The AML/CTF Rules require initial and ongoing training for your personnel (Rules 5-9(2)), but they set no fixed interval for refreshers. AUSTRAC gives example frequencies, such as every 12 months for customer-facing and onboarding roles, and expects you to set a cycle that suits your own business, then prove the training worked. This guide sets out the examples, the events that should trigger an early refresher, and three ways to show a refresher changed what your people do.
TL;DR
- The Rules require training when a person starts and ongoing training throughout their employment or engagement. They do not prescribe a refresher interval.
- AUSTRAC’s examples: compliance officers and senior management every 6 to 12 months, customer-facing, onboarding and enhanced CDD roles every 12 months, vendors at onboarding and on contract renewal or change. They are examples, not a rule.
- Law changes, new risks, program changes, review findings, significant breaches and new AUSTRAC guidance should each prompt a refresher outside the normal cycle.
- Prove effectiveness with a short test, incident reviews and the compliance officer’s report to the governing body, and keep the records.
Table of Contents
- What the Rules actually require
- How often should refresher training run?
- Events that should prompt a refresher before the cycle ends
- What a refresher should cover
- How to check a refresher worked
- What to record
- A simple refresher calendar for a real estate agency
- Keeping the manual and the program aligned
- Run your training from your own program
- FAQ
- Sources
What the Rules actually require
Under the AML/CTF Act 2006 (Cth) and the AML/CTF Rules 2025, a reporting entity must train its people at two points. AUSTRAC’s AML/CTF training guidance describes initial training when a person is employed or engaged, and ongoing training during their employment or engagement. Rules 5-9 is the reference point.
The training has to be tailored. AUSTRAC expects it to reflect the functions the person performs, the ML/TF risks relevant to those functions, and their specific responsibilities under your AML/CTF policies. A reception coordinator who books inspections and a principal who signs off on a high-risk sale need different content, even though both work under the same program.
Tranche 2 obligations for real estate, legal, accounting, and trust and company service providers commenced on 1 July 2026 and are in force. Agencies are therefore past the stage of preparing a first training session. The live question is how to keep training current, which is what a refresher cycle answers.
The word “refresher” does not appear as a defined term. The obligation is for ongoing training, and a refresher is the practical form it takes. That framing matters, because it shifts the question from “have we ticked the annual box?” to “is our training still right for what each person does today?”
How often should refresher training run?
There is no statutory interval. AUSTRAC states that frequency must be appropriate to your business, and it offers example frequencies on its training page. They are examples only, and you should present them that way in your own program.
| Role | AUSTRAC’s example frequency |
|---|---|
| Compliance officers and senior management | Every 6 to 12 months |
| Customer-facing personnel, onboarding, transaction monitoring and enhanced CDD roles | Every 12 months |
| Vendors and third parties | At onboarding, and on contract renewal or change |
The higher cadence for compliance officers and senior management reflects their position. They approve the risk assessment, own the program and answer to the governing body, so they need to hear about regulatory movement sooner than a front-of-house team.
Is annual training legally required?
Not as a stated rule. Twelve months is AUSTRAC’s example for customer-facing and CDD roles, and it is a sensible default because it is easy to schedule, easy to evidence and aligns with most review cycles. If your agency chooses a different interval, your program should record why it suits your size, your services and your risk profile. A larger agency with high staff turnover and a buyer base that includes foreign and trust-structured purchasers may reasonably choose a shorter cycle for onboarding roles than a small boutique agency would.
Two practical points follow from this:
- Write the interval into your AML/CTF policies by role, and state the reasoning. A supervisor reading the policy should see a decision, not a default copied from a template.
- Treat the interval as a maximum between sessions, not the only trigger. The next section covers the events that should bring a refresher forward.
Who counts as personnel?
The training duty reaches the people whose work touches your designated services and your ML/TF risk: agents, property managers who handle transactions, administrative staff who collect identity documents, and the principal. It also reaches contractors and engaged persons, not only employees. AUSTRAC’s wording covers anyone “employed or engaged”, so an agent on a commission-only arrangement belongs in the training register as much as a salaried coordinator.
Events that should prompt a refresher before the cycle ends
AUSTRAC identifies a set of circumstances in which training should be refreshed or delivered outside the normal schedule. Build these into your policy as standing triggers:
- Changes to the law. Amendments to the Act or the Rules change what your people must do.
- New and emerging risks. A typology that now appears in your market, or a change in the types of buyers you act for.
- Program changes. A revised risk assessment, new policies, a new CDD procedure or a new system.
- Evaluation or review findings that show gaps. If an internal review or independent evaluation finds weak spots, training is part of the remedy.
- Significant breaches. A missed obligation or an incident that exposed the agency.
- New AUSTRAC guidance. Fresh guidance can alter what good practice looks like.
There is also a trigger that comes before any of these: training before new duties. When a person moves into a role that carries AML/CTF responsibilities, such as a salesperson taking on onboarding or a property manager starting to handle trust-account transactions, they should be trained before they begin, not at the next scheduled session.
The compliance officer is the person best placed to watch for these triggers. A simple habit works: a standing agenda item at each quarterly management meeting that asks whether any trigger has occurred since the last meeting, with the answer minuted. Developments in international standards on payment transparency are also part of the wider picture a compliance officer tracks, and FATF Recommendation 16 guidance shows how those standards are explained for teams that handle payments.
What a refresher should cover
A refresher is not the induction replayed. Cover three things.
What has changed. Summarise any law, Rules or guidance changes, and any amendments to your own policies since the last session. If your risk assessment changed, say which risks moved and why.
What happened in your agency. Near misses, escalations and any suspicious matter reports (without identifying details where that is inappropriate) are the most relevant teaching material you have. They show people what a red flag looks like in your own listings, auctions and settlements.
Role-specific scenarios. Give each group a scenario drawn from its own work. For a sales team, that might be a buyer who is reluctant to explain the source of funds and wants to settle quickly through an unusual structure. For onboarding staff, it might be a company buyer whose beneficial owners cannot be readily identified. For senior management, it could be a decision on whether to continue acting when CDD cannot be completed.
AUSTRAC also publishes a Smart Real Estate Agent’s Guide to AML/CTF, a train-the-trainer package for frontline real estate professionals. It has three modules covering why AML/CTF matters, CDD risks and obligations, and AML/CTF in practice, with scenarios and discussion activities. AUSTRAC describes it as educational rather than exhaustive: it does not replace training specific to your own business and its risks. Use it as source material for your sessions, and add your own risk assessment and policies on top.
How to check a refresher worked
Holding a session proves it happened. It does not prove people understood it. AUSTRAC’s guidance lists tools for monitoring training effectiveness, and three of them form a practical, low-cost routine.
1. A short test after the session
A post-training assessment of 8 to 15 questions is enough for most roles. Mix question types:
- Recognition: “A seller asks that proceeds be paid to an unrelated third party. Which of these is a red flag?”
- Procedure: “Who do you notify internally, and by when, when you form a suspicion?”
- Judgement: a short scenario with a decision to explain in two sentences.
Set a pass mark in your policy and decide in advance what happens when someone falls short, for example a short follow-up conversation and a re-sit. The result matters less than the pattern: if most of the team misses the same question, the training content or the procedure needs fixing, not the people.
2. Incident reviews
AUSTRAC lists incident reviews as a way to identify knowledge gaps. After each refresher cycle, look at what has actually happened on files:
- Red flags that were missed and spotted later, perhaps at settlement or during a file review.
- Suspicious matter reports that were lodged late, with the reason for the delay.
- CDD files with incomplete beneficial ownership information.
- Escalations that took longer than your procedure allows.
If an incident traces back to a topic you covered in the last refresher, the session did not land and should be redesigned. If it traces back to a topic you did not cover, add it to the next one.
3. The compliance officer’s report to the governing body
AUSTRAC also points to AML/CTF compliance reports from the compliance officer to the governing body. For an agency, the governing body is typically the principals or directors. A short training section in that report should state who was trained, the pass rates, any gaps found by testing or incident review, and the actions taken. This closes the loop: it gives senior management evidence to act on and gives a supervisor a documented record of oversight.
AUSTRAC’s list also includes personnel surveys or feedback, and performance reviews and targets. A two-question feedback form (“What was unclear?” and “What would you change?”) is a useful addition and takes a minute to complete.
What to record
AUSTRAC’s guidance says reporting entities may consider keeping records of attendance, training schedules, content, delivery methods and employee assessments. In practice, a defensible training register shows:
- Who completed training: name, role, team and start date.
- What was delivered: topics, delivery format, and the content and its version.
- How understanding was assessed: the test, the score and any follow-up.
- Training history: initial training, each refresher and any role-specific modules.
Content version is the detail most agencies miss. If your policies change in March and a refresher runs in May, the record should show that the May session used the updated content. For retention periods and a worked list of what to keep, see AML training records: what to keep and how long.
A simple refresher calendar for a real estate agency
Here is a model you can adapt, using AUSTRAC’s examples as a starting point rather than a requirement.
| Group | Cycle | Plus |
|---|---|---|
| Principal, compliance officer, senior management | Every 6 months | Briefing when any trigger occurs |
| Sales, property management, onboarding, enhanced CDD roles | Every 12 months | Training before taking on new duties |
| Administrative and support staff who handle client documents | Every 12 months | Short refresher after any procedure change |
| Vendors and third parties with AML/CTF tasks | At onboarding and on contract renewal or change | Update when their scope changes |
Then layer the triggers on top. A new AUSTRAC guidance note, a revised risk assessment or a significant incident shifts the schedule, and the register records why.
What we see in agencies
At AML Guard we build for Australian Tranche 2 reporting entities, and the same pattern comes up in agencies of every size: training is run well once, then left behind while the policies move on. The result is a manual that no longer matches the program it is meant to teach.
We designed our platform so that this is harder to let happen. Its guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so the training manual starts from the risks you assessed. Rerun the wizards when the risk assessment changes, and the manual moves with it.
The platform automates the paperwork. The judgement about what your people need to know, and whether they have learned it, stays with your compliance officer, where it belongs.
AML Guard
Keeping the manual and the program aligned
A refresher only works if the material underneath is current. Three habits help:
- Change the training when you change the program. Any revision to your AML/CTF policies or your risk assessment for a real estate agency should generate a question: which roles need to hear about this, and by when?
- Version everything. Date and number the training content so the register can point to the exact material each person received.
- Review the cycle annually. Once a year, the compliance officer should check whether the intervals still suit the business, given staff turnover, new services and the incident record.
For a fuller walk-through of what agencies must put in place, see our guide to AML training for real estate agencies.
Run your training from your own program
If you are an agency principal or compliance officer, AML Guard’s guided wizards produce the training manual alongside your risk assessment, AML/CTF program and customer acceptance policy. AML Guard is not self-service; every firm starts with a demo. Book a demo, or see the pricing page for the subscription and per-check fees.
FAQ
How often should AML refresher training happen in Australia?
The Rules set no interval. AUSTRAC’s examples are every 6 to 12 months for compliance officers and senior management, and every 12 months for customer-facing, onboarding and enhanced CDD roles. Choose a cycle that suits your business, write the reasoning into your policies, and bring a session forward when a trigger event occurs.
Is annual AML training mandatory for real estate agency staff?
Annual training is not a stated legal requirement. The obligation is for initial and ongoing training tailored to each person’s functions and risks. Twelve months is AUSTRAC’s example for customer-facing and CDD roles, so many agencies adopt it as their standard and record that choice in the program.
How do I assess whether staff understood the training?
Use the tools AUSTRAC lists: a short post-training test, reviews of incidents such as missed red flags or late suspicious matter reports, staff feedback, and the compliance officer’s report to the governing body. Record each score and any follow-up action in the training register.
Do vendors and contractors need refresher training?
AUSTRAC’s example is training vendors at onboarding and again on contract renewal or change. If a third party carries out AML/CTF tasks for you, treat their training as part of your program and keep a record of it.
What should I do when AUSTRAC issues new guidance?
New AUSTRAC guidance is one of the events that should prompt a refresher. Read it, decide which roles are affected, update your policies and training content if needed, deliver a short session to those roles, and record the date and content version.
Sources
Recommended
- AML training records: what to keep, how long
- AML/CTF Staff Training for Tranche 2
- AML training manual for Tranche 2 firms
- AML training real estate: what agencies must do
See How AML Guard Works
Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.