You Do Not Need Transaction Monitoring Software. You Need Thirty Minutes a Month and a Record That You Spent Them.

Ask a small firm what it did for AML/CTF this year and you will hear about a project: the program, the enrolment, the ID checks on new clients. All of it has a finish line. Ongoing customer due diligence does not, which is probably why it is the obligation most likely to be sitting untouched in October.

The phrase "transaction monitoring" does not help. It sounds like a system a bank buys. For a three person practice it is something much smaller, and AUSTRAC's own guidance says so.

What Ongoing CDD Actually Asks For

Three things, according to AUSTRAC's overview. You must monitor your customers for unusual transactions and behaviours, including behaviour that may require a suspicious matter report. And if you have a business relationship with a customer, you must also review and, if appropriate, update your assessment of their ML/TF risk, and review and, if appropriate, update and reverify their KYC information. (AUSTRAC, overview of ongoing customer due diligence (opens in a new tab), updated 27 March 2026)

Your AML/CTF policies must set out how you will do each of those, how you will respond to what you find, how you will make sure the monitoring is working, and how you will keep records that demonstrate you complied.

So: watch, re-rate, refresh, and be able to show it. The rest of this post takes them in that order.

Manual Is Allowed, and AUSTRAC Describes It

The page on how to monitor is direct about software: "Your customer monitoring measures can be manual, automated, or both. What's appropriate will depend on the nature, size and complexity of your business." AUSTRAC expects an automated transaction monitoring system "if you can't effectively monitor transactions manually", and its example is a business dealing with a high volume of transactions. (AUSTRAC, how to monitor your customers (opens in a new tab), updated 27 March 2026)

A conveyancer settling a few dozen matters a month is not that business. Neither is a suburban accounting practice. For firms that can monitor manually, the same page lists what doing it properly involves:

• training relevant personnel to identify unusual transactions and behaviour and respond appropriately
• scheduling regular time, such as weekly or monthly, to review your customers' transactions and behaviour for indicators of unusual activity
• comparing a customer's transactions and behaviour with their history and what you know about them
• comparing a customer's transactions and behaviour with similar customers and how they use your designated services
• considering information about your industry to help you identify if a transaction or behaviour is unusual or complex
• escalating unusual transactions or behaviour for further review and response, for example to an AML/CTF compliance officer

Read the second item again. "Scheduling regular time, such as weekly or monthly" is a calendar entry. That is the whole technology requirement.

One qualifier. Manual is permitted where it is effective, and AUSTRAC expects you to be able to demonstrate that your monitoring both analyses your customers' transactions and behaviour and alerts you in a timely way to anything unusual. A routine that exists only in the policy document demonstrates nothing.

What You Are Looking For

AUSTRAC's list of unusual transactions is long, but for a professional services firm a handful do most of the work (AUSTRAC, what you must monitor for (opens in a new tab), updated 31 March 2026):

• activity inconsistent with the customer's known risk or transaction history
• transactions that seem unusually complex for the nature of the business relationship
• transactions involving income or wealth inconsistent with the customer's known circumstances
• transactions through a services provider, such as lawyers or accountants, for no apparent commercial or other reason
• using legal entity structures or corporate vehicles for no apparent commercial or other reason, or to obscure ownership
• transactions that appear structured to avoid reporting obligations

Behaviour counts as much as money. The same page lists a customer who is evasive when questioned, appears directed by a third party, tries to rush a transaction, is unable or unwilling to explain why they want the service, or asks staff whether the firm reports to government authorities.

Two points keep this proportionate. First, AUSTRAC says unusual "may look different for each customer", so the benchmark is what you already know about this client, not a universal rule. Second: "Customers may have unusual transaction patterns or behaviours, but that doesn't always mean they're doing something illegal." When something stands out, you decide whether there is a legitimate explanation or whether you need to take further action, such as enhanced CDD or a suspicious matter report.

AUSTRAC also expects you to use its published sector indicators to inform your monitoring where they are relevant to your business. If you have not read the indicators for your industry since you built the program, that is the first item for your first monthly session.

When the Risk Rating Has to Move

A customer risk rating is not set once at onboarding. You must review and, where appropriate, update it if there is a change to any of the following (AUSTRAC, reviewing and updating customers' ML/TF risk and KYC information (opens in a new tab), updated 25 March 2026):

• your business's ML/TF risk assessment, where the change could affect how you identify and assess customer risk
• the type of customer, such as becoming a politically exposed person or changing their corporate structure or beneficial owners
• the kinds of designated services you are providing or are asked to provide
• the channels you use to deliver designated services to the customer, such as the involvement of an agent or a move to online delivery
• the countries you deal with when providing designated services to the customer

You must also do it if the customer is involved in unusual transactions or behaviour that may give rise to an SMR obligation.

Notice the first item. If you review your own program and the risk assessment changes, client ratings built on the old one may need another look. The two reviews are connected.

In practice most of these arrive as ordinary news from the client: a new director, a restructure, a request for a service you have not provided to them before, a buyer who turns out to live overseas. The job is to recognise that the news is also a trigger.

When KYC Needs Refreshing, and When It Does Not

You must review, and where appropriate update and reverify, a customer's KYC information "at a frequency appropriate to their ML/TF risk". Your policies must say how often you will do that for different kinds of customers. AUSTRAC does not prescribe the intervals, so we will not either. What matters is that higher risk clients come around sooner and that the schedule is written down.

Separately from the schedule, a review is required in certain circumstances, including if you have doubts about whether the information you collected is adequate or true, or if the customer, their beneficial owner, or a person on whose behalf they are receiving the service becomes a foreign PEP. The same applies for a domestic or international organisation PEP where the customer's ML/TF risk is high.

Now the part that saves small firms real time. AUSTRAC's page says:

"For example, you don't need to collect and reverify information relating to an individual customer's identity if the verification data, such as an identity document, has expired. This doesn't change the customer's identity or their ML/TF risk."

An expired driver's licence on a long standing client's file is not, by itself, a reason to drag them back in. A KYC review is a check on whether what you know about the client is still accurate. It is not an annual re-run of identity verification.

AUSTRAC's examples of how to do a review are equally unglamorous: ask customers to confirm or update their information when you have face to face or telephone contact, and have a process to request and verify information after a change in ownership structure, beneficial owners or the people acting on the customer's behalf.

Existing Clients Are Not Exempt From This Part

A common misreading is that clients you had before 1 July 2026 sit outside all of this until something triggers initial CDD. They do not. For pre-commencement customers AUSTRAC lists ongoing CDD obligations that apply now: monitor for unusual transactions and behaviours that may give rise to an SMR obligation, review KYC information at an appropriate frequency, and monitor for significant changes in the nature and purpose of the relationship that result in the customer's ML/TF risk being medium or high. (AUSTRAC, transitioning existing customers (opens in a new tab), updated 1 July 2026)

We covered the initial CDD side of that in existing clients and pre-commencement customers. The monitoring side is why your monthly session covers the whole active client list, not only the clients onboarded since July.

The Routine

Here is a manual routine built from the pieces above. Adjust the frequency to your volume. AUSTRAC's own example is weekly or monthly.

1. Block the time. A recurring thirty minutes, owned by a named person, usually the compliance officer.
2. List what happened. The designated services you provided since the last session, and to whom. For most small firms this is a short list.
3. Compare each one to the client. Does it fit their history, their stated purpose and what you know about their funds? Does it look like what similar clients do?
4. Ask the people who dealt with the client. Behavioural indicators never appear in a ledger. They appear in what the receptionist or the junior noticed.
5. Run the trigger list. New service, new channel, new country, new owners or controllers, new PEP status. Any hit means a rating review.
6. Pull the KYC reviews that are due under the schedule in your policies.
7. Escalate what needs it and decide the response. AUSTRAC expects your policies to outline when you will review a transaction or behaviour to determine if you need to submit an SMR.
8. Write it down. Date, who did it, what was reviewed, what was found, what was decided. "Nothing unusual" is a finding.

Clients you have rated higher get more of this. AUSTRAC's example for those customers is to manually review their transactions more frequently, which is one of the costs of keeping a high risk client.

The Record Is the Proof

Step 8 is not housekeeping. You must keep records that show how you complied with your ongoing CDD obligations for a customer, including records of the customer's transactions and significant behaviour, your identification, analysis and assessment of their ML/TF risk, and any decisions your business makes about how it conducts ongoing CDD on them (node 1325).

AUSTRAC also expects you to regularly check that the monitoring itself is working: that you have enough information about your customers to identify unusual activity, that you are being alerted to it, and that you are responding appropriately to alerts. For a manual routine, twelve dated session notes are most of the evidence for all three.

There is a second payoff. A year of those notes is exactly the kind of record that makes the first annual compliance report a matter of looking things up instead of reconstructing them.

Where AML Mate Fits

AML Mate lets you record and review client transactions, flag suspicious activity with your reasons, and identify cash transactions at or above the $10,000 TTR threshold. Each client carries a documented risk rating with its factors, review dates can be scheduled so the KYC refresh comes to you instead of relying on memory, and sanctions and PEP screening can be re-run on demand. The audit-ready export pack puts the client register and the audit log in one file for whoever asks how the monitoring was run. If you want a quick read on where you stand first, the free compliance check scores your readiness across the six core obligations, no signup needed.

The program was a project. This is the routine that makes the program true. Thirty minutes, a short list, and a note that says you looked.

This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.