AML/CTF Policies in Australia: What the Law Asks
Home / Insights / AML/CTF Policies in Australia: What the Law…

AML/CTF Policies in Australia: What the Law Asks

What AML/CTF policies must do in Australia: how they flow from your risk assessment, who approves them, when to review them and how to keep them short.

AML/CTF Compliance 29 October 2026 12 min read AML Guard

Agency principal reviewing AML policy documents

AML/CTF policies are the written policies, procedures, systems and controls that manage and mitigate the money laundering, terrorism financing and proliferation financing risks your risk assessment identified, and that make sure you comply with the Act and Rules. For a real estate agency, buyers agent or other Tranche 2 business, they are the working centre of your AML/CTF program, and under section 26G you must comply with them. A policy that exists on paper but is not followed is therefore a breach in its own right.

This guide covers what the law asks policies to do, how they connect to your risk assessment, who approves them, when they are reviewed, and how a small firm keeps them short and true.

AML Guard
Keep Policies Matched to Risk
AML Guard’s guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual.
Book a demo

TL;DR

Table of Contents

What AML/CTF policies are, and who needs them

Tranche 2 obligations for real estate, legal, accounting, and trust and company service providers commenced on 1 July 2026 and are in force. AUSTRAC’s guidance on real estate designated services says you are likely to provide them if you work as a buyer’s or seller’s agent, or are a property developer selling without engaging an independent real estate agent.

An AML/CTF program, according to AUSTRAC’s program overview, must include both your ML/TF risk assessment and your AML/CTF policies: the policies, procedures, systems and controls you use to manage and mitigate your risks. The policies are one part of the program, not the whole of it. The risk assessment says what can go wrong in your business. The policies say what you do about it.

AUSTRAC also draws a line around what counts. In its guidance on managing and mitigating risks, ancillary procedures that are not directly needed to manage the risks or show compliance are not AML/CTF policies. That matters for a small firm: your general office manual does not need to be dragged into the program.

How policies flow from the risk assessment

The order is fixed. You assess first, then you write policies that answer what the assessment found. AUSTRAC’s step 2 guidance says the completed risk assessment is used to build the system by which you assign ML/TF risk ratings to customers, and that high, medium and low inherent risks call for different strengths of response: priority mitigation for high, mitigation or management for medium, management for low.

AUSTRAC sets four expectations for policies: they should be targeted, proportionate, ongoing and effective. In practice:

A worked example for a residential sales agency shows the chain. Suppose your assessment rates purchasers using foreign or complex entity structures as higher risk because the real owner is hard to see. The policy that answers it might require beneficial ownership determination before the customer proceeds, enhanced CDD, source of funds checks at defined triggers, and sign-off by the compliance officer. If your assessment rates a local individual selling a home they have long owned in their own name as lower risk, the policy can specify standard identity verification and routine monitoring. Same agency, two proportionate responses. For the detail of the assessment step, see our guide to the AML risk assessment for real estate agencies.

What the policies need to cover

Do not rely on a generic list from a template or a blog. AUSTRAC’s page on managing and mitigating risks sets out what policies must address and gives examples of the kinds of matters they deal with. The page’s own list of what you must do under the program includes:

AUSTRAC’s examples of mitigation include limiting the channels and services high-risk customers can use, increasing monitoring, and, where cash exposure is high, setting a transaction limit or requiring bank transfer. Its guidance also says that if you cannot appropriately mitigate or manage a risk, you should consider whether to keep providing designated services to that customer. Your policies should say who makes that call.

Proliferation financing needs a line of its own. The same guidance says you need not write separate proliferation financing policies if you have reasonably assessed the risk as low and your policies manage it. AUSTRAC lists four signs that a business is less likely to face it, including operating only in Australia and having no customers located in, or connected to, high-risk jurisdictions. Either way, the assessment is documented in the program.

Timing rules belong in the policy where they change behaviour. In real estate, AUSTRAC’s delayed CDD guidance lets an agent delay initial CDD on the party they do not act for until 28 days after the exchange of contracts or 3 days before the initially agreed settlement day, whichever is earlier, where the conditions in section 29 of the Act are met. A buyers agent has two customers on different clocks, which we cover in buyers agent AML. A policy should state which clock applies to whom, and who checks.

Reporting steps also belong in the policy. Suspicious matter reports go to AUSTRAC within 24 hours for suspicions relating to terrorism financing and three business days for other matters, and records are generally retained for seven years, per the factsheet. Name the person who lodges, the person who backs them up, and where the evidence is stored.

Suiting the nature, size and complexity of your business

The Act does not ask a three-person agency to write what a national network writes. AUSTRAC’s guidance on tailoring gives examples of larger businesses using automated monitoring, dedicated financial crime teams and multiple senior managers separate from the compliance officer. A small firm is not expected to copy that.

AUSTRAC has also published a real estate program starter kit to help small real estate and buyer’s agencies customise, use and maintain a program. Use it as a reference, but remember the kit is a starting point, and it is your risk assessment that decides what stays.

A practical test for each paragraph of a policy:

  1. Which risk in our assessment does this answer?
  2. Who does it, and when?
  3. What record shows it was done?
  4. Would our team actually do this on a busy settlement week?

If the fourth answer is no, the sentence is a liability. Because section 26G makes compliance with your own policies a civil penalty provision, an ambitious promise you do not keep is worse than a modest one you do.

Who approves the policies, and who is accountable

AUSTRAC’s step 3 guidance describes the approval path: document the program, give it and the risk assessment to a senior manager, have that person approve in writing with their name, role and a date before you provide designated services, and give the risk assessment to your governing body. Under section 26P of the Act, any update to the risk assessment must also be notified in writing to the governing body as soon as practicable.

AML program approval and oversight roles

The AML/CTF compliance officer sits beside this chain, not inside the approval step. AUSTRAC’s page on the role says the officer needs sufficient authority, independence, and access to resources and expertise, and its governing body guidance says no other person should amend or remove significant findings or recommendations in the officer’s reports before they reach the governing body. The factsheet describes the role as overseeing day-to-day compliance and communicating with AUSTRAC.

In a small agency, the principal often holds several roles. That can work, provided your policy records who holds each one, and that the compliance officer can raise a problem upward without it being edited on the way. Version control matters here too: restricting who can edit approved program documents, in the way document access controls for brokers are used to protect sensitive deal files, keeps the approved version identical to the one your team reads.

When policies are reviewed

AUSTRAC’s guidance says you review and update your program in response to triggers, and in any case every three years. The factsheet adds that agencies conduct internal reviews and independent evaluations in certain circumstances and at least once every three years. The reforms replaced independent reviews of Part A with independent evaluations of the entire program.

Write your triggers into the policy so the review does not depend on memory. Reasonable triggers include:

Keep a dated log of every review, even when the answer is that nothing changed. That log is evidence that your policies are ongoing, which is one of AUSTRAC’s four expectations.

Keeping a small firm’s policies short and true

Short does not mean vague. The strongest small-firm policies share a few habits.

Write in the present tense of what you do. “The compliance officer reviews every high-risk rating within two business days” is checkable. “We take a robust approach to risk” is not.

Use one source of truth. When policies, risk assessment and training say different things, staff follow whichever they remember. A supervisor reading the three documents side by side will notice the mismatch before anything else.

Train to the policy. Staff must know the steps they are expected to follow, and you keep records of training sessions. Our guide to AML training for real estate covers what agencies need to do.

Record evidence as you go. AUSTRAC expects policies to work in practice, and records are how you show they do. A file note at the time beats a reconstruction later.

Cut what you do not use. Delete clauses that answer risks you do not have. Conveyancers and settlement agents face a different set; see what a conveyancer AML program must contain rather than borrowing from real estate.

Keeping a small firm's policies short and true

Our perspective: policies that match the risk assessment

We built AML Guard for Australian Tranche 2 reporting entities, not as an adaptation of banking tools, and the lesson we return to most is consistency. When an agency writes its risk assessment in one place, its policies in another and its training in a third, the documents drift. The drift is the thing a supervisor tests: does the policy answer the risk, and does the training teach the policy?

So AML Guard’s guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment. A downloaded template starts with no knowledge of your risk assessment.

We also hold a firm line on judgement. The platform automates lookups and record keeping, not decisions: for companies, beneficial ownership is determined from the ACN, and an officer approves each determination. Your policies describe a human decision, and the case record holds it.

Putting the set in place with AML Guard

If you want your risk assessment, program, customer acceptance policy and training manual built with guided wizards, AML Guard produces them, then supports the work the policies describe: one case record holding each identity check, screening result and officer decision, and ACN-based beneficial ownership determination with an officer approving each one.

AML Guard is not self-service; every firm starts with a demo. See the pricing page for the subscription and per-check fees.

What AUSTRAC prioritises on enforcement

AUSTRAC’s regulatory priorities for 2026-27 say that during the year it expects newly regulated businesses to have enrolled, completed their risk assessments, appointed governance roles, established appropriate policies and embedded them in daily operations. In newly regulated sectors, its interventions focus on businesses that haven’t enrolled or are recklessly involved in, or complicit with, criminal activity. That is no reason to relax about everything else, since section 26G still applies to every reporting entity. It does show what the regulator expects to see: policies that are part of daily work, not a document on a shelf.

FAQ

Are AML/CTF policies the same as an AML/CTF program?

No. The program is the whole framework: it includes the risk assessment, the policies, and the governance and review arrangements. The policies are the procedures, systems and controls that manage and mitigate the risks the assessment found.

Who must approve our AML/CTF policies?

A senior manager approves the documented program in writing, with their name, role and the date, before you provide designated services. The governing body receives the risk assessment and oversees compliance.

How often must we review our policies?

You review them when triggers occur, such as a change in your services, customers or risks, and at least every three years. Independent evaluation of the program also happens at least once every three years.

What happens if we do not follow our own policies?

Section 26G requires you to comply with your AML/CTF policies, and it is a civil penalty provision. Keep policies accurate to what your team really does, and keep records that show they were applied.

Sources

See How AML Guard Works

Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.

Book a Demo
This article is for general information purposes only and does not constitute legal advice. Firms should obtain independent professional advice on their specific AML/CTF obligations.
Last reviewed: 29 October 2026.