AML compliance checklist for Australia: five steps
To comply with Australia’s AML/CTF law, enrol with AUSTRAC within 28 days of your first designated service and have a senior manager approve your AML/CTF program before you start. Then check every customer, report suspicious matters to AUSTRAC and keep records for 7 years.
Australia’s AML/CTF Act applies to any business that provides a designated service. A senior manager approves your anti-money laundering and counter-terrorism financing (AML/CTF) program before you start, and you enrol with the Australian Transaction Reports and Analysis Centre (AUSTRAC) within 28 days. Then you check every customer, report suspicious matters and keep records, in the five steps below.
What does AML compliance involve?
Five steps to AML/CTF compliance, in order
Australia’s AML/CTF Act, for a newly regulated business
- Step 1
Confirm you are a reporting entity
You provide a designated service. Enrol with AUSTRAC within 28 days of the first one.
- Step 2
Set governance
Governing body, senior manager and an AML/CTF compliance officer.
- Step 3
Assess your ML/TF risk
Services, customers, delivery channels and countries.
- Step 4
Write and approve the program
Risk assessment plus policies, approved by a senior manager before you start.
- Step 5
Run the controls for every customer
Customer due diligence, screening, reports and records.
-
Independent evaluation
At least once every 3 years.
Sources: AUSTRAC, Your AML/CTF program overview; AUSTRAC, Enrol with us overview; AUSTRAC, Step 5: Conduct an independent evaluation Reviewed
AML compliance means meeting your duties under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, which AUSTRAC regulates. Our guides to what AML compliance is and AML compliance requirements in Australia cover the background; this page is the working checklist.
The order matters, because each step depends on the one before. Your program must be appropriate to the nature, size and complexity of your business, so a copied template will not do.
Step 1. Are you a reporting entity?
You are a reporting entity if you provide a designated service listed in section 6 of the Act. There is no small business exemption. From 1 July 2026, the newly regulated services include these professional designated services and dealer services:
- assisting with a transaction to buy, sell or transfer real estate
- assisting with creating or restructuring a company, trust or other legal arrangement
- receiving, holding, controlling or managing a client’s property as part of a transaction
- selling or transferring a shelf company
- buying or selling precious metals, stones or products for $10,000 or more in cash or virtual assets
Preparing tax returns or giving tax advice is not a designated service on its own. AUSTRAC treats help as regulated when it directly advances the transaction, not when it merely influences it. Our guide to designated services for accountants works through examples.
Key point
Under Australia’s AML/CTF Act, a business must enrol with AUSTRAC no later than 28 days after it first provides a designated service.
Record the date of that first service, because the enrolment clock starts then, not when you sign the client.
Step 2. Who is accountable for compliance?
AUSTRAC’s governance framework has three roles. Your governing body oversees the program and a senior manager approves it. An AML/CTF compliance officer runs day-to-day compliance.
You appoint the compliance officer within 28 days of providing designated services and notify AUSTRAC within 14 days. They must be at management level, resident in Australia and a fit and proper person. They report to the governing body at least once every 12 months.
The full eligibility test is in our guide to AML/CTF compliance officer requirements. Put these in writing:
- the senior manager’s approval of the program, with their name, role and the date
- who can approve high-risk customers and lodge reports
- how staff escalate a suspicious matter
- the compliance officer’s reporting schedule to the governing body
Step 3. What must your risk assessment cover?
Under section 26C you assess the money laundering and terrorism financing risks you may reasonably face. You must consider four sources of risk: your designated services, your customers, your delivery channels and the countries you deal with.
You also assess planned changes to any of these, and the risk information AUSTRAC publishes. Rate each source on evidence, and record how you reached the rating:
| Risk source | Example risk | Rating |
|---|---|---|
| Customers | Clients with layered trust or company structures | High |
| Delivery channels | Onboarding without meeting the client | High |
| Countries | Clients with business interests in high-risk jurisdictions | Medium |
You review it at least once every 3 years, and sooner after a significant change, such as a new service. Our AML/CTF risk assessment guide shows a full method.
Step 4. What goes in your AML/CTF program?
What an AML/CTF program is made of
| Element | What the Act requires | Section |
|---|---|---|
| ML/TF risk assessment | Identify and assess your money laundering, terrorism financing and proliferation financing risks before your first designated service. Review it on a significant change and at least every 3 years | ss 26C, 26D, 26E |
| AML/CTF policies | Policies, procedures, systems and controls that manage those risks and meet your obligations, such as customer due diligence, reporting and record keeping | ss 26F, 26G |
| Approval and oversight | A senior manager approves the risk assessment, the policies and every update. The governing body oversees them | ss 26P, 26H |
| AML/CTF compliance officer | Designated within 28 days of your first designated service: management level, resident in Australia, fit and proper | ss 26J, 26K |
Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26B to 26P); AUSTRAC, Your AML/CTF program overview Reviewed
The program has two parts: your risk assessment from Step 3, and your AML/CTF policies. The policies are the procedures, systems and controls that manage those risks and meet each obligation.
A senior manager approves the program and any updates, and it must be documented before you start providing a designated service. Updates must be documented within 14 days.
Write each policy so a new staff member could follow it: who does what, when, and how. AUSTRAC’s free program starter kits and our AML/CTF program template give you a structure to adapt.
Step 5. What do you do for every customer?
Before you provide a designated service, you complete customer due diligence. The full list is in our AML customer due diligence checklist. For each customer:
- Collect their details and documents, and verify identity from reliable, independent data
- Verify beneficial owners who own 25% or more, or who control the customer
- Screen for politically exposed persons and for targeted financial sanctions, using DFAT’s Consolidated List
- Assess the customer’s risk, and apply enhanced checks when it is high
- Monitor the relationship, and keep checking sanctions status while it lasts
Key point
Under Australia’s AML/CTF Act, a reporting entity lodges a suspicious matter report within 3 business days, or 24 hours for terrorism financing.
Those are the SMR deadlines, counted from when you form the suspicion. You keep customer due diligence records for at least 7 years after the relationship ends. IdentityCheck runs these checks from your customer relationship management (CRM) and keeps the result on the client record.
How do you keep the program working?
- Enrol
- Within 28 daysAfter the day you first provide a designated service
- SMR
- Within 3 business daysAfter you form the suspicion; 24 hours if it relates to terrorism financing
- Records
- 7 yearsCustomer due diligence records, from the end of the business relationship
- Independent evaluation
- At least every 3 yearsBy an evaluator who is independent and suitable for your business
- Maximum civil penalty
- A$36.4 million per contravention, companyA$7.28 million for an individual. Australia’s AML/CTF Act 2006 (s 175): 100,000 and 20,000 penalty units at A$364, the rate from 1 July 2026
Sources: AUSTRAC, Enrol with us overview; AUSTRAC, Suspicious matter reports; AUSTRAC, Record keeping checklist; AUSTRAC, Step 5: Conduct an independent evaluation; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26E, 26F, 26K, 26M, 175); AUSTRAC, Consequences of not complying Reviewed
Your program must be independently evaluated at least once every 3 years. Review it as well when AUSTRAC issues new guidance or your business changes.
Train staff on their duties, and test that screening and monitoring catch what they should. Track each failure until it is fixed. The cost of getting it wrong is set out in our guide to AML non-compliance penalties.
Sources
Primary sources, checked 21 October 2026:
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 6, 26C to 26P, 175)
- AUSTRAC, Your AML/CTF program overview, and its steps 1 to 5
- AUSTRAC, Enrol with us overview
- AUSTRAC, Professional designated services
- AUSTRAC, Suspicious matter reports
- AUSTRAC, Consequences of not complying