AML Mate / Journal
Practical articles and guides for Australian professionals working through AML/CTF obligations.
104 articles Page 3 of 9
The Act created three governance roles in your firm: governing body, senior manager and AML/CTF compliance officer. In most small firms all three are you. Wearing every hat does not merge the duties: some approvals cannot be delegated, one report is owed every 12 months, and AUSTRAC expects records showing each role actually did its job.
Every professional firm says the same sentence: we don't take cash. The Act does not care what your policy says, it cares what happened. A threshold transaction report is due within 10 business days of any $10,000-plus physical currency transaction, separate payments are counted separately, and a client who splits payments to stay under the line has just handed you a different report to file. Here is how the rule actually reaches firms that think it never will.
On 9 August 2026 AUSTRAC suspended Cryptolink's registration and took its 96 crypto ATMs offline. Not for the breaches it had already paid for: for the routine reports and unanswered questions that came after. The remediation project succeeded and the week-to-week routine failed. Every newly regulated Tranche 2 firm is now on the same three reporting clocks, so this one is worth reading twice.
A stored risk rating and a risk assessment are not the same thing, and AUSTRAC asks you to keep a record of the second one. If your client files were rated low by a default rather than by a person, the rationale AUSTRAC expects to see does not exist. Here is how to tell the difference, and a three-step check you can run on your own files this morning.
If your practice sits under a trust or holding company that owns something else, you may already be in a reporting group without having chosen one. Business groups become reporting groups automatically, a lead entity has to be appointed in writing within 28 days, and the entity that ends up carrying the group program may be one that has never provided a designated service in its life. Here is the test, the clock, and what you actually get in return.
The AML/CTF Act tells you to collect identity information and keep the record for seven years, which quietly turns your practice into something worth stealing. AUSTRAC's data breach guidance covers that, and it also covers the case nobody expects: a breach at some other organisation that never touches your systems and still weakens every identity check you run. Here is what it expects you to do about both.
AUSTRAC's program starter kits are free, sector-specific and genuinely good. They also come with a list of conditions, and you have to meet every one of them. Fifteen personnel including admin is the condition most firms fail, but it is not the one that catches them out. Here is the full list for each sector, and what AUSTRAC says happens if you use the kit anyway.
There is a due diligence obligation in the AML/CTF Act that points at your own staff rather than your clients, and most firms have not read it. It asks you to assess the skills and the integrity of everyone who performs an AML/CTF function, before you engage them and for as long as they stay. Here is who it covers, what AUSTRAC's own worked example does, and the two parts of it almost nobody has written down.
If you cannot establish who your customer is on reasonable grounds, you must not provide the designated service. That is the whole rule, and it is short. What it does not tell you is the difference between a client who will not prove who they are and one who cannot, which are two different situations that look identical from your side of the desk. Here is how to tell them apart, and what has to be in the file either way.
Enrolment closed on 29 July 2026. For most Tranche 2 firms the next date AUSTRAC actually puts in your calendar is 1 July 2027, when the first annual compliance report window opens. Everything in between runs on triggers you have to notice yourself, not dates anyone reminds you about. Here is what those triggers are, and what should be in your file by the end of August.
Most Tranche 2 firms nail the business risk assessment and skip the other one: rating each client low, medium or high. It is a separate AUSTRAC obligation, and it decides whether you can use simplified CDD or must do enhanced. Here is the method AUSTRAC expects, the four factor categories, the low/medium/high examples, and a worked conveyancer example.
You've enrolled with AUSTRAC and a company walks in as a client. The rules say identify its beneficial owners, but the free ASIC search won't tell you who owns it. Here is exactly which ASIC product actually carries the ownership data, the free one that looks right but isn't, how to read directors and shareholders off it, and where the extract stops and you take over.
