Which AML/CTF program template should you use in 2026?

Use an official AUSTRAC program starter kit as your authoritative Australian template, then customise it against your own ML/TF risk assessment. Do not lodge or operate a starter kit unchanged.

Three facts govern this decision:

• AUSTRAC’s starter kits are the only free, government-issued Australian templates built for the standard program requirement in s.84 of the AML/CTF Act.
• The 2024 Amendment Act scrapped the old prescriptive Part A/Part B split in favour of one outcomes-focused, risk-based document.
• A template only satisfies AUSTRAC if it’s tailored, approved by senior management, and demonstrably in use. Platforms like AML Guard exist to make that last part provable.

Key Takeaways

A compliant AML/CTF program starts with an AUSTRAC starter kit customised against your own risk assessment, then becomes real only once it’s embedded into daily workflows and provable through records.

Table of Contents

• Where to find AUSTRAC starter kits and other Australian templates
• How do you customise a starter kit into a working program?
• What must the program actually contain?
• A template structure you can build from today
• Building a realistic implementation timeline
• What actually makes a template fail in practice
• Turning your program document into working controls
• Sources

Where to find AUSTRAC starter kits and other Australian templates

AUSTRAC publishes sector-specific starter kits for accountants, real estate agents, conveyancers, and legal practitioners, each built around the same statutory skeleton but weighted toward that sector’s designated services. Every kit bundles a policy template, a risk assessment worksheet, and customer due diligence appendices covering identity verification and record-keeping.

Worth pairing with the official kits:

• The real estate program starter kit, which walks through document customisation specific to property transactions.
• Sector project plans from professional bodies, such as the Chartered Accountants ANZ project plan, which sets realistic milestones firms can scale down.
• A plain-English explainer if your team needs the concepts unpacked before diving into what an AML/CTF program actually requires in a property context.

None of these replace legal advice for complex structures, but together they give a reporting entity everything needed to draft a defensible first version.

How do you customise a starter kit into a working program?

Turning a downloaded template into an operational document is a project, not a copy-paste exercise. Follow this sequence:

1. Map your designated services. List every Table 5 or Table 6 service you provide and how you deliver it (in person, online, via a portal), then align each starter kit section to that list.
2. Run the ML/TF risk assessment first. Everything downstream, your CDD thresholds, enhanced due diligence (EDD) triggers, and monitoring rules, should trace back to specific findings in that assessment.
3. Assign ownership and get sign-off. Name your AML/CTF compliance officer, brief senior management, and record their formal approval of the finished document.
4. Embed procedures into daily workflows. Build the CDD steps into onboarding, not just into a PDF nobody opens after week one.
5. Keep a version log. Record every amendment, who approved it, and why, alongside training completion records for staff who work under the program.

Pro Tip: Keep a one-page “evidence trail” spreadsheet that links every policy clause back to the risk assessment finding that justifies it. When AUSTRAC or an independent reviewer asks why a control exists, you point to a row, not a memory.

What must the program actually contain?

AUSTRAC’s guidance on developing an AML/CTF program sets out the non-negotiable components, and the amended framework expects them written as one integrated document rather than split across legacy parts.

ML/TF risk assessment. Document the scope of your business, the likelihood and impact of money laundering and terrorism financing across your customer types, delivery channels, and jurisdictions, and set a review trigger (new service line, new customer segment, regulatory change) rather than a fixed annual date alone.

Governance and oversight. The board or senior management must approve the program and understand their obligations under it. The AML/CTF compliance officer needs a documented mandate: what they can decide alone, and what needs escalation.

Customer due diligence and reporting. This covers identity verification standards, beneficial ownership tracing for companies, trusts and SMSFs, politically exposed person (PEP) screening, and the workflow for lodging a suspicious matter report when something doesn’t check out.

Monitoring, records, and review. AUSTRAC expects ongoing transaction monitoring tuned to your risk assessment, a seven-year record-keeping standard, and periodic independent review of the whole program’s effectiveness.

Every one of these controls should cite the risk assessment finding it responds to. A CDD threshold with no risk rationale behind it is exactly the kind of gap an independent reviewer flags first.

A template structure you can build from today

Rather than retaining the old Part A/Part B labelling, structure your program as one integrated document under these headings:

• Executive summary and program governance
• ML/TF risk assessment (methodology, findings, review schedule)
• AML/CTF policies and procedures (CDD, EDD triggers, escalation paths)
• Customer due diligence appendix (verification standards, beneficial ownership evidence)
• Monitoring and reporting workflow (suspicious matter reports, threshold transaction reports)
• Training register and record-keeping schedule
• Audit history and independent review log

If your existing program still runs the legacy Part A/Part B split, you don’t need to rewrite it overnight, but new content should be drafted against this integrated structure so the transition is straightforward when you next revise it. AUSTRAC’s Tranche 2 document guidance is a useful reference point for what a finished set of documents looks like in practice.

Sense-check each section against this short list before calling the document final:

• Does every policy clause reference a risk assessment finding?
• Is the compliance officer named and their authority documented?
• Are CDD and beneficial ownership standards specific enough for staff to apply without guessing?
• Is there a dated approval from senior management?
• Are training records and version history stored somewhere retrievable in seven years?

Building a realistic implementation timeline

A template is only as good as the project plan behind it. Professional bodies including Chartered Accountants ANZ have published realistic project plans with milestones that smaller firms can scale down without losing rigour.

1. Weeks 0 to 2: Scope your designated services and appoint your compliance officer.
2. Weeks 2 to 6: Complete the risk assessment and draft policies against it.
3. Weeks 6 to 10: Configure systems, train staff, and set up record-keeping.
4. Weeks 10 to 14: Run an independent review and secure board approval.

Data gaps are the most common cause of delay. If you can’t pull a clean list of customer types or transaction volumes in week one, fix that before drafting a single policy clause.

What actually makes a template fail in practice

Most programs don’t fail on paper, they fail in the drawer. A beautifully worded risk assessment means nothing if the person onboarding a trust client has never seen it and can’t name a beneficial ownership trigger when one appears.

The pattern repeats across property, legal, and accounting files: a template gets approved, then operational reality drifts from it within months. Beneficial ownership evidence for trusts is a frequent failure point, since discretionary trusts and SMSFs rarely present a tidy ownership chain, and enhanced due diligence triggers in property transactions get missed when nobody’s watching for cash-heavy buyers or rushed settlements. Status flags synced to the systems your team already uses, and a tamper-evident audit trail that survives an independent review, close that gap far better than a document sitting in a shared drive.

Turning your program document into working controls

AUSTRAC starter kits give you the words. Making those words operational, verified identities, screened beneficial owners, logged suspicious matter reports, is a separate job, and it’s the one most firms underestimate.

AML Guard is built to close that gap for Australian Tranche 2 reporting entities. Guided wizards produce all four program artefacts as one linked set rather than four separate documents: the business-wide ML/TF risk assessment, the AML/CTF policies, the compliance action plan, and the staff training manual. Because they are generated from the same answers, the policies match the risk assessment and the training manual matches the policies, which is the internal consistency a supervisor checks and the one thing a downloaded template cannot give you. Around them, identity verification, PEP and sanctions screening, and beneficial ownership tracing across companies, trusts and SMSFs run against every customer, not just the ones someone remembers to check.

Status indicators sync to REX CRM so your team sees compliance progress against a listing without duplicating data entry, and a client-pays option lets a transaction party fund their own verification, with the fee credited back against your subscription. Multilingual training records and a seven-year tamper-evident audit trail mean an independent reviewer gets a complete evidence trail instead of a folder of loose documents. There’s no self-service sign-up: firms start by booking a demo so their tenant can be configured to their actual designated services and risk profile.

Sources

• Changes to AML/CTF program requirements — Home Affairs (Australia)
• Anti‑Money Laundering and Counter‑Terrorism Financing Act 2006 — s.84
• AML/CTF Program project plan (AU) for professional accountants — Chartered Accountants ANZ

Recommended

• AML/CTF Program Documents for Tranche 2 | AML Guard
• What Is an AML/CTF Program? A Plain-English Guide for Property Professionals | AML Guard
• AML/CTF Staff Training for Tranche 2 | AML Guard
• AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026 | AML Guard