AML/CTF programs for Australian accounting firms: what your program must contain

Every reporting entity under the AML/CTF Act must have an AML/CTF program. It is not a marketing document or a staff manual; it is the framework, approved by a senior manager and subject to ongoing oversight by the governing body, that governs how the firm identifies, assesses and manages money laundering, terrorism financing and proliferation financing risk. It is also the first thing AUSTRAC asks for when something goes wrong.

The structure changed with the reforms that commenced on 31 March 2026 (and applied to accountants from 1 July 2026), and a good deal of material still in circulation describes the old one. The former framework split the program into a mandatory Part A, covering the firm-wide risk management framework, and a Part B, covering customer identification procedures. That Part A and Part B division is no longer how the obligation is framed. The current framework requires a money laundering and terrorism financing risk assessment of the business, together with AML/CTF policies that respond to the risks the assessment identifies.

AUSTRAC’s starter kit for accountants is organised around three documents, and it is a sensible shape for a small or mid-sized practice to follow: a risk assessment, a policy document, and a process document. The risk assessment is the foundation and everything else answers to it. The policy document records what the firm has decided to do about the risks identified. The process document records how staff actually carry that out, day to day.

The risk assessment needs to be about the firm rather than about accounting practices in general. It should work through the firm’s customer types, the designated services it actually provides, the countries and jurisdictions it deals with, the delivery channels it uses including remote onboarding, and the money laundering and terrorism financing typologies that plausibly apply to that combination. A generic template that would fit any practice in the country is the single most common weakness, because a risk assessment that does not describe this firm cannot support policies proportionate to this firm.

The policies then have to cover the substantive obligations: initial customer due diligence before the designated service is provided, ongoing customer due diligence and the circumstances that trigger a refresh, enhanced due diligence for high-risk customers and politically exposed persons, beneficial ownership identification, reporting of suspicious matters and threshold transactions, record keeping, staff training including tipping-off, the compliance officer’s role and authority, senior manager approval and governing-body oversight, and independent evaluation of the program.

The recurring gaps in professional firms are consistent: beneficial ownership not properly documented for trust and layered corporate customers, no tipping-off training for the client-facing staff most likely to be asked awkward questions, training delivery not recorded in a way that survives staff turnover, and a process document describing an ideal workflow rather than the one the firm uses.

The program is a living document. The risk assessment should be reviewed on a regular cycle and whenever something material changes, such as a new service line, a new customer segment, or a new jurisdiction. Policies should be updated when the risk assessment moves, and new starters should be trained promptly rather than at the next annual session.

CoSec Partners helps accounting and legal firms with the formation-side inputs their program depends on: structured information capture at company, trust and SMSF formation, beneficial ownership documentation, and consistent handover of customer information. We do not draft, review or sign off a firm’s AML/CTF program, and nothing here is AML advice. Where you need that, work with an AML specialist or your professional body; AUSTRAC’s own guidance and starter kit for accountants are the right first stop.