AML/CTF Compliance Program for Accounting Practices

AML compliance starts with a written risk assessment and the policies your practice follows to manage those risks. Build the AML/CTF program around your designated services, assign responsible people and test whether staff follow it when clients arrive.

What an AML/CTF Program Contains

An anti-money laundering and counter-terrorism financing (AML/CTF) program combines your money laundering, terrorism financing and proliferation financing risk assessment with your AML/CTF policies. AUSTRAC uses ML/TF risks as shorthand for all these risks. Its current framework covers the whole program, replacing the old Part A and Part B division.

Your program needs the following working parts:

• A risk assessment of the designated services your practice provides.
• Initial, ongoing and enhanced customer due diligence procedures.
• Reporting procedures, including how staff raise suspicious matters.
• Personnel due diligence and role-specific training.
• Governance responsibilities, senior manager approvals and compliance oversight.
• Record keeping that preserves decisions and supporting evidence.
• Internal reviews and an independent evaluation schedule.

AUSTRAC requires the program to be documented, approved and in place before you provide a designated service. A senior manager approves the risk assessment and AML/CTF policies. Record their approval against the document version. Your governing body oversees how the program operates. AUSTRAC’s program overview explains these responsibilities.

The program must fit your practice’s nature, size and complexity. A sole practitioner can use a much shorter document than a 40-person practice with several service teams. Both need procedures that match their actual risks. For example, a company formation risk must lead to a procedure for understanding ownership and escalating unexplained arrangements.

First establish which accounting services attract AML/CTF obligations. Arrange AUSTRAC enrolment alongside program preparation. Enrolment alone does not establish that staff can follow the program.

Start With the Risk Assessment

Your AML/CTF risk assessment explains how each designated service could be misused and what your practice does about it. Start with your real services and client base, then assess the following factors.

Risk factor	Accounting example	Decision the program needs
Customer type	A trust has several layers of ownership and an overseas controller	How staff establish who owns or controls it and when they escalate gaps
Designated service	The practice creates companies or receives client funds into a trust account	What purpose and funding evidence staff obtain before proceeding
Delivery channel	An unfamiliar client requests company formation entirely remotely	How staff verify identity and authority and investigate inconsistent information
Countries	A trust has beneficiaries or funding in higher-risk jurisdictions	Which country risks trigger extra information, approval or a refusal

Assess risk before safeguards, then consider how effective your safeguards are and what risk remains. Record the reason behind each rating. A rating based only on a client’s country misses risks in the service or ownership arrangement.

For a hypothetical three-partner practice, assume its ordinary work includes establishing trusts and companies for small business clients. The partners use this illustrative matrix to discuss likelihood and consequence. It is a practice example, not an AUSTRAC scoring requirement.

Likelihood of misuse	Limited consequence	Material consequence	Severe consequence
Unlikely	Low	Low	Medium
Possible	Low	Medium	High
Likely	Medium	High	High

A familiar local business establishing a company for an explained trading activity could have a lower likelihood rating. An unfamiliar overseas client seeking a trust with unexplained controllers could have a higher rating. The partners document why, then decide which risks they accept and which services they will decline.

For an accepted higher-risk case, the program might require more ownership evidence and source-of-funds enquiries before senior manager approval. Staff need a named escalation contact and a record of the decision. The matrix does not override mandatory due diligence or reporting duties, even where the rating is Low.

Use AUSTRAC’s national risk assessments and accounting guidance as inputs, then apply them to your practice. Review risk before introducing a new designated service, delivery channel or client type. Revisit it when the client base changes or AUSTRAC communicates relevant new risks. Your policies must follow the changed assessment.

Using AUSTRAC’s Starter Kit as a Program Template

AUSTRAC’s accounting program starter kit contains a Customise the program starter kit guide, Risk assessment, Policy document and Process document. Personnel forms and client forms support their use. Maintenance and effectiveness-check forms help you test the finished program.

The starter kit suitability criteria include a limit of 15 personnel, counting administrative staff. The kit is designed for practices providing professional designated services, mainly serving Australian resident individuals and not regularly dealing with high-risk clients. Other criteria cover overseas property work, remote self-service, practice acquisitions and reporting-group arrangements.

A practice that does not meet every criterion must assess suitability and identify changes. It cannot rely on the kit to meet AUSTRAC’s expectations for its whole program. The three-partner example needs this assessment if entity clients dominate its work.

Use the document library with the customisation guide:

1. Mark the designated services you provide and remove inapplicable service selections as the guide directs. Keep mandatory obligations that still apply.
2. Record your client types, delivery methods and countries. Decide risk appetite and what you will decline.
3. Adapt the Policy document and Process document to your checks, escalation steps and record locations.
4. Name the people holding each AML/CTF role. Complete the appropriate personnel and client forms.
5. Obtain senior manager approval, retain the approved version and train staff to use it.

For a company formation service, fill in who reviews ownership, what evidence they use and what happens when the client refuses information. A template saying staff assess risk cannot answer those questions on its own. Unchanged generic wording leaves a gap between the program and the work AUSTRAC can examine.

Starting point	Cost and effort	Fit	Upkeep
AUSTRAC starter kit	Downloadable documents avoid a template purchase, but tailoring takes staff time	Designed for eligible small practices	Your practice follows updates and maintains its decisions
Paid template	Purchase cost plus internal adaptation time	Depends on the services and client types it covers	Establish whether updates are included and who implements them
Consultant-built program	Paid professional work plus interviews and practice input	Can address more complex risks if the scope matches them	Agree who updates the documents and trains staff after changes

Compare the work included, not the number of pages delivered. Paying for a program does not transfer responsibility for following it.

Appointing an AML Compliance Officer (AMLCO)

The AML/CTF compliance officer oversees day-to-day compliance, coordinates program maintenance, reports to the governing body and communicates with AUSTRAC. Staff can perform individual checks while the officer oversees them. Write down who covers the functions during absence.

AUSTRAC’s compliance officer guidance requires management-level authority and a fit and proper person. Australian residency is required where designated services are provided at or through an Australian permanent establishment. A principal can combine this role with other responsibilities if they meet the criteria.

Assess competence and integrity, including relevant misconduct, insolvency and conflicts. Retain your reasons and supporting checks. A position title alone does not establish eligibility.

To hire someone, describe the designated services, program workload and authority in the role specification. Assess relevant experience and their ability to understand your practice’s risks. An external officer is permitted if they have sufficient authority, resources and expertise. Agree access to files, escalation arrangements and reporting duties before appointing them. The practice retains its compliance obligations.

The ordinary rule requires appointment within 28 days of providing designated services and notification to AUSTRAC within 14 days of appointment. Replacement after departure or ineligibility follows the same requirements. Notify AUSTRAC through its Online enrolment form and retain the appointment record. Newly regulated practices have transitional notification rules, so apply the official transitional details where relevant.

Employee Due Diligence and Training

AUSTRAC calls employee screening personnel due diligence because it covers people you employ or engage to perform AML/CTF functions. Your program must provide for initial and ongoing checks. Assess relevant people before employment or engagement and reassess suitability as their duties change.

Choose checks suited to the role and risk. Reference checks can establish experience and conduct. Police checks can inform integrity assessment where appropriate. Neither is a universal substitute for assessing competence. Apply the separate fit and proper requirements to the compliance officer.

AML training for accountants teaches staff how to apply your program to the work they perform. Cover the practice’s risks and customer due diligence steps, including know your customer (KYC) information. Explain red flags, internal escalation, reporting responsibilities and tipping-off restrictions.

Write a training plan with these fields:

Plan field	What to record
Role and people	Staff performing onboarding, monitoring, reporting or governance functions
Topics	The procedures and risks relevant to each role
Timing	Initial training, refresher schedule and training before new AML/CTF duties
Format	Course material plus practice-specific scenarios and supervised work
Assessment	How staff demonstrate they can apply the procedure
Record	Completion, content version, result and next training due

AUSTRAC requires initial and ongoing training. It does not set one annual course frequency for every role. Its training guidance requires tailoring to functions and risks. A generic course needs your own procedures alongside it.

Use fictional scenarios in training. A client pays fees from an unexplained stranger’s account. Another pressures staff to create a trust before explaining its purpose. Staff practise recording the concern and escalating it without treating the indicator alone as proof of a crime. Ask them to show where they would record the matter and who receives it.

Customer Due Diligence and Reporting Procedures

Your customer due diligence procedures turn the program’s risk decisions into repeatable client checks. Initial due diligence establishes required information and assesses risk. Enhanced due diligence adds measures for higher-risk circumstances. Ongoing due diligence monitors the relationship and changes in activity or information.

Write the ordinary onboarding sequence around decision points. Staff identify the designated service, collect the required KYC information and establish identity and authority. They assess ownership and risk, escalate relevant cases and record the required approval before proceeding. Your procedures also identify any legally permitted exception to ordinary timing. The KYC checks for accounting clients explains the individual checks.

Monitoring needs an owner and triggers. An unexplained funding change or a new controller can prompt a review between scheduled checks. Define who follows up, who reassesses risk and where the outcome is recorded.

Your reporting procedures identify who receives staff concerns, who assesses them and who lodges a suspicious matter report when required. They must also cover applicable threshold transaction and other reporting obligations. Include required timeframes and who covers absence, so an internal approval queue cannot delay a statutory report. Use the suspicious matter reporting guide for that reporting duty.

Keep confidential escalation records accessible only to authorised staff. Train staff on what they can communicate to the client under tipping-off restrictions. Test the procedure with a fictional concern from first escalation through to the recorded decision.

Independent Evaluation and Keeping the Program Current

An independent evaluation checks the risk assessment, policy design and whether your practice follows the program effectively. It is additional to your own reviews. It differs from responding to an AUSTRAC audit notice, which has its own regulator audit preparation steps.

AUSTRAC’s independent evaluation guidance sets a minimum frequency of once every three years. Set a frequency appropriate to your practice’s nature, size and complexity and record the rationale. Newly regulated businesses have staggered first-evaluation deadlines determined by their AUSTRAC account number. Record the applicable deadline from the transitional rules in your schedule.

An evaluator can be internal or external if independent of the work evaluated. The person who designed or maintains the program cannot independently evaluate their own work. AUSTRAC sets no mandatory qualification, but expects relevant AML/CTF knowledge and sector experience. For a small practice where the principal runs the program, an external evaluator can provide the required independence.

Give the evaluator access to the program and sample client files, training records and monitoring results. Obtain a written findings report and provide it to the governing body and relevant approving senior manager. Record your response to adverse findings and assess whether changes worked.

Review the program when you add designated services, change clients or delivery methods, receive relevant AUSTRAC risk guidance or identify failures through evaluation. Full internal reviews of the risk assessment and policies are also required at least every three years. They do not replace independent evaluation.

Keep version histories, previous documents, approvals, review reasons and action records. AUSTRAC’s kit requires previous versions of its core documents to be retained for seven years. Document program updates within 14 days and obtain required senior manager approvals. Tell staff what changed and update their training where needed.

Before you approve the program, ask a staff member to run a fictional new client through it. Check that every decision has an owner and an evidence record, then resolve any point where the written steps cannot be followed.