AML audit trail: prove who, what, when and why

An AML audit trail should let a reviewer reconstruct who made each compliance decision, what information they relied on, when they acted, and why they reached that conclusion. This includes how every screening match was resolved, what triggered enhanced due diligence, and any override of a standard control. Section 111 of the AML/CTF Act 2006 (Cth) is the baseline: customer due diligence records must include any analysis, risk assessment or decision-making about the customer, and they are kept for seven years after the business relationship ends or the occasional transaction is completed.

TL;DR:

• Every decision should name the officer, timestamp, evidence reviewed, and rationale, with screening resolutions and control overrides documented beside the determination.
• Tamper-evident storage makes edits detectable and attributable, not impossible; keep records for the periods the Act sets (seven years, from different starting points) and preserve version and access logs.
• Document suspicious matter reporting decisions promptly: reports are due within 24 hours for terrorism financing suspicions and three business days for other suspicions.
• One workable review rhythm: sample recently closed alerts weekly or fortnightly, audit high-risk and enhanced due diligence files quarterly, and record who checked each file and what they found.
• Make transaction records at the time, not retrospectively, and link alerts through escalation and final rationale to the related transaction and any reporting decision.

Table of Contents

• Legal requirements and where the evidence obligation comes from
• What to capture: who, what, when and why in every record
• Retention, storage and what “tamper-evident” actually means
• A checklist for making your audit trail defensible
• What a complete record looks like in practice
• Evidencing alert reviews and SMR timing
• How a compliance platform can preserve this trail
• How often should you review your audit trail
• Why audit trails matter in a regulatory examination
• Blockchain, AI and the shape of the audit trail ahead
• Common deficiencies and what they teach
• Practical priorities when defending an audit
• Making your records audit-ready with AML Guard
• FAQ
• Sources

Legal requirements and where the evidence obligation comes from

Section 111 of the Act requires that customer due diligence records include any analysis, risk assessment or decision-making about the customer. That single provision is the reason an audit trail exists at all: it is not enough to have made the right call on a customer, you need a record showing how you got there. AUSTRAC’s record keeping guidance covers AML/CTF program records, CDD records and transaction records, and asks you to keep the records reasonably necessary to demonstrate compliance.

In practice, the records a reviewer expects to see fall into a few groups:

• Program-level records: the risk assessment, policy versions and any changes made to them over time.
• Customer due diligence files: identity verification outputs, beneficial ownership findings and screening results.
• Transaction records tied to each designated service provided.
• Internal reporting logs, meeting notes and training records that support the broader program.

What matters is reconstruction, not volume. A thin file that clearly shows the reasoning behind a decision serves a reviewer better than a thick one that only shows the outcome.

What to capture: who, what, when and why in every record

Every entry in your audit trail should answer four questions on its own, without needing a conversation with the staff member who created it. That means recording the identity of the person who acted, the documents or data they reviewed, the timestamp of the action, and the reasoning behind the decision they made.

1. Program records: version history of the risk assessment and policies, with the officer who approved each change.
2. CDD files: identity verification results, beneficial ownership findings, and the screening outputs considered at onboarding.
3. Transaction records: amounts, parties, dates and the designated service involved.
4. Monitoring logs: alerts generated, who reviewed them and the outcome.
5. SMR registers: the suspicion formed, who formed it, and when it was reported or why it was not.

Beneath each of these, preserve the supporting metadata: screening match identifiers and how each was resolved, the documents reviewed at the point of decision, and any note explaining an override of a standard rule.

Pro Tip: Record the reasoning in the same place as the decision, not in a separate email thread that will not survive a staff departure.

Retention, storage and what “tamper-evident” actually means

The Act sets seven-year retention periods for AML/CTF records, running from different starting points for different records. We cover the mechanics in our separate explainer on the seven-year clocks, so this article stays on the evidence itself rather than the timing.

“Tamper-evident” is not the same claim as “tamper-proof”. A tamper-evident system means any change to a record is detectable and attributable: it does not mean a change is impossible. That distinction matters when a reviewer asks whether a file could have been altered after the fact without anyone knowing.

A defensible storage approach typically includes:

• Immutable or append-only logs rather than editable fields.
• Write-once storage for finalised determinations.
• Version history showing every edit and who made it.
• Access logs showing who viewed or exported a record and when.

One structural fact worth noting: for suspicious matter reporting, AUSTRAC’s record keeping guidance lists internal escalation records, case files or audit trails, records of when a matter was first identified and when the suspicion was formed, and meeting notes, emails or system notes showing review outcomes and the rationale for decisions. That is a broader set than many firms assume.

A checklist for making your audit trail defensible

Four areas tend to separate audit trails that hold up under review from those that do not.

1. Policy and ownership: name the officer responsible for approving each type of determination, and gate CDD progression on that approval being recorded.
2. Process controls: make the transaction record at the time, not retrospectively, and timestamp every screening and escalation step as it happens.
3. Escalation discipline: when a match or an unusual pattern is escalated, record who escalated it, who reviewed it next, and the outcome.
4. Training and assurance: keep completion records for staff training, and run periodic internal reviews to test whether your files would survive external scrutiny.

Pro Tip: Run a mock file review on your highest-risk customer once a quarter. If your own compliance officer cannot reconstruct the decision from the file alone, nor could an auditor.

Our checklist for Tranche 2 entities preparing their programs walks through these controls in more detail for firms building a program from scratch.

What a complete record looks like in practice

A transaction record and an SMR decision trail are two of the most commonly requested files in a review, and both reward a consistent template.

• The alert that triggered a review, with its timestamp and the rule that fired it.
• The reviewer’s notes explaining what they checked and what they concluded.
• The escalation record, if one occurred, naming the next reviewer and their decision.
• The final rationale, stating either the SMR reference or why no report was lodged.

Each field exists to answer a specific question an auditor will ask: who looked at this, what did they see, and does the decision match the evidence in front of them.

Evidencing alert reviews and SMR timing

Record the alert itself, how it was reviewed, the steps taken and the rationale for your decision, including a decision not to submit an SMR. Where a suspicion is formed, section 41 of the Act and AUSTRAC’s SMR guidance set fixed timeframes: 24 hours where the suspicion relates to terrorism financing, and three business days for other suspicions. Your records need to support that you met those windows, not just that you eventually reported.

Keep the following close together, ideally in one case file:

• The alert log entry and the rule or pattern that triggered it.
• Review notes, including who looked at the alert and what they checked.
• Escalation records showing who the matter was passed to and when.
• The final decision, with the reviewer’s name and the reasoning behind it.

Linking each transaction record to its related SMR submission, or to the note explaining why none was filed, closes the loop an auditor will follow from alert to outcome. Our guide to SMR timing and record-keeping for Tranche 2 firms goes further into the reporting workflow itself.

How a compliance platform can preserve this trail

A platform built for Tranche 2 obligations should capture officer approvals against each determination, keep the program artefacts (risk assessment, policies, training records) linked to each other, and store identity verification and screening outputs alongside the decision they informed. Property firms commissioning their own software face the same design questions, which this Real Estate App Development Guide approaches from the build side.

• Officer approval recorded against each CDD determination before the service proceeds.
• Program documents linked so a policy change is traceable to the risk assessment that prompted it.
• Screening and verification outputs stored with the file, not in a separate system.
• Only status metadata pushed into a CRM, with CDD detail held in a secure vault.

Pro Tip: If a platform pushes full CDD data into your CRM, that is a second copy of sensitive evidence to secure and reconcile, not a convenience.

We built AML Guard around this principle: an 8-year tamper-evident audit trail, above the Act’s seven-year minimum, with an officer’s approval recorded against each determination before it takes effect. You can see how that trail sits alongside program documents and screening logs in our guide to the governance dashboard.

How often should you review your audit trail

An audit trail is only as useful as the review process built around it. A file that sits untouched between onboarding and a regulatory request is a file nobody has tested, and the first time you find a gap should not be when AUSTRAC asks for it.

A practical review rhythm has three layers. First, ongoing spot checks: a sample of recently closed alerts reviewed weekly or fortnightly by someone other than the original reviewer, to confirm the reasoning on file would make sense to a stranger. Second, a periodic file audit, quarterly for example, covering higher-risk customers and any enhanced due diligence triggers, checking that escalation notes, screening resolutions and overrides are all present and dated. Third, an annual or program-cycle review that looks at the audit trail as a system: are staff recording decisions consistently, are approvals being captured before services proceed, and has the storage method held up without gaps.

The frequency should scale with risk. A firm handling a small number of standard customers each month can run a lighter review cycle than one processing high-risk or enhanced CDD files regularly. What matters is that the review itself is documented: who ran it, what they checked, and what they found. A review process with no record of its own findings does not help you when a regulator asks how you monitor your own compliance.

Why audit trails matter in a regulatory examination

When AUSTRAC asks for records, or requires an external audit, the audit trail is the primary evidence a reviewer works from. A policy document says what your program will do. The audit trail shows what actually happened.

In an enforcement context, the absence of a clear rationale on file is likely to be viewed differently from a wrong decision made for a documented reason. A firm that screened a customer, found a partial match, investigated it and recorded why it was resolved as a false positive has demonstrated a working control, even if a regulator would have made a different call. A firm that closed the same alert with no note at all has demonstrated nothing, regardless of the outcome.

The records are how your program is tested, not a filing obligation that sits beside it. A reporting entity preparing for a request gains more from tidying its decision trail on a handful of higher-risk files than from any other single action.

Blockchain, AI and the shape of the audit trail ahead

Two technology shifts are changing what an audit trail can look like, without changing what it must prove. Blockchain and distributed ledger approaches offer a structurally tamper-evident record: once an entry is written, altering it leaves a detectable trace across the chain rather than a quiet edit in a single database. That property suits audit trails well, though it does not replace the need for a human-readable rationale attached to each entry. A ledger can prove a record was not altered. It cannot explain why a compliance officer closed an alert the way they did.

Artificial intelligence is doing more of the pattern detection that generates alerts in the first place, flagging unusual transaction behaviour faster than manual review could manage. That shifts more weight onto the documentation step that follows: if a system increases the volume of alerts a team sees, the rationale behind each review decision becomes more important, not less, because a regulator will want to see that genuine judgement was applied rather than an automated signal rubber-stamped without scrutiny.

Neither development changes the statutory test. AUSTRAC does not require a particular system, format or piece of software, and no technology choice substitutes for recording who acted, what they saw, and why. The firms that benefit most from these tools are the ones that use them to produce clearer evidence, not just faster decisions.

Common deficiencies and what they teach

The audit trail gaps that repeatedly cause problems are rarely exotic. They tend to be ordinary lapses, repeated often enough to undermine a program.

The most common is a decision with no rationale attached: an alert marked “reviewed, no action” with nothing explaining what was checked or why it was dismissed. The second is inconsistency between the risk assessment and the policy that is supposed to implement it, which signals to a reviewer that the two documents were written separately rather than developed from the same analysis. The third is a transaction record created after the fact, reconstructed from memory once a request for information arrives, which is difficult to distinguish from a record that never existed in the first place.

A fourth pattern worth naming is the override with no trace: a standard control bypassed for a particular customer, with the exception never logged anywhere a reviewer would find it. Monitoring is not the same as alerting: and the documentation of review and escalation is what demonstrates the obligation has actually been met, not just that a system generated a flag.

The lesson across all four is consistent. A compliance program is judged on what can be reconstructed after the fact, and a gap in the record reads the same to a reviewer as a gap in the control itself, whether or not that is a fair reading of what actually happened.

Practical priorities when defending an audit

If we had to name the one habit that separates audit trails that hold up from those that do not, it is this: write the reasoning down at the moment of decision, not afterwards. A reviewer can forgive a judgement call they disagree with. A missing rationale looks the same as no judgement at all.

Prioritise your highest-risk files first when tidying records, since that is where a reviewer will spend most of their time. Small governance habits, consistent timestamps, named approvers, a one-line reason for every override, do more for defensibility than any new system on its own.

Making your records audit-ready with AML Guard

We developed a platform for Tranche 2 reporting entities who need their decisions evidenced, not just made correctly. Every determination carries an officer’s approval before it proceeds, and the program artefacts, risk assessment, policies, training records, stay linked so a reviewer can trace one back to the other.

• An 8-year tamper-evident audit trail, above the Act’s seven-year minimum.
• Officer approval recorded against each CDD and enhanced CDD determination.
• Screening outputs and resolution notes stored with the file they relate to.

If your current setup leaves you reconstructing decisions from memory or scattered emails, book a demo to see how the workflow fits your existing process, or review plan details on our pricing page.

FAQ

What is an audit trail?

An audit trail is the full set of records showing who took an action, what information they relied on, when they acted and why, so that a decision can be reconstructed after the fact. In AML compliance, it covers program decisions, customer due diligence files, transaction records and the review of any alerts raised.

Is an audit trail mandatory?

The Act does not use the term, but section 111 requires CDD records to include any analysis, risk assessment or decision-making about the customer, and AUSTRAC asks for the records reasonably necessary to demonstrate compliance. In practice that is an audit trail. No particular system or format is required.

Can you give me an example of an audit trail?

A typical example is a transaction record showing the parties, date and designated service, paired with a case file showing the alert it triggered, the reviewer’s notes, any escalation and the final decision with its rationale. Each entry should name who acted and when, so a reviewer can follow the file from alert to outcome.

How does an audit trail work?

It works by capturing every step of a decision as it happens, rather than reconstructing it later: an officer reviews information, records what they saw and why they decided as they did, and that entry becomes part of a retained, tamper-evident record. Changes to the record remain detectable and attributable, which is what makes the trail reliable for a later review.

What does AML Guard provide for audit trail evidence?

AML Guard retains an 8-year tamper-evident audit trail, above the Act’s seven-year minimum, with an officer’s approval recorded against each determination before it takes effect. Program documents, CDD files and screening outputs stay linked within the same record set.

Sources

• Record keeping overview | AUSTRAC
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
• Suspicious matter reports | AUSTRAC

Recommended

• Audit-ready AML files for an AUSTRAC request
• AML record keeping: the seven-year clocks
• AML/CTF Program Documents for Tranche 2
• AUSTRAC penalties 2026: how enforcement works