AML compliance calendar: the dates the law sets
Home / Insights / AML compliance calendar: the dates the law sets

AML compliance calendar: the dates the law sets

Build an AML compliance calendar from the Act and Rules: 28-day enrolment and officer clocks, SMR and TTR deadlines, the annual report and 3-year reviews.

AML/CTF Compliance 13 October 2026 16 min read AML Guard

Officer marking dates on a paper calendar

Diarise four statutory clocks the moment you read this: enrol within 28 days of starting a designated service (section 51B of the Act), designate an AML/CTF compliance officer within the same 28 days (and tell AUSTRAC who it is within 14 days of designating them), lodge your annual compliance report within three months of each 1 July to 30 June reporting year, and report suspicious matters within three business days (24 hours for suspected terrorism financing). The review cycles below are statutory too; training and PEP rescreening intervals are yours to set.

TL;DR:

AML Guard
Keep Compliance Tasks on Track
AML Guard includes a compliance calendar alongside linked AML/CTF program artefacts, due diligence workflows and an 8-year tamper-evident audit trail.
Book a demo

Table of Contents

Statutory calendar: fixed dates and event-triggered clocks you must diarise

An AML compliance calendar built on guesswork fails the first time a supervisor asks why a task was due on a given date. We build ours from two sources only: the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and the AML/CTF Rules 2025. Some clocks run on a fixed calendar date, others start ticking the moment an event happens in your business, and the distinction matters for how you schedule reminders.

The annual compliance report runs on a fixed financial year window. AUSTRAC’s guidance on annual compliance reports confirms the reporting period is 1 July to 30 June, with lodgement due within three months after the period ends, under section 47 of the Act and section 9-9 of the AML/CTF Rules. The first reporting period under this cycle is 1 July 2026 to 30 June 2027.

Two clocks are event-triggered rather than date-fixed:

Reporting obligations for suspected misconduct run on their own short clocks under Act section 41. A suspicious matter report (SMR) is due within three business days of forming the relevant suspicion, or within 24 hours where the suspicion involves terrorism financing. A threshold transaction report (TTR) is due within 10 business days where a reporting entity provides a designated service involving physical currency of $10,000 or more, under section 43.

Record-keeping sits underneath all of this. The Act’s record-keeping periods are seven years, running from different starting points: transaction records from when they are made (section 107), CDD records from the end of the business relationship or the completion of an occasional transaction (section 111), and program records from when they stop being relevant (section 116). AML Guard’s audit trail holds records for 8 years, above the Act’s seven-year minimum; the two figures are never interchangeable.

How to build a practical, risk-based calendar from the law

Once the statutory clocks are mapped, the next job is to turn them into calendar entries that a supervisor can trust. Two habits make the difference between a calendar that survives scrutiny and one that collapses under a single pointed question.

  1. Tag every entry as either ‘statutory’ or ‘control’ at the point of creation, so nobody mistakes an internal best-practice date for a legal deadline.
  2. For event-triggered items, calculate the due date from the triggering event itself (service start date, incident date, suspicion formed date), never from a rolling calendar reminder set months in advance.
  3. For governance cycles with a minimum frequency rather than a fixed date, calculate the next due date from the last approved date, not from when the task happens to get picked up.
  4. Attach an event trigger to every periodic review so a significant operational change (new service line, new ownership structure, a material incident) forces an earlier review rather than waiting for the clock to expire.

Pro Tip: Store the evidence with the calendar entry at the moment a task closes out: the approval, the signed policy, the training completion record. Reconstructing it later from memory rarely survives an audit.

This structure also solves a common failure mode: treating a periodic review as “due sometime this year” rather than from a specific anchor date. A risk assessment reviewed on 14 March 2027 has its next statutory-minimum review due no later than 14 March 2030, regardless of when the finance team happens to schedule a budget review. Keeping the anchor date visible in the calendar entry itself, rather than buried in a policy document, is what lets a compliance officer answer a supervisor’s question in seconds rather than hours.

Example timeline: first compliance-report year after a July 2026 start

A firm that began providing a designated service on 1 July 2026 sits inside the first annual compliance report period, which runs from 1 July 2026 to 30 June 2027, with lodgement due by 30 September 2027 under the three-month window confirmed in AUSTRAC’s guidance. There is no separate “anniversary date” to invent here: the reporting year is fixed to the financial year, not to the date a firm happened to start trading.

What should go into the calendar immediately, rather than waiting for a compliance-report deadline to force the issue:

Recurring governance checklist: what to schedule, minimum frequency and owners

A calendar that only tracks reporting deadlines misses the governance work that keeps a program defensible between reports. The following items carry statutory minimum frequencies and need a named owner, not just a date.

  1. Review the business-wide ML/TF risk assessment at least every three years, before a significant change that is within your control and as soon as practicable after one that is not (section 26D). Review the AML/CTF policies at least every three years too, and after each risk assessment review (section 26F(3)).
  2. Commission an independent evaluation of the AML/CTF program at least every three years, under section 26F(4)(f). For the first one, check section 17 of the Transitional Rules 2026: for entities that did not previously need independent reviews, it sets a deadline between 30 June 2029 and 31 December 2030, depending on the last two digits of the enrolment identifier.
  3. Reassess any reliance arrangements with other entities at least every two years, under section 6-30 of the Rules.
  4. Set staff training frequency and politically exposed person (PEP) rescreening intervals according to the firm’s own risk profile. Neither has a fixed statutory interval, and a calendar entry claiming otherwise overstates the law.
  5. Assign a named owner to monitor for SMR triggers (three business days, 24 hours for suspected terrorism financing) and TTR triggers (10 business days for physical currency of $10,000 or more). The SMR clock runs from when the suspicion is formed and the TTR clock from the day of the transaction, so frontline staff need a fast route to the compliance officer.

How AML Guard maps statutory and risk-based clocks into a single compliance action plan

We built the compliance action plan to track these dates directly rather than leaving them scattered across spreadsheets and calendar invites. Guided wizards produce the risk assessment, AML/CTF policies, compliance action plan and staff training manual as one linked set, drawn from underlying answers, so a reviewer checking one document against another finds consistency rather than contradiction.

Incorporation and monitoring of the AML compliance calendar within the AML/CTF program governance framework

A compliance calendar is not a standalone document sitting next to the AML/CTF program. It is the operational layer that makes the program’s governance obligations visible and trackable day to day. The program itself is a business-wide ML/TF risk assessment (section 26C) paired with AML/CTF policies (section 26F); the calendar is how a firm proves those documents are living artefacts rather than a file produced once and forgotten.

Monitoring works best when the calendar sits under the same governance owner who signs off the risk assessment and policies, usually the AML/CTF compliance officer, with oversight visible to senior management. That person needs to see, at a glance, which statutory clocks are approaching (enrolment, officer designation, the annual compliance report) and which risk-based reviews are due against their own last-approved date (risk assessment, independent evaluation, reliance arrangements).

The governance framework also needs a mechanism for escalation when a date is missed, not just a record that it was missed. A calendar entry that simply turns red with no accompanying remediation note gives a supervisor nothing to work with. Each entry should carry a short note on what happened, who was notified and what corrective step was taken, because that is what a reviewer will ask for. Treating the calendar as part of governance, rather than as an administrative add-on, is what keeps the whole program coherent between the longer three-year and two-year review cycles.

Integration of compliance calendar deadlines with actual operational workflows using AML Guard’s platform functionalities

A calendar date means little if the person responsible for the task cannot see it inside the system they actually use to do the work. In AML Guard, the compliance action plan sits in the same platform as customer due diligence, screening and the audit trail, rather than in a separate reminder tool.

When onboarding or enhanced due diligence on a higher-risk client raises a concern, the matter goes to the compliance officer, and the officer’s decision and reasoning are recorded in the same audit trail as the rest of the file. The reporting clock, three business days or 24 hours for terrorism financing, runs from when the suspicion is formed, so that date belongs on the record.

Training and policy tasks sit on the same compliance action plan as reporting deadlines, so a compliance officer managing a firm’s obligations is not toggling between a training spreadsheet, a reporting tracker and a separate risk-review document. Reliance arrangement reviews, due at least every two years under section 6-30 of the Rules, appear alongside the day-to-day customer due diligence work that reliance arrangements actually affect, which keeps the two-year clock visible to the people doing the underlying checks, not just to the compliance officer running the calendar.

Practical examples or templates of calendar entries for key Tranche 2 obligations specific to AUSTRAC’s regulatory requirements

A calendar entry is only useful if it tells the reader what to do, not just when. For a Tranche 2 reporting entity, a well-formed entry separates the statutory requirement from the task that satisfies it.

An enrolment entry should record the actual date the designated service began, the calculated 28-day deadline under section 51B, the enrolment reference once lodged, and the name of the person who completed it. An officer-designation entry mirrors this structure under section 26K, recording the designation date, the 28-day deadline and the notice to AUSTRAC, due within 14 days of designation (section 26M).

Two 28-day clocks and their recorded evidence

The annual compliance report entry should record the reporting period (1 July to 30 June), the three-month lodgement deadline that follows, and a checklist of the supporting evidence the report draws on: risk assessment status, training completion records, SMR and TTR logs for the period, and any independent evaluation findings relevant to that year.

Review-cycle entries (risk assessment, independent evaluation, reliance arrangements) should record the date of the last approval, the statutory minimum frequency that applies, the calculated next-due date, and a note of any significant operational change that might bring the review forward. None of these entries needs to be elaborate, but each one needs the anchor date, the governing provision and the evidence location recorded together, rather than split across three different systems.

Process for updating the AML compliance calendar in response to regulatory changes or organisational shifts

A calendar built from the Act and the Rules needs a maintenance process, because neither the law nor the business stays still. Two kinds of change force an update: a change in the regulatory framework itself, and a change inside the business that alters its risk profile.

When AUSTRAC updates guidance or the Rules are amended, the firm’s compliance officer should review every calendar entry that references the changed provision, confirm the new deadline or frequency, and update the entry with a note on what changed and when. A program is not static: reviews should be triggered by regulatory or operational change, not only by the calendar reaching a scheduled date.

Organisational shifts work the same way. A firm that adds a new designated service, changes ownership structure, enters a new reliance arrangement, or experiences a material incident must review the risk assessment under section 26D, rather than waiting for the three-year clock, where the change is a significant change to its services, customers, delivery channels or countries: before the change where it is within the firm’s control, and as soon as practicable after it where it is not. Treat other changes, such as ownership or an incident, as good-practice triggers. The calendar entry for that review should be brought forward and the reason recorded, so the file shows a deliberate response to change rather than a coincidence of timing.

Building this update process into the calendar itself, rather than relying on someone remembering to check, is what keeps the document from drifting out of step with the law or the business it is meant to govern.

Calendar update triggers: regulatory change and business change

Role of the compliance calendar in audit preparedness, including maintaining the 8-year tamper-evident audit trail

Supervisors and auditors do not inspect a calendar tick. They inspect the file behind it: the approval, the signed policy, the training record, the evaluation report. A compliance calendar earns its keep by making that file easy to produce on request, for every entry, not just the ones due this month.

Preparedness starts with consistent evidence capture at the point a task closes, rather than reconstruction after the fact. A risk assessment review marked complete should link directly to the approved document and the date it was signed off. An SMR entry should link to the lodgement confirmation and the internal note on how the three-business-day or 24-hour clock was calculated. A training entry should link to attendance and completion records for the staff involved.

AML Guard retains this evidence in an 8-year tamper-evident audit trail, above the Act’s seven-year minimum. The two figures are not interchangeable: seven years is what the Act sets, from different starting points, and 8 years is what the platform holds. For audit purposes, the calendar’s value is less about the date it displays and more about the depth of the evidence trail it opens when someone asks to see it.

Synchronisation of compliance calendar activities with staff training schedules and policy updates under the AML/CTF Rules

Training and policy maintenance are not separate projects from the compliance calendar; they are two of the recurring inputs that keep every other date on the calendar credible. A risk assessment that was reviewed on schedule but never flowed through to updated staff training leaves a visible gap for a supervisor to find.

The Rules set governance expectations around program currency without fixing a training interval, which means the calendar needs to carry the firm’s own risk-based training schedule alongside the statutory dates, clearly marked as a control date rather than a legal deadline. When a policy is updated, whether from a scheduled three-year review or an event-triggered change, the calendar should automatically flag a corresponding training refresh for affected staff, so the policy and the training staff actually received stay in step.

PEP rescreening works the same way: no fixed statutory interval applies, so the calendar should reflect the frequency the firm has set based on its own risk assessment, and that frequency should be revisited whenever the risk assessment itself is reviewed. Keeping training schedules, policy update dates and rescreening intervals synchronised on the same calendar, rather than managed in three separate documents, is what lets a compliance officer demonstrate that the program functions as one coherent system rather than three disconnected obligations.

Publisher perspective: pragmatic priorities for compliance owners

Most AML calendars fail not because a date was missed, but because nobody can explain where the date came from. Start with the statutory clocks, layer risk-based controls on top, and make sure every entry can point back to a provision or a documented risk decision. Record the evidence when the task closes, not weeks later from memory, and let operational change (a new service, a new structure, an incident) pull a review forward rather than waiting out the clock.

Book a demo or view pricing to map your compliance calendar with AML Guard

Working out which dates apply to your firm, and keeping the evidence behind each one, takes real time away from client work. We configure a compliance action plan around the firm’s start date, designated services and risk profile, so enrolment deadlines, officer designation and the first-year compliance report can be mapped before they become urgent.

FAQ

What is an AML compliance calendar?

An AML compliance calendar is a schedule of the statutory deadlines and recurring governance tasks a reporting entity must track under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and the AML/CTF Rules 2025. It separates fixed dates, like the annual compliance report window, from event-triggered clocks, like enrolment within 28 days of starting a designated service.

When is the AML/CTF annual compliance report due?

The reporting period runs from 1 July to 30 June each financial year, with lodgement due within three months after the period ends, as confirmed in AUSTRAC’s guidance. The first reporting period under this cycle is 1 July 2026 to 30 June 2027, with lodgement due by 30 September 2027.

How quickly must a suspicious matter report be lodged?

A suspicious matter report must be lodged within three business days of forming the relevant suspicion, or within 24 hours if the suspicion involves terrorism financing, under section 41 of the AML/CTF Act. A threshold transaction report, covering physical currency of $10,000 or more, is due within 10 business days under section 43.

How often must a risk assessment or independent evaluation be reviewed?

The business-wide ML/TF risk assessment must be reviewed at least every three years, and before a significant change within your control (as soon as practicable after one that is not), under section 26D. An independent evaluation of the AML/CTF program is required at least every three years, under section 26F(4)(f), and reliance arrangements must be reassessed at least every two years under the AML/CTF Rules 2025.

No. Neither has a fixed interval in the Act or the Rules. Record whatever interval you choose as a risk-based control date, not a legal deadline, so the distinction is never lost in your calendar.

Sources

See How AML Guard Works

Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.

Book a Demo
This article is for general information purposes only and does not constitute legal advice. Firms should obtain independent professional advice on their specific AML/CTF obligations.
Last reviewed: 13 October 2026.