AML/CTF compliance checklist.

Map your activities to designated services and check their geographical link to Australia. Profession alone does not determine coverage.

Keep as evidence

Service list, scope assessment and the guidance or advice relied on.

Review check

Each activity has a documented scope decision and any uncertainty has an assigned follow-up.

Confirm your enrolment requirements, submit the required details and keep them current. Registration is a separate requirement for relevant remittance and virtual asset services.

Keep as evidence

Enrolment confirmation, AUSTRAC account details and the people authorised to submit reports.

Review check

You can locate the confirmation and the responsible person can access the relevant AUSTRAC service.

Assess the money laundering, terrorism financing and proliferation financing risks relevant to your customers, services, delivery channels and countries.

Keep as evidence

Dated risk assessment, reasoning and controls for the risks identified.

Review check

The assessment reflects the services actually provided and explains how identified risks are managed.

Document governance, customer checks, monitoring, reporting, personnel and record keeping procedures. Check eligibility before relying on a starter kit and obtain the required approval.

Keep as evidence

Approved program, version history, approval record and access instructions for staff.

Review check

The responsible approver has reviewed the program and staff can find the current procedures.

Appoint an eligible AML/CTF compliance officer, document governance responsibilities and check the applicable AUSTRAC notification deadline.

Keep as evidence

Appointment and eligibility records, responsibilities and notification confirmation.

Review check

Staff know who receives escalations and the notification requirement has been checked against the applicable rules.

Apply personnel due diligence and provide initial and ongoing training appropriate to roles and risks. Set training timing in your policies; do not assume a universal annual interval.

Keep as evidence

Personnel assessments, training content, attendance, learning checks and follow-up training needs.

Review check

Relevant people understand their duties, recognise concerns and know how to escalate them.

Establish customer identity, relevant beneficial owners, purpose and risk. Set PEP checks, sanctions checks and enhanced due diligence procedures for the applicable circumstances.

Keep as evidence

Verification results, ownership information, risk assessment and any enhanced checks or approvals.

Review check

The file explains the customer assessment and how required checks are completed before service, subject to any lawful exception.

Keep customer information current and monitor activity. For pre-commencement customers, check initial CDD triggers, including an SMR obligation or a significant relationship change resulting in medium or high risk, even if risk was already medium or high.

Keep as evidence

Monitoring records, changes considered, trigger assessments and review actions.

Review check

Do not apply a blanket 2029 deadline to Tranche 2 pre-commencement customers. Apply the relevant trigger and timing rules.

Set monitoring and escalation procedures. Where an SMR is required, report within 24 hours of forming a terrorism-financing suspicion, or within 3 business days after the day the suspicion is formed for other matters.

Keep as evidence

Suspicion timestamp, assessment, restricted-access report and submission acknowledgement.

Review check

Staff understand the applicable tipping-off restrictions. Preparing a report in software is not submission to AUSTRAC.

Check TTR requirements for transfers of A$10,000 or more in physical currency, including the foreign-currency equivalent, in connection with a designated service. Submit within 10 business days after the transaction day.

Keep as evidence

Transaction details, reporting assessment and submission acknowledgement.

Review check

The process distinguishes physical currency from ordinary bank transfers and recognises possible structuring concerns.

Confirm which other reports, including any compliance report, apply to your business and period. Record the current AUSTRAC requirements and due dates rather than assuming every business has the same annual filing.

Keep as evidence

Reporting calendar, source guidance and a named reviewer for each applicable report.

Review check

Required reports are lodged through the appropriate AUSTRAC channel and acknowledgements are retained.

Set retention periods and their start points for CDD, transactions and program records. Many requirements are 7 years, but the starting event differs. Avoid one blanket deletion date.

Keep as evidence

Retention schedule with record categories, legal basis, start event and disposal controls.

Review check

The schedule accounts for an ongoing customer relationship and any requirement to retain records longer.

Keep program versions, customer checks, reports, training and monitoring evidence organised. Limit access to appropriate personnel and check that records can be retrieved.

Keep as evidence

Record index, access arrangements and a documented retrieval check.

Review check

A responsible person can find the supporting record without relying on a tick on this checklist.

Review risks and controls as required by changes, new information and your policies. Follow up weaknesses and update procedures and training where needed.

Keep as evidence

Review findings, decisions, updated versions and action owners.

Review check

Relevant changes and identified weaknesses have been assessed, with unresolved actions tracked.

Arrange an independent evaluation separate from internal review. Check your applicable first-evaluation cohort and deadline, then the ongoing requirements.

Keep as evidence

Deadline basis, evaluator suitability and independence, scope and follow-up plan.

Review check

The deadline is based on the applicable rules, including any transitional cohort, rather than a universal three-year assumption.