AML Compliance Failures in Australia: 7 Patterns

Most AML/CTF failures in a small Australian firm are not dramatic. They are quiet gaps between what the program says and what the team does on a Tuesday afternoon: a policy nobody follows, a risk assessment nobody has reopened, a file that shows a tick but no reasoning. Since the Tranche 2 obligations for real estate, legal, accounting, and trust and company service providers commenced on 1 July 2026, these gaps are assessable by AUSTRAC. This guide sets out seven common failure patterns, the early warning sign of each, and the fix, so you can find them before a supervisor does.

TL;DR

• Failure usually looks like divergence: the written program says one thing and daily practice does another. Failing to comply with your own AML/CTF policies is itself a civil penalty provision (section 26G).
• Seven patterns recur in small firms: unfollowed policies, a stale risk assessment, services started before CDD, decisions without recorded reasons, no designated compliance officer, unescalated suspicion, and thin training records.
• Each has a visible early warning sign you can test for this week with a small file sample.
• The fix in every case is evidence: who decided, on what basis, when, and under which version of the program.

Table of Contents

• Why small firms fail differently
• The seven failure patterns at a glance
• 1. Policies written but not followed
• 2. A risk assessment that was never reviewed
• 3. A service started before CDD
• 4. No record of why a decision was made
• 5. No compliance officer designated
• 6. Unusual activity seen but not escalated
• 7. Missing training records
• How to find the failures first: a 90-minute self-review
• Our view: evidence beats paperwork
• Where AML Guard fits
• FAQ
• Sources

Why small firms fail differently

A large institution tends to fail through scale. A principal-led agency, conveyancing practice or accounting firm fails through informality. The principal is also the compliance officer, the administrator and the person closing the deal. Nobody is positioned to ask whether the procedure was followed, because the person who would ask is the person who skipped it.

AUSTRAC’s program overview states the basic shape: you must develop, maintain and comply with a program tailored to your business. The word that catches small firms is not “develop” but “comply”. A document that exists but is not followed is a control failure, not a documentation success.

AUSTRAC can respond to non-compliance with civil penalty proceedings, injunctions, enforceable undertakings, infringement notices or remedial directions, according to its consequences guidance. The same page notes that infringement notices can cover program documentation, compliance with the program, customer due diligence, reporting, compliance officer designation and record keeping. In other words, the areas below are not obscure. They are the areas AUSTRAC has said it can act on. For how enforcement works in practice, see our overview of AUSTRAC penalties.

The seven failure patterns at a glance

1. Policies written but not followed

This is the most common pattern and the one with its own provision. Section 26G makes failing to comply with your own AML/CTF policies a civil penalty provision. The policy does not need to be poor for the firm to be in breach. It needs only to describe a step that did not happen.

Early warning sign. Ask three staff members, separately, to walk you through what they do when a new seller or buyer instructs the firm. If the answers differ from each other or from the written policy, the program exists on paper only. Another sign: the policy was downloaded as a generic template and nobody has compared it to how the office actually operates.

The fix.

1. Pull five recent files and test each against the written procedure, step by step.
2. Record every deviation as an internal incident, whether or not it caused harm.
3. Decide for each deviation whether the practice or the policy should change. Do not leave both as they are.
4. Treat incidents and control failures as review triggers. AUSTRAC lists internal incidents and control failures among the triggers for revisiting the risk assessment, in its real estate program guidance.

A realistic policy that the team follows is worth more than an ambitious one that it does not.

2. A risk assessment that was never reviewed

The business-wide ML/TF risk assessment (section 26C of the AML/CTF Act) is the foundation, and section 26D requires you to review it. Section 26E goes further: you must not start providing a designated service if you do not comply with section 26C or 26D. The policies must describe controls that logically answer the risks identified. If the assessment is out of date, every control built on it is open to challenge.

Early warning sign. The assessment describes a firm that no longer exists: it does not mention the property type you now sell, the overseas buyers you now act for, the online instruction channel you added, or the new service line. Section 26D requires a review when there is a significant change to the matters the assessment covers, when AUSTRAC communicates information about the risks of your services, or in circumstances the Rules specify, and in any event at least once every 3 years. AUSTRAC’s real estate program starter kit adds practical triggers: significant changes to your services, delivery channels or customers, changes to ML/TF risk, regulatory or legislative updates, adverse findings from an independent evaluation, internal incidents or control failures, and scheduled periodic reviews (see the step 3 guidance).

The fix. Build a chain that can be traced from trigger to reassessment to policy change to staff communication. For each review, record:

• what triggered it (a new service, a customer segment, a control failure, or the calendar);
• what was reassessed and what the result was;
• which policy or control changed as a result;
• when and how staff were told, ideally through training.

Our guide to the risk assessment for real estate agencies walks through the content in more detail.

3. A service started before CDD

The usual version of this failure is commercial pressure. A vendor wants the appraisal and listing agreement signed now, a client wants the contract exchanged, and identity checks “can follow”. Delay is permitted only in limited circumstances, and the conditions must be met before the service begins.

Section 29 of the Act lets a service start before initial CDD only where circumstances in the Rules apply, you determine on reasonable grounds that starting first is essential to avoid interrupting the ordinary course of business and that any additional ML/TF risk is low, and your AML/CTF policies provide for completing CDD as soon as reasonably practicable and for mitigating and managing the risk meanwhile. For real estate, Rules section 6-32 sets the circumstances, such as an agent who has started brokering the sale for the seller delaying CDD on the buyer, and a specified period for finishing it. AUSTRAC’s guidance on delayed initial CDD sets out these conditions. “We always do it afterwards” is not a determination.

Early warning sign. Files in which the service date precedes the identity verification date, with no note explaining why. Also watch for ID checks that were completed only after settlement, or never.

The fix.

1. Make full CDD the default, completed before the service begins.
2. Where you do delay, record the reasonable grounds and the risk mitigation before the work starts, not afterwards.
3. Set a completion date and an owner, and chase it.
4. Report the number of delayed files to the compliance officer each month. A rising number is a control failure forming.

4. No record of why a decision was made

Section 111 sits behind a common failure: the file proves that a check happened but not why the firm decided what it decided. AUSTRAC’s record keeping overview says your CDD records must clearly show what customer information you collected, the steps you took to verify it, and the analysis or decision making that explains why the level of CDD was applied.

Early warning sign. A file with a green tick, a screenshot of a screening result and nothing else. If a colleague who had never met the client could not reconstruct why the customer was rated medium rather than high, the file is weak.

The fix. Add one required field to every CDD file: the reasoning, in a sentence or two, with the name of the person who made the call and the date. Retention matters as well. CDD records are kept for seven years from the end of the business relationship or the completed occasional transaction (section 111), and transaction records for seven years from the day the record is made (section 107). AUSTRAC’s record keeping checklist says your business should have a policy keeping all AML/CTF records for at least seven years, or as the Act requires, and our guide to the seven-year clocks explains how those periods run.

AUSTRAC’s record keeping overview gives examples of what makes evidence persuasive: version history, approvals, meeting records, control testing and documented decisions. The distinction is between saying a control operated and preserving evidence that lets an independent reviewer see how it operated.

5. No compliance officer designated

Section 26K requires you to designate an AML/CTF compliance officer no later than 28 days after you start providing a designated service, and section 26M requires you to notify AUSTRAC within 14 days of the designation. In a small firm the obligation is often assumed to be met because “the principal looks after it”.

AUSTRAC’s compliance officer page says the officer communicates with AUSTRAC on the business’s behalf and oversees and coordinates day-to-day compliance with the Act and the Rules. That is a defined role, not a courtesy title.

Early warning sign. Responsibility sits informally with a principal or an office administrator, and there is no appointment letter, no assessment of suitability and no record that AUSTRAC was told.

The fix.

• Appoint a named person in writing, with the date, and keep the document.
• Record why that person is suitable and what time and authority they have.
• Write a short role description covering oversight, reporting and liaison with AUSTRAC.
• Keep the officer’s own training evidence with the appointment.
• Name a deputy for leave, so reports are not missed in a holiday week.

6. Unusual activity seen but not escalated

This is the pattern with the shortest clock. Under section 41, a suspicious matter report must reach AUSTRAC within 3 business days after the day on which you form the suspicion, or within 24 hours if it relates to terrorism financing, according to AUSTRAC’s suspicious matter report guidance. The same page notes up to 5 business days where the report includes information protected by legal professional privilege, other than for terrorism financing.

In a small firm the delay rarely comes from a decision not to report. It comes from the concern sitting with the agent who noticed it. A buyer who will not explain the source of funds, a vendor who insists on an odd payment route, a customer whose documents do not quite match: each gets mentioned in the corridor and then the settlement date arrives.

Early warning sign. Unusual activity discussed informally but absent from any escalation register. If no concern has been logged in six months, ask whether that reflects clean business or concerns that are never written down.

The fix.

1. Give every staff member a one-step route to the compliance officer, such as a form or a CRM task, that takes under two minutes.
2. Log every escalation with a timestamp, the person who raised it and the officer who received it.
3. Have the officer record the assessment and the decision, including a decision not to report and the reasons for it.
4. Start the clock at the point suspicion is formed, not the point the officer opens the email.
5. Check what each report must contain against Part 9 of the AML/CTF Rules 2025, which deals with suspicious matter reports, threshold transaction reports and AML/CTF compliance reports.

7. Missing training records

Training often happens and cannot be proved. AUSTRAC’s training guidance says reporting entities must keep records reasonably necessary to demonstrate compliance with their personnel training obligations. Its examples include who completed training, what was delivered and which version of the content, how understanding was assessed and the results, and training history, including initial and refresher sessions.

Early warning sign. A slide deck from a team meeting and no log of who attended, who was absent, or which version of the content was shown. New starters who have never had a session are a second sign.

The fix. Keep a training register that records who completed what, when, in which role, which version of the content, the assessment result, and what was done about anyone who did not attend. Add each person’s start date so you can show that new staff were trained promptly. Our guide to AML training for real estate sets out what agencies should cover.

How to find the failures first: a 90-minute self-review

You do not need a consultant to start. Once a quarter, the compliance officer can run this test.

1. Sample. Take five files opened in the last quarter, including at least one higher-risk customer and one delayed-CDD file.
2. Trace. For each, confirm the date of CDD against the date the service started, and that the reasoning is written down.
3. Compare. Check the control actually applied against the policy wording. Note every gap.
4. Check the register. Review the escalation log and the training register for gaps, and the appointment record for the compliance officer.
5. Test the assessment. Ask whether anything has changed in services, customers, countries or channels since the last review. If so, record the trigger and reassess.
6. Record. Keep the review itself as evidence, with the date and what you changed.

A review that finds problems is a sign the system works. A review that is never done is the failure.

Our view: evidence beats paperwork

We built AML Guard for Australian Tranche 2 reporting entities because we kept seeing the same shape of failure: documents that exist, practice that differs, and no trail connecting the two.

Three convictions shape the platform. First, the four program artefacts, the risk assessment, the policies, the compliance action plan and the staff training manual, should come from the same answers. When they do, the policies match the risk assessment and the training matches the policies, which is the consistency a supervisor checks and a downloaded template cannot supply. Second, the platform should automate lookups and record keeping, not judgement. An officer reviews each outcome, so a person, not software, owns each decision. Third, every step belongs in the record. Each action is recorded in AML Guard’s tamper-evident audit trail, which holds records for 8 years, above the Act’s seven-year minimum, so the reasoning, the approver and the timing can be reconstructed long after the file closes.

None of this removes the need for a committed compliance officer and a team that follows the process. It makes it much harder for the process to drift without anyone noticing.

Where AML Guard fits

If the self-review above turned up gaps, a single platform can close several of them at once: guided wizards for the linked program documents, end-to-end CDD with identity verification, sanctions, PEP and adverse media screening, suspicious matter and threshold transaction reporting workflows, a training register with completion records, and a compliance calendar. Details of the plan and per-check options are on our pricing page, or you can start from the AML Guard home page.

FAQ

What is the most common AML/CTF failure in a small firm?

The gap between the written program and daily practice is the most common pattern. Failing to comply with your own AML/CTF policies is a civil penalty provision under section 26G, so a well-written policy that is not followed can itself be the breach. Regular sampling of files against the policy is the simplest way to catch it.

How quickly must a suspicious matter report be lodged?

AUSTRAC’s guidance says within 3 business days after the day you form the suspicion, or 24 hours if it relates to terrorism financing. Where the report includes information protected by legal professional privilege, up to 5 business days applies, except for terrorism financing. The clock runs from forming the suspicion, so informal delay inside the firm does not extend it.

Can we start a service before CDD is finished?

Only where section 29 of the Act applies. Circumstances set in the Rules must apply (for real estate, Rules section 6-32 covers some of them), you must determine on reasonable grounds that starting first is essential to avoid interrupting the ordinary course of business and that any additional ML/TF risk is low, and your policies must provide for completing CDD as soon as reasonably practicable and for managing the risk. Record those grounds before the work starts.

How long must AML/CTF records be kept?

CDD records are kept for seven years from the end of the business relationship or the completed occasional transaction (section 111), and transaction records for seven years from the day the record is made (section 107). Program records, such as your risk assessment and policies, are kept until seven years after they stop being relevant to your compliance (section 116). Check the record keeping checklist for the specific record types that apply to you. AML Guard’s audit trail holds records for 8 years, above the Act’s seven-year minimum.

Does the principal have to be the compliance officer?

Not necessarily. Someone must be designated within 28 days after you start providing a designated service (section 26K), and AUSTRAC must be told within 14 days (section 26M). The officer must be employed or engaged at management level, with sufficient authority, independence and access to resources, must be a fit and proper person, and must be an Australian resident where you provide services through a permanent establishment in Australia (section 26J). A principal can hold the role if they meet those requirements. The officer oversees day-to-day compliance and communicates with AUSTRAC for the business. Whoever it is, document the appointment, their suitability and their training.

Sources

• AUSTRAC: Your AML/CTF program overview
• AUSTRAC: Consequences of not complying
• AUSTRAC: Step 3, maintain and review your real estate program
• AUSTRAC: Delayed initial customer due diligence
• AUSTRAC: Record keeping checklist
• AUSTRAC: Record keeping overview
• AUSTRAC: AML/CTF compliance officer
• AUSTRAC: Suspicious matter reports
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006
• Anti-Money Laundering and Counter-Terrorism Financing Rules 2025
• AUSTRAC: AML/CTF training

Recommended

• AML Compliance Pricing in Australia: 2026 Comparison
• AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026
• AML for accountants: which services are captured
• Suspicious matter reports for Tranche 2 firms