Tranche 2 scope checker
• Beneficial owner identifier
• Compliance calendar builder