What Is an AML/CTF Program? A Simple Explanation

Every business caught by Tranche 2 needs an "AML/CTF Program." Here's what that actually means in practice.

Think of it as your compliance rulebook

It's a written document that says: here's how our business identifies risk, here's how we check our clients, and here's what we do if something looks wrong. AUSTRAC doesn't hand you a template to fill in — you have to write one specific to your own business.

What actually goes into it?

Broadly, two parts:

• Part A — your risk assessment. What kind of clients do you serve, what services do you offer, and where does your genuine risk actually sit?
• Part B — your customer identification procedures. Exactly how you'll verify who your clients are before working with them.

On top of that: how you'll train your staff, how you'll keep records, and how you'll review and update the whole thing over time.

Can't I just copy a template from the internet?

A generic template alone won't cut it — your program needs to genuinely reflect your specific business, services, and client base. AUSTRAC does provide starter kits for simple, low-complexity businesses, which are a legitimate starting point — but you still need to actually tailor it, not just fill in the blanks and file it away.

Do I write this once and forget about it?

No — it needs reviewing at least annually, and sooner if something material changes (new services, new client types, a regulatory update). A program nobody's looked at in years is itself a red flag if AUSTRAC ever reviews your compliance.

Making this genuinely manageable

Writing one of these from a blank page is the single biggest reason people put this off. CompliDesk's guided builder walks you through every section in order and generates a complete, tailored document as you go — most sole practitioners finish it in under an hour.

Frequently Asked Questions

Related reading: What your AML/CTF Program must include · AML/CTF Programs explained · AUSTRAC enrolment checklist · Frequently asked questions