AML training for law firms under Tranche 2

Under section 26F(4)(e) of the AML/CTF Act and Rules 5-9, a law practice’s AML/CTF policies must provide for role-appropriate AML/CTF training, initial and ongoing. The first practical step is mapping AML/CTF roles across the practice and customising AUSTRAC’s legal profession program starter kit around them. Training must match each person’s function and the risks they handle, and you need records that show it happened.

TL;DR:

• Your policies must provide initial and ongoing training for personnel whose functions are relevant to the Act (section 26F(4)(e) and Rules 5-9), at a frequency set by each role’s duties and risks.
• Conveyancing, handling client or trust account money, entity formation, and trustee or director work can trigger duties; legal advice alone generally does not.
• Fee earners handling corporate or trust matters need deeper training to spot layered beneficial ownership and know when to escalate for enhanced due diligence.
• Certificates alone do not prove effectiveness; use scenario assessments and file reviews, record results and remediation, and retain AML/CTF evidence for at least seven years.
• Complete and document personnel checks and role specific training before assigning anyone trust account duties, compliance officer responsibilities, or other sensitive AML/CTF functions.

Table of Contents

• What your AML/CTF training must cover
• Which legal services and firm roles are in scope
• Building a training plan from AUSTRAC’s legal starter kit
• Choosing delivery formats and vetting outside providers
• Monitoring effectiveness and keeping records AUSTRAC expects
• Personnel due diligence and your compliance officer appointment
• How a compliance platform can operationalise your training
• Quick fixes law firms can make this week
• AML Guard: training and records built for Tranche 2 law firms
• FAQ
• Sources

What your AML/CTF training must cover

Section 26F(4)(e) of the Act requires a practice’s AML/CTF policies to deal with training for people whose functions are relevant to its obligations, covering the practice’s ML/TF risks and its obligations under the Act. Rules 5-9 adds that the training is both initial and ongoing, and suited to each person’s function, risks and responsibilities. There is no fixed statutory interval: the frequency has to match the role and the risks it carries, not a calendar default.

A sound curriculum covers:

• Obligations under the Act and the AML/CTF Rules, including enrolment and program duties
• Money laundering, terrorism financing and proliferation financing risks relevant to legal work
• Customer due diligence and enhanced customer due diligence procedures
• Sanctions and politically exposed person screening, and source of funds or wealth checks
• The suspicious matter reporting process and the tipping off offence under section 123
• Record keeping standards that support an audit trail

Training has to be tailored, not generic: AUSTRAC’s training guidance expects it to suit each person’s functions, risks and responsibilities, and to be delivered in a way they understand, so firms must adjust content and timing to the person’s role and the ML/TF risks they face, rather than running the same module for every employee.

Which legal services and firm roles are in scope

Not every matter a practice handles triggers AML/CTF duties. Designated services commonly captured in legal work include assisting with a transaction to buy, sell or transfer real estate, receiving, holding or controlling a client’s money or property to help in a transaction, creating or restructuring companies and trusts, and acting as, or arranging for someone to act as, a trustee, director or secretary. Advice alone is generally not a designated service: AUSTRAC’s professional services guidance says merely influencing how a client proceeds, or giving general advice, is not enough. Check how this applies to your work before assuming a matter falls outside scope.

Once you know which services are captured, map your people against them:

1. Client intake and reception staff, who need to recognise red flags at first contact
2. Fee earners running conveyancing, trust, entity formation or trustee matters
3. Trust account staff who handle client money directly
4. The AML/CTF compliance officer, who needs the deepest training and oversight role
5. IT and support staff, who need enough awareness to protect records and escalate concerns

Fee earners on corporate or trust matters generally sit at higher risk and need training on recognising layered beneficial ownership structures and knowing when to escalate for enhanced due diligence. Our guidance for law firms adapting to Tranche 2 walks through this mapping in more detail for practices working out their own service mix.

Building a training plan from AUSTRAC’s legal starter kit

AUSTRAC’s legal profession program starter kit is designed for small legal practices that meet its suitability criteria, and is meant to be customised rather than used unmodified. A practice must have its risk assessment and AML/CTF policies in place before providing a designated service (sections 26E and 26F(8)), so treat the starter kit as the skeleton and your own workflows as the content that fills it in.

A workable sequence looks like this:

• Use your business wide ML/TF risk assessment to identify which roles and services need the most training depth
• Customise starter kit templates so the risk assessment, policies and training manual tell the same story
• Build a role based training matrix covering initial training, scheduled refreshers and trigger based sessions after incidents or policy changes
• Assign an owner and a due date to each row in the matrix, not just a topic
• Keep a training register, assessment evidence and manager sign off as your audit trail

Pro Tip: Map starter kit controls against your existing file workflows before you roll out training content, so staff are learning the version of the process they will actually use.

Our training manual built for Tranche 2 firms gives practices a starting structure for this kind of role based matrix.

Choosing delivery formats and vetting outside providers

Online modules work well for baseline knowledge and are easy to track at scale, but they rarely teach staff to spot a red flag in an actual file. Live workshops suit scenario discussion and questions, while on the job coaching from a compliance officer or senior fee earner builds judgement that a module cannot. Most practices end up blending the three.

If you outsource delivery, check:

• The provider has genuine experience with legal sector money laundering and terrorism financing risks, not just generic financial services content
• Materials can be customised to your designated services and your firm’s own file types
• The provider supplies assessment tools and completion evidence you can file, not just a certificate
• Content is accessible in the languages your staff actually use

Generic courses should always be supplemented with firm specific scenarios drawn from real file types, tested through short assessments rather than a tick box completion screen.

Monitoring effectiveness and keeping records AUSTRAC expects

AUSTRAC expects you to monitor the effectiveness of your training and check that people are retaining what they learn and applying it, which a completion certificate alone cannot show. A central training register should record completion dates, when further training is due, assessment results and any remedial action taken.

Practical ways to test effectiveness include:

• Scenario based quizzes tied to the designated services your firm actually provides
• File based reviews that check whether red flags were identified and escalated in practice
• Manager observation during live matters, with follow up training where gaps appear
• Refresher sessions triggered by policy changes, new services, reported incidents or audit findings

Scenario-based assessments tied to real file reviews show far more than certificates of attendance. Keep training records for the period the Act sets for program records, seven years after they stop being relevant (section 116), since AUSTRAC can ask for them well after the training took place.

Personnel due diligence and your compliance officer appointment

Personnel due diligence and training work as a pair: one control screens who holds a sensitive role, the other equips them to perform it properly, and your AML/CTF policies must deal with both. Under Rules 5-8, the policies must assess a person’s skills, knowledge and expertise for their AML/CTF responsibilities, and their integrity, both before and during their engagement (AUSTRAC’s personnel due diligence guidance). In practice, a firm should:

1. Identify which roles carry the highest ML/TF risk, including anyone who can authorise transactions, approve reporting or override controls
2. Check references, run police checks where appropriate, and verify claimed qualifications and prior compliance experience
3. Assess integrity factors relevant to the seniority and risk of the role
4. Record the decision, including what was checked and why the person was considered suitable
5. Set triggers for reassessment, such as a change of role, a conduct concern or a material change in responsibilities

No one should be assigned trust account duties, compliance officer responsibilities or other sensitive AML/CTF functions until personnel due diligence and role specific training are both complete.

How a compliance platform can operationalise your training

A guided platform can turn these separate duties into one linked workflow instead of three disconnected documents. Wizards that generate a risk assessment, AML/CTF policies and a training manual from the same answers keep all three consistent with each other, which is what a reviewer will look for.

Multilingual training modules with completion records give a compliance officer one place to see who has trained, on what, and when the next refresher is due. AML Guard’s 8-year tamper-evident audit trail, above the Act’s seven-year minimum, keeps training evidence alongside the rest of the compliance history rather than scattered across separate files.

Quick fixes law firms can make this week

Stop running one training module for the whole firm: map roles first, then tailor content to what each person actually does. Add short, file based scenarios for fee earners and record the assessment results, not just attendance. Put one person, usually the compliance officer, in charge of reviewing the training register every quarter.

AML Guard: training and records built for Tranche 2 law firms

Building a training program from scratch means juggling a risk assessment, a set of policies and a training manual that all need to agree with each other, then finding a way to prove it to a supervisor later. We built AML Guard so those pieces come from one guided process instead of three separate documents that drift apart over time.

For law practices, that means:

• Guided wizards that produce a risk assessment, AML/CTF policies and a training manual as one linked set
• Training modules with completion records your compliance officer can pull up on demand
• A governance dashboard showing who is trained, on what, and when the next session is due
• An 8-year tamper-evident audit trail that keeps training evidence alongside your other compliance records

If your practice is working out how training fits into a broader Tranche 2 program, you can see pricing for our plans or book a demo to see how the workflow applies to your own services and roles.

FAQ

Is AML/CTF training legally required for law firms?

Yes. Section 26F(4)(e) of the AML/CTF Act requires a practice’s AML/CTF policies to provide training for personnel whose functions are relevant to its obligations, and Rules 5-9 requires it to be initial and ongoing. Neither sets a fixed interval; frequency has to match the person’s role and risk exposure.

Does legal professional privilege excuse a firm from customer due diligence?

No. Privilege belongs to the client and does not displace customer due diligence. In reporting, the Act keeps the right to withhold privileged information: where some of the information for a suspicious matter report may be privileged, the report goes in with an LPP form, within 5 business days (24 hours where the suspicion relates to terrorism financing), and where all of the grounds for the suspicion are privileged, the firm may decline to report (section 41). AUSTRAC’s LPP guidance sets out the form.

What can staff not say if tipping off rules apply?

Section 123 makes it an offence to disclose that a suspicious matter report has been or must be given, or that AUSTRAC has issued certain notices, where the disclosure would or could reasonably be expected to prejudice an investigation. Staff should say nothing to the client about a report. Lawyers and qualified accountants have one specific exception: a good-faith disclosure made to dissuade a client from conduct that constitutes, or could constitute, an offence (section 123(4)); even then, AUSTRAC says not to disclose that an SMR exists. AUSTRAC’s tipping off guidance explains its limits.

Is giving legal advice alone a designated service?

Generally no. Advice alone typically falls outside the designated services that trigger AML/CTF obligations, though this depends on the specific work involved; check the AUSTRAC professional services guidance against your own services before relying on this as a general rule.

Where can a firm get customisable AML/CTF training templates?

AUSTRAC’s legal profession program starter kit is designed for small legal practices to customise. AML Guard also generates an aligned risk assessment, policy set and training manual from the same inputs, with multilingual training modules and completion records.

Sources

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
• Anti-Money Laundering and Counter-Terrorism Financing Rules 2025
• AML/CTF training | AUSTRAC
• Personnel due diligence | AUSTRAC
• Professional designated services | AUSTRAC
• Legal profession program starter kit | AUSTRAC
• Legal professional privilege | AUSTRAC
• Tipping off | AUSTRAC

Recommended

• Tranche 2 AML/CTF for Australian law firms
• AML training manual for Tranche 2 firms
• Tranche 2 AML Australia: your compliance obligations explained