# AML/CTF program outline (starting template) Prepared by InvestPass as a free starting outline. Reviewed 7 November 2026 (Australia/Sydney). > **Important.** General information, not legal advice. This outline is a starting point only. It is NOT a compliant AML/CTF program by itself, it is NOT approved or endorsed by AUSTRAC, and using it does not by itself meet your obligations. Start from the AUSTRAC program starter kit for your sector where one exists, adapt everything to your own business and risks, and have the final document reviewed by a qualified adviser. ## How to use this outline 1. Download the AUSTRAC program starter kit for your sector first: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/program-starter-kits 2. Use this outline as a checklist of topics and prompts while you adapt the official kit. 3. Replace every `[square bracket]` prompt with your own facts. Delete prompts that do not apply and explain why. 4. Base every control on your documented ML/TF risk assessment (section 2). 5. Have senior management approve the final version and record the date. 6. Diarise reviews (section 10). ## 1. About the business - Legal name, ABN, trading names: `[ ]` - The designated services you provide (scope is based on the services you provide, not your profession alone): `[list each designated service]` - Locations, staff numbers, delivery channels: `[ ]` - Date obligations began for your business and your AUSTRAC enrolment details: `[ ]` ## 2. ML/TF risk assessment - Summarise your documented risk assessment and where it is kept: `[ ]` - Risks considered: customer types, designated services, delivery channels, jurisdictions, and any other relevant factors. - Overall business risk and key risks: `[ ]` - When the assessment will be reviewed and what triggers an earlier review: `[ ]` Prompt: what could a criminal use your services for? Which customers or services worry you most, and why? ## 3. Governance and the AML/CTF compliance officer - Senior manager responsible for approving and overseeing the policies: `[name, role]` - AML/CTF compliance officer: `[name, role, date appointed]` - Their authority, independence, resources and reporting line: `[ ]` - How the board or owners receive compliance reports: `[ ]` ## 4. Personnel due diligence and training - Screening of staff in roles that could facilitate ML/TF: `[ ]` - Training content, frequency and who must complete it: `[ ]` - Where the training log is kept (see the InvestPass training log template): `[ ]` ## 5. Initial customer due diligence (CDD) Reflect AUSTRAC guidance. Initial CDD is generally completed before providing a designated service, subject to exceptions, delayed CDD in limited circumstances and transitional rules for existing customers. - How you establish the customer's identity: `[ ]` - How you identify beneficial owners (individuals who ultimately own 25% or more, or otherwise control the customer, noting control is not limited to a 25% test): `[ ]` - Persons acting on behalf of the customer and their authority; persons on whose behalf the service is received: `[ ]` - Nature and purpose of the business relationship or transaction: `[ ]` - PEP checks (customer, persons acting for them, beneficial owners, persons on whose behalf the service is received, including defined family members and close associates) and targeted financial sanctions checks: `[ ]` - Mandatory senior manager approval before providing or continuing a service in the PEP cases set out in AUSTRAC guidance (foreign PEPs, and domestic or international organisation PEPs where the customer is high risk, subject to the stated qualifications), plus any extra approvals your policies add: `[ ]` - Customer risk rating method: `[ ]` - Reliable and independent verification appropriate to the risk: `[ ]` - Enhanced CDD triggers, including source of funds and source of wealth for foreign PEPs and high risk domestic or international organisation PEPs: `[ ]` - What happens if CDD cannot be completed: `[ ]` Note: a digital identity check alone is not AML/CTF compliance. It is one part of CDD. ## 6. Ongoing CDD and monitoring - How you monitor customers and transactions for unusual activity: `[ ]` - When you update customer information and re-rate risk: `[ ]` ## 7. Reporting to AUSTRAC - Escalation path for staff who notice something unusual: `[ ]` - Who decides whether to lodge a suspicious matter report (SMR): `[ ]` - Threshold transaction reports (TTR) and any other reports that apply: `[ ]` - Tipping off controls: `[ ]` ## 8. Record keeping - Records kept, format and location: `[ ]` - Retention periods for each record type. For example, CDD records are generally kept for 7 years after the business relationship ends or after the last occasional transaction. Check the trigger for each other record type: `[ ]` ## 9. Third parties and reliance - Any providers you use (for example identity verification), what they do, and how you oversee them: `[ ]` ## 10. Review and independent evaluation - Review frequency and triggers: `[ ]` - Independent evaluation arrangements, where required: `[ ]` ## Approval - Approved by: `[name, role]` Date: `[ ]` Version: `[ ]` ## Sources - AUSTRAC, Politically exposed persons: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/politically-exposed-persons-pep - AUSTRAC, Enhanced customer due diligence: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/enhanced-customer-due-diligence - AUSTRAC, About the AML/CTF reforms: https://www.austrac.gov.au/industry-and-business/about-amlctf-reforms/about-reforms - AUSTRAC, Program starter kits: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/program-starter-kits - AUSTRAC, Overview of initial customer due diligence: https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/initial-customer-due-diligence/overview-initial-customer-due-diligence General information, not legal advice.