Frequently Asked Questions

You must appoint an AML/CTF Compliance Officer (management level) and ensure board/senior management oversight of the program.

Your AML/CTF program must be documented and approved by a senior manager, with appropriate oversight by the board or senior management and independent evaluation at least every 3 years. There is no legal requirement for a “wet-ink” signature; AUSTRAC accepts electronic records/approvals.

Yes—many entities outsource functions (e.g., KYC collection). However, you remain legally responsible for compliance, and you must manage the outsourcing risks.

In some circumstances you can rely on a third party’s customer identification procedures under a KYC arrangement or case-by-case reliance, with specific conditions and documented agreements (“safe harbour” applies to isolated breaches under compliant arrangements). You must retain the relevant records.

• Suspicious Matter Reports (SMRs):
  24 hours if related to terrorism financing; three business days for other suspicions. AUSTRAC
• Threshold Transaction Reports (TTRs):
  Physical currency transactions $10,000 or higher (or foreign equivalent).
• International transfers:
  Under the reformed framework these are International Value Transfer Service (IVTS) reports (terminology updated from IFTIs).
• Compliance reports:
  Submitted when required by AUSTRAC (not automatically every year for all sectors).

Yes. Even when relying on or outsourcing to a third party, your agency must retain the records required under the AML/CTF regime.

Tranche 2 entities need to enrol with AUSTRAC from 31 March 2026.

Daily civil penalties accrue if you provide a designated service for at least 28 days without enrolling: up to 12 penalty units per day (individual) or up to 60 per day (body corporate).

The penalty unit amount is set by law and was $313 (noting the government may index it over time).

In order to be AML/CTF compliant from 1 July 2026 onwards, you need to have everything in place prior to this date. 

This includes:

• Enrolment with AUSTRAC

• Appointing and AML Compliance Officer

• Creating your Risk Assessment and AML/CTF Program

• Training staff in their AML/CTF obligations and how to fulfil them

• Being ready to conduct KYC on clients from 1 July 2026

• Staff vetting

• Being ready to monitor for suspicious activity and file Suspicious Matter Reports with AUSTRAC

No. AUSTRAC requires your AML/CTF program to be documented and approved (by a senior manager) and your records to be retrievable. Records can be electronic or hard copy; the focus is on governance and effectiveness, not the ink.

Yes, AUSTRAC has provided Program starter kits for Tranche 2 entities. These are designed for small real estate and buyer's agencies who meet AUSTRAC's criteria, and must be tailored to the risks your business faces.

Set-up typically takes months (risk assessment, program, training, systems). Ongoing effort depends on business size and processes; with appropriate tooling, daily management should be limited for most agencies. This is implementation guidance rather than a legal rule.

Employee due diligence (also known as personnel due diligence or staff vetting) are checks and assessments run on the people you employ who handle AML/CTF responsibilities.

This helps protect your business by:

• making sure only suitable people perform AML/CTF functions;
• reducing the likelihood of internal fraud.

You must conduct personnel due diligence:

• before you employ or engage the person;
• on an ongoing basis during their employment or engagement.

Your AML/CTF Program outlines how this should be completed within your business.

 Customer Due Diligence/Know Your Customer—identify and verify the customer/beneficial owners before providing the service; apply enhanced checks when risks are higher. 

 Suspicious Matter Report—24 hrs (Terrorism Financing) / three business days (other).