Is an AML/CTF program the same as an AML/CTF policy?

The terms are often used interchangeably but technically the AML/CTF Act requires a program — a comprehensive framework covering risk assessment, customer due diligence, staff training, transaction monitoring, and reporting. A policy is typically one component within the program. When AUSTRAC refers to your AML/CTF program, it means the complete documented framework, not a single policy document.

Does every business need an AML/CTF program or only large ones?

Reporting entities generally need an AML/CTF program regardless of size, subject to applicable statutory exemptions. A sole-practitioner conveyancer and a large law firm may both need a written program. The program must be appropriate to the nature, size, and complexity of the reporting entity's business. A small, low-complexity practice can use AUSTRAC's Program Starter Kit as a starting point and customise it to its circumstances.

What happens if a business provides designated services without an AML/CTF program?

Providing a designated service without meeting the applicable AML/CTF program obligations can contravene the AML/CTF Act 2006. AUSTRAC publishes enforcement actions publicly.

What is beneficial ownership and why does it matter for an AML/CTF program?

Beneficial ownership refers to the natural persons who ultimately own or control an entity — those who own 25% or more of shares or voting rights, or who otherwise control the entity. Identifying beneficial owners is a distinct obligation from identifying the person who signs your engagement documents. For trusts, this means tracing through to the natural persons who ultimately control and benefit.

Can I use the same AML/CTF program for multiple related entities?

A joint AML/CTF program is possible if your related entities form a reporting group — a structure that replaced the previous 'designated business group' (DBG) model from 31 March 2026. Each entity in the group must still be enrolled separately with AUSTRAC. Outside a reporting group structure, each reporting entity must have its own program.

How long does it take to write an AML/CTF program?

The time required to write an AML/CTF program varies with the size and complexity of the business, its service lines, and its client types. The risk assessment requires documenting every service, client type, delivery channel, and jurisdiction. AUSTRAC's Starter Kit can be used as a base, or Klyvon can assist with document generation.

Does my program need a lawyer to review it?

AUSTRAC does not mandate legal review of your AML/CTF program, but professional review is strongly recommended before operational reliance — particularly for firms with complex service mixes, PEP clients, or international transactions. The program must demonstrate genuine risk-based thinking, not just tick boxes. A qualified AML/CTF adviser or compliance lawyer can identify gaps that may not be obvious from the AUSTRAC guidance alone.

Can my AML/CTF program be stored digitally or does it need to be printed?

AUSTRAC accepts programs in digital or printed form — there is no requirement for a physical document. Your program must be accessible to relevant staff and available for production to AUSTRAC on request. If stored digitally, ensure version control is maintained so that historical versions can be retrieved to demonstrate the program's evolution over time.

What is the difference between a joint program and an individual program?

An individual program covers a single reporting entity and its designated services. A joint program covers all members of a reporting group — the structure that replaced the previous 'designated business group' (DBG) model from 31 March 2026 — administered by a nominated lead entity. Under a joint program, one entity administers compliance on behalf of all group members, but each member retains individual legal liability for compliance with their own obligations.

Does my program need to be registered or lodged with AUSTRAC?

No. You do not lodge or register your AML/CTF program with AUSTRAC. You must have a compliant program in place and be ready to produce it to AUSTRAC on request during a compliance review or investigation. AUSTRAC may also ask you to self-certify compliance through the Annual Compliance Report lodged by 30 September each year.

What is a reporting group and does it affect my program obligations?

A reporting group lets two or more related reporting entities comply jointly under a single AML/CTF program, administered by a nominated lead entity. Reporting groups replaced the previous 'designated business group' (DBG) structure from 31 March 2026 — existing DBGs ceased to exist on that date, and any group wanting joint compliance had to transition to the new reporting group structure. A reporting group can form either because all members of an existing business group agree on a lead entity, or by two or more reporting entities electing to join together. The advantage is operational efficiency — one program, one compliance function — but each entity remains individually liable for its own compliance.

How does the outcomes-based approach under the 2026 reforms change what my program must demonstrate?

The AML/CTF Amendment Act 2024 shifts the compliance framework from prescriptive rules-based obligations toward an outcomes-based approach. AUSTRAC now assesses whether your program effectively manages ML/TF risk — not just whether you have a document that ticks statutory boxes. This means your risk assessment must be genuinely analytical, your controls must be traceable to identified risks, and your program must be operationally followed. A technically complete document that is not reflected in actual practice will not satisfy the outcomes-based standard.

Is there a minimum length or format required for an AML/CTF program?

AUSTRAC does not prescribe a minimum length, word count, or format. The program must cover the applicable elements under the AML/CTF Act 2006 and AML/CTF Rules 2025. Its content should be appropriate to the nature, size and complexity of the reporting entity's business.

What must an independent evaluation of an AML/CTF program actually assess?

The evaluation must assess the steps taken when undertaking or reviewing the ML/TF risk assessment against the legislation, assess the design of the AML/CTF policies against the legislation, test compliance with those policies, and test whether the reporting entity appropriately identifies, assesses, manages and mitigates the ML/TF risks it may reasonably face. The findings must be recorded in a written independent-evaluation report.

Who counts as 'independent' for an AML/CTF program evaluation?

The evaluation must be independent. Whether an internal or external evaluator is suitable depends on the applicable independence requirements and the reporting entity's circumstances. Confirm that the proposed evaluator meets those requirements before appointment.

How much does it cost to build an AML/CTF program?

Costs vary by approach. AUSTRAC's sector starter kits are free, while building the program yourself requires internal time. Consultant pricing varies by scope, business complexity, and provider. Compliance software can also generate a firm-specific program.

Updated August 2026

Reference · The AML/CTF Program

What is an AML/CTF program?

A written framework covering how your business assesses ML/TF risk and verifies customers — required before you provide a single designated service. What it must contain, and how to build one.

Generate my program →See the 9 steps

Core components
Risk management + CDD: 3 yrs
Independent evaluation: 7 yrs
Record retention: 1 Jul
In effect since

An AML/CTF program is the written framework a reporting entity uses to identify, assess and manage money laundering and terrorism financing risk. It connects the business’s ML/TF risk assessment to governance, customer due diligence, transaction monitoring, staff training, regulatory reporting, record keeping and review. Subject to applicable statutory exemptions, a reporting entity that provides a designated service must have a program appropriate to the nature, size and complexity of its business.

In this guide

What is an AML/CTF program?Do you still need Part A / Part B?The 4 risk vectors Customer due diligence Build it — 9 steps Frequently asked questions

I. The Short Answer

What is an AML/CTF program, and who needs one?

“When AUSTRAC refers to your AML/CTF program, it means the complete documented framework — not a single policy document.”
— AML/CTF Act 2006

III. The Foundation

A ML/TF risk assessment comes first — here's why

Every control in your program has to be traceable to a risk identified here. AUSTRAC checks that traceability directly.

Client-type risk

Individuals, companies, trusts, SMSFs, PEPs, non-residents. Higher-risk types need enhanced controls and more frequent reviews.

Product & service risk

Property transactions, trust formation, precious metals, client fund management — internationally recognised as high risk.

Delivery channel risk

Online-only onboarding, remote transactions, trust accounts, and intermediaries all increase risk vs face-to-face.

Jurisdiction risk

Connections to FATF grey- or black-listed countries. Your assessment must reference current listings and apply enhanced CDD.

The assessment must be reviewed when a specified review trigger occurs and, in any event, at least once every 3 years. Triggers include a significant change to relevant business circumstances, relevant risk information communicated by AUSTRAC, and adverse findings in an independent evaluation report. Any issues identified by the review must be reflected in the risk assessment and affected AML/CTF policies.

Governance and accountability

Who is responsible for the AML/CTF program?

AML/CTF policies must address applicable governance requirements, including the Compliance Officer role, subject to any statutory exemptions that apply to the reporting entity.

The program must be approved by a senior manager before you start providing designated services, subject to any applicable statutory exemptions. Document the approval with the approver’s name, title, date, and signature.

IV. Three Tiers, One Test

Customer due diligence: simplified, standard, enhanced

The tier isn't your choice to make freely — it's set by the risk of the customer and the service in front of you.

Simplified CDD

When permitted

Simplified CDD may be used only where the circumstances and requirements specified in the AML/CTF Act and Rules are met.

Standard CDD

Risk-based

Initial CDD requirements depend on the customer type, designated service, assessed ML/TF risk, and the information and verification requirements specified in the AML/CTF Act and Rules.

III

Enhanced CDD

When required

Enhanced CDD must be applied when a trigger specified in the AML/CTF Act or Rules applies. The required steps and approvals depend on the applicable trigger.

Reporting, training and monitoring

Put the program into day-to-day operation

Put the program into practice — conduct CDD on every relevant client, monitor transactions, escalate suspicious matters through your Compliance Officer, and submit SMRs and TTRs as required. See how to submit a Suspicious Matter Report to AUSTRAC.

Your AML/CTF policies must provide for initial and ongoing training for personnel who perform functions relevant to the business’s AML/CTF obligations. The training must be appropriate to each person’s function, relevant ML/TF risks, and responsibilities under the policies. Keep training records under the applicable program-record requirements.

Review, updates and independent evaluation

Keep the program current and test how it operates

A reporting entity must review and, where required, update its ML/TF risk assessment and AML/CTF policies when a specified review trigger occurs. Relevant triggers include significant changes, risk information communicated by AUSTRAC, and adverse findings from an independent evaluation. Reviews are also required in any event at least once every 3 years. An updated AML/CTF program must be documented within 14 days after the update occurs.

For reporting entities to which the independent-evaluation requirement applies, AML/CTF policies must provide for an independent evaluation at a frequency appropriate to the nature, size and complexity of the business and at least once every 3 years. The evaluation must assess the entity’s risk-assessment process, policy design, compliance with its policies, and management of ML/TF risk, and it must produce a written report.

AML/CTF program records must be kept until 7 years after they are no longer relevant to demonstrating compliance with Part 1A of the Act. These records can include the current program, relevant previous versions, version history, approval records, and records of reviews or independent evaluations.

V. Building It

Nine steps, in order — each one builds on the last

This is the sequence the HowTo schema on this page follows. Skipping ahead usually means redoing earlier work.

Confirm your designated services

Identify every designated service your business provides under the AML/CTF Act. Your program only needs to cover designated services — but it must cover all of them. Understating your services is itself a compliance risk if AUSTRAC reviews your program against your actual activities.

Appoint your Compliance Officer in writing

The Compliance Officer must be senior, have access to all records, and be formally appointed before the program is finalised. Their name, title, and responsibilities must appear in the program document. For sole traders, the owner fills this role.

Complete your ML/TF risk assessment

Assess your risks across client types, services, delivery channels, and jurisdictions. Assign risk ratings — Low, Medium, or High. Document your methodology and findings. This assessment is the foundation of everything else in the program — every control must be traceable to a risk you identified here.

Write your risk management framework

Document your governance structure, training requirements and schedule, transaction monitoring procedures, enhanced due diligence triggers, program review schedule, and independent evaluation timeline. Every control must connect back to a risk identified in your risk assessment. You are not required to label this as a separate 'Part A' — organise it however suits your business.

Write your CDD procedures

Document your customer identification and verification procedures for each client type — individuals, companies, trusts, SMSFs. Include simplified, standard, and enhanced CDD thresholds, triggers, and steps. Include your beneficial ownership identification procedure and your ongoing CDD review schedule.

Get senior management approval

Mandatory

Train your staff

Your AML/CTF policies must provide for initial and ongoing training for personnel who perform functions relevant to the business's AML/CTF obligations. The training must be appropriate to each person's function, relevant ML/TF risks, and responsibilities under the policies. Keep training records under the applicable program-record requirements.

Implement and operate the program

Put the program into practice — conduct CDD on every relevant client, monitor transactions, escalate suspicious matters through your Compliance Officer, and submit SMRs and TTRs as required. A written program that is not operationally followed provides no compliance protection and no defence in an AUSTRAC review.

Schedule your independent evaluation

At least every 3 yrs

For reporting entities to which the requirement applies, AML/CTF policies must provide for an independent evaluation at a frequency appropriate to the nature, size and complexity of the business and at least once every 3 years. Schedule the evaluation in advance.

II. What Changed in 2024

Do you still need separate Part A and Part B sections?

No. The rigid two-part labelling is gone — but the substance underneath it hasn't moved.

Formerly “Part A”

Risk management framework

ML/TF risk assessment methodology · governance and Compliance Officer role · staff training schedule · transaction monitoring · enhanced CDD triggers · program review schedule · independent evaluation requirements.

Formerly “Part B”

CDD procedures

Customer identification for individuals, companies and trusts · beneficial ownership (25% threshold) · simplified / standard / enhanced CDD · PEP identification · ongoing CDD review · record-keeping.

AUSTRAC’s current guidance lets you organise your program however suits your business, provided it satisfies the Act’s requirements. The two components above still both have to be there — only the mandatory labelling has been dropped.

VI. Starter Kit vs Custom

A generic template and a compliant program aren't the same thing

AUSTRAC’s free sector Starter Kits are a genuine head start — a pre-built framework aligned to official guidance, available at austrac.gov.au ↗. But they’re generic by design — no business name, no compliance officer, no specific designated services, no client risk profile.

“When AUSTRAC reviews your program, the regulator looks for evidence it reflects how your business actually operates — not just that a document exists.”
— AUSTRAC guidance

A document that reads as a generic template for anyone in your sector is a red flag in a compliance review. One that references your actual services, client types, officer name, and risk profile demonstrates genuine intent — that distinction is the whole test.

VII. Keeping the Paper Trail

Record-keeping — different rules for different records

Different AML/CTF record categories have different retention rules. Program records must be retained until 7 years after they are no longer relevant to demonstrating compliance with Part 1A of the Act. CDD, transaction and reporting records are subject to their own retention provisions. Records must be stored securely and remain retrievable.

“If AUSTRAC conducts a compliance review, they may request historical versions of the program to assess whether it was genuinely maintained over time — not just written once and filed away.”
— AML/CTF Act 2006, record-keeping obligations

VIII. Reference

Everything else people ask

Reporting entities generally need an AML/CTF program regardless of size, subject to applicable statutory exemptions. A sole-practitioner conveyancer and a large law firm may both need one. The program must be appropriate to the nature, size and complexity of the reporting entity’s business. Failure to meet applicable program obligations can contravene the Act. Use the penalty calculator to estimate your firm's exposure.

Primary sources

AUSTRAC — AML/CTF reform guidance

Last updated 20 August 2026 · Klyvon Compliance Team

IX. How Klyvon Helps

Generate your AML/CTF program for review

4–6 questions, one document

Your industry, designated services, client types, and compliance officer — Klyvon generates both the risk framework and CDD procedures in one pass.

Cited throughout

Every section references the AML/CTF Act 2006 by name, written in first person for your firm — not a swapped-logo template.

A starting point, not the finish line

Built on AUSTRAC official guidance. We recommend review by a qualified AML/CTF adviser before operational reliance.

Generate my program — free →

Free to start · cancel anytime

Related resources

AUSTRAC Tranche 2 — Complete Guide

Obligations, deadlines, penalties

How to Submit an SMR to AUSTRAC

The 3-day and 24-hour deadlines

Am I Regulated?

60-second eligibility checker

AUSTRAC Enrolment Guide

Step-by-step enrolment walkthrough

AML/CTF for Accountants

Sector guide and compliance steps

All resources

Every guide, sector explainer and tool