The working parts of an AML/CTF program

Five things, in sequence:

• Enrolment with AUSTRAC
• A written AML/CTF program, based on your ML/TF risk assessment
• Customer identification before you provide a designated service
• Ongoing customer due diligence through the life of the relationship
• Reporting — suspicious matter reports, threshold transaction reports and annual compliance reports

How much detail each of these requires depends on your designated services and what your risk assessment concluded about them. A firm providing one low-risk service and a bank do not carry the same program, but they carry the same obligations.

Customer identification, verified against reliable, independent sources, not self-reported details.

The timing is the part that catches organisations out. The obligation is to verify before providing the designated service, so a process that onboards the customer first and verifies within a few days is not compliant regardless of how quickly the verification eventually completes.

This is why the checks need to return in seconds, not hours. If verification is fast enough to sit inside the sign-up flow, the sequencing takes care of itself.

Identity checks run against the government's Document Verification Service and an Australian reference universe of roughly 2 billion records. Screening data is aggregated from official sanctions lists and PEP registers worldwide, across more than 268 countries.

For ongoing monitoring, each source is a separate monitor you can schedule independently:

• PEP and Sanction — global PEP lists and international sanctions
• Adverse Media — negative news, with AI-generated summaries
• Court — civil and criminal case records
• Banned or Disqualified Persons
• Deceased — including the Australian Death Check register
• Business and UK Business — ASIC and Companies House
• Phone and Real Estate — connectivity, and address listing history

The sourcing is what makes these checks count for compliance purposes. AUSTRAC's standard is reliable and independent, which excludes self-reported information no matter how carefully it is collected.

On a schedule you choose, set per monitor, not globally.

The options run from daily, through weekdays, weekends or a nominated day of the week, to the 1st or 15th of the month, both, or quarterly. Scheduled monitors run automatically overnight and screen every entity in the program; if anything new is found, an event is created and the program's report email addresses are notified.

A program can carry several monitors at different cadences (PEP and sanctions daily, adverse media weekly, court screening quarterly), so you can put frequency where the risk is instead of running every source at the same rate.

Choosing the cadence is a real compliance decision, not a preference. The interval you set is the maximum time a newly sanctioned customer can sit in your book unnoticed, so it is worth setting deliberately and recording why.

What was checked, against which source, the result, the timestamp, and the operator who ran it.

Those records support both directions of the reporting obligation. Suspicious matter reports and annual compliance reports need the evidence of what was checked and when; an AUSTRAC request or an audit needs the same material assembled per customer.

Records can be exported at any time, and because they are produced by the checks themselves there is no separate filing step to be missed.

Three things, on different triggers:

• Suspicious matter reports — when you form a suspicion, on the timeframe set by the Act
• Threshold transaction reports — for cash transactions at or above the reporting threshold
• Annual compliance reports — covering how your program operated over the year

The common failure point is not the filing itself but the evidence behind it. An SMR has to reference what was checked and observed, and an annual compliance report has to describe a program that demonstrably ran. Both are straightforward when the per-check record already exists and difficult when it has to be reconstructed.

Yes. The obligations are the same, scaled to your designated services.

Tranche 2 brought lawyers, conveyancers, accountants, real estate professionals, dealers in precious metals and stones, and trust and company service providers into the regime. The Act does not set a lighter standard for them; it sets the same standard against a smaller set of services.

What differs is delivery. Most Tranche 2 firms run checks from a browser instead of building an integration, and their programs are sized accordingly. The Tranche 2 use case covers the specifics.

Yes. The checks run independently of each other, so there is no requirement to implement everything at once.

Many organisations start with customer identification or screening, the two that are hardest to do manually and most immediately visible in a review, and add ongoing monitoring later, once the first part is running properly.

That sequencing is usually the right one. A screening capability that works reliably is worth more than three capabilities that are half-configured, and the records from the first obligation are useful evidence on their own.