What Is an AML/CTF Program?

Your Business Roadmap for Managing Financial Crime Risk

If you've already read our guide on AML/CTF risk assessments, you'll know that identifying your risks is the first critical step for Tranche 2 firms. But what comes next? Once you know where your vulnerabilities are, you need a plan to manage them. That's where your AML/CTF Program comes in.

From 1 July 2026, real estate agencies, law firms and accounting practices providing designated services must have a documented AML/CTF Program in place. With AUSTRAC registration opening in March 2026, the time to start preparing is now. Let's break down what this program actually is.

What is an AML/CTF Program?

Think of your AML/CTF Program as your business's comprehensive playbook for preventing money laundering and terrorism financing. It's a formal, written document that sets out:

• How you will identify and verify your clients

• What records you'll keep and for how long

• How you'll monitor transactions for suspicious activity

• How you'll report concerns to AUSTRAC

• Who is responsible for compliance in your business

• How you'll train your staff to recognise and respond to risks

It's not a generic template you download and forget about. Your program must be tailored to your specific business, reflecting the risks you identified in your risk assessment. It's a living document that guides day-to-day decisions and gets updated as your business or the risk environment changes.

How Does It Relate to Your Risk Assessment?

Your risk assessment and your AML/CTF Program work hand in hand. Here's how:

The risk assessment tells you what could go wrong. It identifies the money laundering and terrorism financing risks your business faces based on your services, customers, delivery channels and locations.

Your AML/CTF Program tells you what you're going to do about those risks. It documents the policies, processes and controls you'll put in place to manage them.

Without a risk assessment, your program would be guessing at what controls you need. Without a program, your risk assessment is just a document with no action behind it.

What Should Your AML/CTF Program Include?

AUSTRAC expects your program to cover several key elements:

Customer Due Diligence - Clear procedures for identifying and verifying clients before you provide designated services. This includes knowing who you're dealing with and, where relevant, who really owns or controls a business you're working with.

Ongoing Monitoring - Processes and systems to watch for unusual or suspicious transactions that might indicate money laundering. This doesn't mean monitoring every transaction, but having appropriate processes based on your risk assessment.

Reporting Obligations - Processes for recognising and reporting suspicious matters to AUSTRAC, as well as threshold transaction reports where required.

Record Keeping - Documentation of what records you need to keep, how long to keep them and how they'll be stored.

Governance and Accountability - Identifying who in your business is responsible for AML/CTF compliance, from board level down to front-line staff.

Training and Awareness - Plans for how you'll ensure staff understand their obligations and can spot potential red flags.

Why Tranche 2 Firms Need to Act Now

For real estate agencies handling property settlements, law firms managing trust accounts or company formations, and accounting practices involved in complex financial structuring, these requirements represent a significant shift.

Here's why starting now is important:

• Registration with AUSTRAC opens in March 2026, just months away

• You must be fully compliant by 1 July 2026

• Developing a proper risk assessment and AML/CTF Program takes time, especially if you're doing it for the first time

• Staff need training before the compliance date, not after

• Getting it wrong can result in significant penalties and reputational damage

The businesses that start preparing now will have time to get it right, test their processes, and train their teams properly. Those who wait until the last minute will be scrambling and more likely to make costly mistakes.

What's the First Step?

If you haven't completed your risk assessment yet, that's where to begin. Once you understand your risks, building your AML/CTF Program becomes much clearer.

Need help getting started? Book a free consultation with one of our AML experts to discuss your specific situation and timeline.