AML/CTF Resource Hub

Who must comply with AML/CTF obligations?

Any business that provides a designated service must comply with AML/CTF obligations.

Do AML/CTF obligations apply only to large firms?

No, obligations apply regardless of business size if a designated service is provided.

When do we need to enrol with AUSTRAC?

You must enrol within 28 days of first providing a designated service. We recommend enrolling early as once enrolment opens at the end of March, there will be as many as 90,000 businesses trying to enrol by July.

What is an AML/CTF Program?

A written, risk-based framework that explains how the business identifies, manages and mitigates ML/TF risk.

Do staff need AML/CTF training?

Yes, the law stipulates that staff must be trained on the AML/CTF program and internal processes relevant to their role.

Does everyone need the same level of training?

No, training should be appropriate to the staff member’s role and ML/TF risk exposure.

Can a sole practitioner be their own AML/CTF Compliance Officer?

Yes. A sole practitioner may act as their own AML/CTF Compliance Officer, provided they can meet the role’s responsibilities and authority requirements.

Can the AML/CTF Compliance Officer be outsourced?

Yes. The role may be outsourced, but the business remains responsible for AML/CTF compliance and must retain access to relevant information.

Can AML/CTF tasks be outsourced to a third party or RegTech provider?

Yes, but the reporting entity remains responsible for compliance and decision making.

A note on outsourcing: reporting entities are required to carry out initial and ongoing due diligence with respect to the outsource provider and to the way the outsourced services are being managed. Similar considerations apply to reliance and reporting groups.

Do AML/CTF obligations override Privacy Act deletion requests?

Yes. AML/CTF recordkeeping obligations override requests to delete information. Records must generally be kept for 7 years.

Can we tell a client that an SMR has been lodged?

No. Disclosing certain information about an SMR may constitute tipping off, which is a criminal offence.

During the transition period, can we mix old and new CDD rules?

No. You must choose one framework at a time either stay on ACIP or fully transition to reformed initial CDD. You cannot mix elements of both.

What does not change during the transition period?

Ongoing CDD, monitoring, reporting and risk management continue to apply at all times, regardless of which option you choose.

Does giving advice alone trigger a designated service?

No. Simply giving advice does not trigger a designated service. The service must advance or execute the transaction, not just advise on it.

Is simply holding money in a trust account always a designated service?

No. A designated service generally arises where you receive, hold, control or manage money or property as part of a transaction, such as escrow or making payments on a client’s instructions. Simply holding funds in a trust account for routine legal services does not, by itself, trigger a designated service.

Does delayed CDD mean lower standards?

Delayed CDD does not reduce AML/CTF standards. It only allows limited flexibility in when checks are completed, provided risk is appropriately managed.

Does preparatory work (drafting or negotiating documents) count as a designated service?
Yes, preparatory steps required in anticipation of creating or restructuring a body corporate or legal arrangement are included.

Are testamentary trusts captured as designated services?

No, services relating to testamentary trusts or trusts not created intentionally or in writing are excluded.

When does the obligation to submit an SMR arise?

Once reasonable grounds for suspicion exist, even if the business decides not to proceed with the client or transaction.

Do we still have to lodge an SMR if we stop acting for the client?

Yes, once reasonable grounds for suspicion exist, an SMR must be lodged even if the relationship ends.

Does lodging an SMR remove the need for EDD?

No, where a customer is high risk, enhanced due diligence must still be applied

What happens if Legal Professional Privilege applies?

Privileged information is not required to be disclosed, and AUSTRAC has confirmed a privilege form will be available where applicable.

How long must AML/CTF records be kept?

Generally, AML/CTF records must be kept for at least seven years.

What is replacing IFTI reporting?

International Value Transfer Service (IVTS) reporting will replace IFTI reporting in 2029.

Does the travel rule usually apply to law firms or accountants?

Generally no, it usually applies to banks, remitters and VASPs, unless the transfer of value itself is the designated service.