Core AML/CTF obligations and controls

What an AML/CTF program must contain for a small Australian practice: its ML/TF risk assessment, risk-based policies, governance, training, evaluation and evidence that the controls operate.

Step-by-step AUSTRAC enrolment for tax agents, lawyers and real estate agents: who must enrol, what information you need, the compliance officer notification, and what happens after you enrol.

Customer due diligence under the amended AML/CTF Act: verifying individuals and entities, finding beneficial owners (UBOs), PEP and sanctions screening, risk rating, and when enhanced due diligence applies.

Suspicious matter reporting for newly regulated Australian practices: what forms a suspicion, SMR deadlines, what goes in the report, and the section 123 tipping-off offence every staff member must understand.

How to identify beneficial owners under the amended AML/CTF Act: the 25% ownership threshold, control through other means, trustees and appointors, walking layered structures, and what to record when no owner reaches 25%.

Threshold transaction reports for Australian practices and dealers: what counts as physical currency, the A$10,000 threshold, aggregation traps, the 10-business-day deadline, and how TTRs differ from SMRs.

A practical method for identifying, assessing and documenting money laundering, terrorism financing and proliferation financing risks.

How Australian reporting entities can assign governing-body, senior-manager and compliance-officer responsibilities with evidence and oversight.

A risk-based framework for identifying relevant roles, assessing personnel integrity and capability, and delivering effective AML/CTF training.

A practical retention schedule for CDD, transactions, programs, reports, screening and governance evidence under Australian AML/CTF law.

How to plan, commission and remediate an independent evaluation of AML/CTF program design, implementation and effectiveness.

A practical Australian workflow for distinguishing PEP risk from sanctions prohibitions, resolving matches and documenting ongoing screening decisions.

How to distinguish, collect and verify source-of-funds and source-of-wealth information using a risk-based Australian AML/CTF approach.

An operational catalogue of customer events that should trigger AML/CTF risk, KYC, verification, enhanced due diligence and reporting review.

How Australian reporting entities use adverse-media searches in AML/CTF without treating every negative article as an automatic risk result.

What an international funds transfer instruction is, who must report it to AUSTRAC, the 10-business-day deadline and how IFTIs differ from TTRs and SMRs.

What tipping off means under the AML/CTF Act, which SMR-related information is protected and how Australian firms communicate without disclosing it.

When Australian reporting entities can rely on another entity's customer identification, what a reliance arrangement requires and what each party still owns.

The verification paths Australian reporting entities can use under AML/CTF: document-based checks, electronic identity providers and the Document Verification Service.

How AUSTRAC supervises reporting entities, the enforcement tools it uses and the penalty framework Australian practices now face under the AML/CTF Act.

The practical first-90-days checklist for practices that became reporting entities under Tranche 2: enrolment, governance, risk, CDD, training and records.

When Australian reporting entities must refuse a service or exit a relationship because CDD cannot be completed, and how to record the decision safely.

How Australian reporting entities screen against targeted financial sanctions, use the DFAT Consolidated List and integrate sanctions checks with AML/CTF.

The criteria Australian Tranche 2 practices should test when buying AML/CTF software: scope, evidence, reporting, security, integrations and provider honesty.

The transaction and behaviour patterns Australian professionals should escalate: secrecy, unusual payments, complex structures, third parties and rapid changes.

Distinguish a missing document, inconsistent information and an unresolved identity question before allowing a designated service to proceed.

Document the applicable delay provision, permitted outstanding verification, risk controls, completion deadline and stop conditions before providing a service.

Turn an enhanced-CDD trigger into focused inquiries, a documented decision and appropriate approval rather than an unexplained request for more documents.

Distinguish a provider alert, an unresolved possible match and a supported decision, with special care for Australian targeted financial sanctions.

Assess the issuer, document meaning, reliable corroboration and translation needs without treating every overseas customer or document as automatically high risk.

Correct inaccurate customer information, reassess affected checks and retain the necessary history without treating an audit log as a reason to leave bad data in use.

Connect expected customer activity, events, review owners and outcomes in a manual process, and recognise when volume or complexity requires automation.

Assess updated guidance against the practice's services, policies, forms and training, then record the decision and any required approval.

Separate technical failure from an adverse customer result, control the service boundary and use an alternative verification method only where permitted.

Identify whether another business performs AML functions, supplies a tool or provides CDD for lawful reliance, then document responsibilities and records access.

Design collection, access, retention and disclosure controls around the evidence actually needed for AML work, including small reporting entities.

Separate observed facts, an unusual event and reasonable grounds for suspicion, with a clear decision owner, protected record and reporting clock.