AML/CTF Compliance Checklist for Australian Accountants
From July 1, 2026, accounting firms that provide designated services become reporting entities under Australia’s AML/CTF regime. That means real obligations, enforceable by AUSTRAC, with serious penalties for non-compliance.
This is not a checklist you can start the week before the deadline. Some of these obligations particularly developing your AML/CTF program and training your staff take weeks to implement properly. Below is a complete, breakdown of all 9 obligations your firm must meet, what each one requires in practice, and exactly what you need to do. Each item also notes where VERA — Nex Automate’s client verification automation tool directly handles the compliance work for you.
⚠️ Penalties for Non-Compliance
Individuals: Up to $6.6 million per contravention
Businesses: Up to $33 million per contravention
AUSTRAC can also cancel your registration, publicly name your firm, and refer matters to the Australian Federal Police. Non-compliance is not a minor administrative issue — it is a serious criminal and civil liability.
At a Glance: Your 9 AML/CTF Obligations
Use this table as a quick reference. The detailed breakdown for each item follows below.
| # | Obligation | When / Frequency |
|---|---|---|
| 1 | Enrol with AUSTRAC | By July 29, 2026 |
| 2 | Develop an AML/CTF Program | Before July 1, 2026 |
| 3 | Appoint a Compliance Officer | Before July 1, 2026 |
| 4 | Customer Due Diligence (CDD) | Every new client — before service |
| 5 | Enhanced Due Diligence (EDD) | High-risk clients — ongoing |
| 6 | Ongoing Monitoring | Continuous — all clients |
| 7 | Reporting to AUSTRAC | As required — no delay |
| 8 | Record Keeping | 7 years minimum |
| 9 | Staff Training | Before July 1, 2026 — then annually |
Don’t have time to build all of this from scratch?
VERA automates the client verification, AML screening, risk scoring, and document generation steps — the most time-consuming parts of your compliance program. Book a free 30-minute demo to see it in action.
👉 Book Your Free VERA DemoFull Checklist: 9 Obligations Explained
Enrol with AUSTRAC
✓ Create an AUSTRAC Online account at austrac.gov.au if you do not already have one.
✓ Complete the enrolment form with your business details, ABN, and the designated services you provide.
✓ Enrol by July 29, 2026 at the latest, within 28 days of July 1 — note that enrolment opened March 31, 2026.
✓ Keep your enrolment details up to date — you must notify AUSTRAC within 14 days of any material changes.
Develop an AML/CTF Program
✓ Conduct a money laundering and terrorism financing risk assessment for your practice — covering your client base, services, delivery channels, and geographies.
✓ Document your AML/CTF policies, procedures, and internal controls in a written program.
✓ Ensure the program covers: customer due diligence, ongoing monitoring, reporting, record keeping, and staff training.
✓ Appoint a senior person to own and oversee the program.
✓ Review and update the program at least every 3 years — and whenever your business model or risk profile changes significantly.
✓ For smaller practices, 15 or fewer staff, professional services only, AUSTRAC’s Accounting Program Starter Kit provides a template to build from.
Appoint an AML/CTF Compliance Officer
✓ Nominate a compliance officer from within your firm — this can be a principal, partner, or senior manager.
✓ Ensure they have sufficient authority, resources, and access to information to perform their role.
✓ The compliance officer must understand the requirements of the AML/CTF Act and your firm’s specific obligations.
✓ Document the appointment formally as part of your AML/CTF program.
✓ In smaller practices, the principal or sole practitioner will typically serve as their own compliance officer.
Customer Due Diligence (CDD)
✓ Verify the identity of every client before providing any designated service — not after.
✓ For individuals: collect full name, date of birth, and residential address. Verify using a government-issued photo ID, such as a passport or driver licence, plus a Face-ID biometric check.
✓ For companies and trusts: identify and verify the beneficial owners, being individuals who ultimately own or control 25% or more of the entity.
✓ Conduct AML/CTF screening against sanctions lists, including OFAC, UN, Australian sanctions, and Politically Exposed Persons, PEP, databases.
✓ Assign a risk rating to each client — low, medium, or high — based on their profile.
✓ Existing clients who receive new designated services may need to be re-verified.
⚡ VERA handles this: VERA automates the entire CDD process — Face-ID verification, document checks, sanctions screening, PEP screening, and risk scoring — reducing 30–45 minutes of manual work to approximately 3 minutes per client.
Enhanced Due Diligence (EDD)
✓ Apply EDD to any client identified as a Politically Exposed Person, PEP — a current or former senior government official, or their close associate or family member.
✓ Apply EDD to clients from high-risk countries identified by FATF or AUSTRAC guidance.
✓ Apply EDD when a client’s source of funds or wealth cannot be easily explained or verified.
✓ Apply EDD when a transaction appears unusual, complex, or inconsistent with the client’s known profile.
✓ Document your EDD process and the decisions made for each high-risk client in your records.
✓ Consider whether to continue or terminate the relationship if EDD cannot be completed satisfactorily.
⚡ VERA handles this: VERA’s risk scoring module automatically flags clients for EDD based on PEP status, sanctions hits, and risk profile — ensuring no high-risk client slips through your process.
Ongoing Monitoring
✓ Review client relationships periodically — the frequency should match their risk rating, with higher-risk clients reviewed more frequently.
✓ Monitor transactions and instructions for patterns inconsistent with what you know about the client.
✓ Re-verify clients when their circumstances change materially — such as new beneficial owners, change of jurisdiction, or a significant shift in transaction volume.
✓ Keep client information up to date — outdated information means you cannot effectively monitor the relationship.
✓ Document your monitoring activities and the outcomes of each review.
Reporting to AUSTRAC
✓ Submit a Suspicious Matter Report, SMR, as soon as practicable — and within 24 hours if terrorism financing is suspected — when you form a suspicion about a client or transaction.
✓ Submit a Threshold Transaction Report, TTR, within 10 business days for any physical cash transaction of $10,000 or more.
✓ Submit an International Funds Transfer Instruction, IFTI, report within 10 business days for relevant international transfers.
✓ Never tip off a client that you have submitted or are considering submitting a report — tipping off is itself a criminal offence.
✓ Keep records of all reports submitted and the basis for submitting them.
Record Keeping
✓ Retain all identity verification documents and records, including copies of IDs, Face-ID results, and screening reports, for a minimum of 7 years from the date of the transaction or end of the client relationship.
✓ Retain records of your AML/CTF risk assessments, due diligence decisions, and monitoring reviews.
✓ Retain records of all AUSTRAC reports submitted.
✓ Ensure records are stored securely and can be retrieved promptly if requested by AUSTRAC.
✓ Records must be in English or readily convertible to English.
⚡ VERA handles this: VERA automatically stores all client verification records, screening results, and audit trails — with timestamps and document copies — in a format ready for AUSTRAC review.
Staff Training
✓ Deliver AML/CTF training to all relevant staff before July 1, 2026.
✓ Training must cover: what money laundering and terrorism financing look like, your firm’s obligations under the AML/CTF Act, your internal procedures and policies, and how to escalate concerns.
✓ Repeat training at least annually — and when your program or AUSTRAC guidance changes significantly.
✓ Keep records of all training delivered, including dates, attendees, and the content covered.
✓ New staff must complete training before they begin working with clients on designated services.
How Long Does All of This Actually Take?
This is the question every practice principal is asking. The honest answer depends on your firm’s size and complexity but here is a realistic timeline for a mid-sized practice starting from scratch:
| Task | Manual effort | With VERA |
|---|---|---|
| Develop AML/CTF Program | 2–4 weeks | 2–4 weeks (VERA does not replace this) |
| AUSTRAC Enrolment | 1–2 hours | 1–2 hours |
| Appoint Compliance Officer | 1 day | 1 day |
| Client verification (per client) | 30–45 minutes | ~3 minutes |
| 100 clients verified | 50–75 hours | ~5 hours |
| Staff training | 1–2 days | 1–2 days |
| Records setup and storage | Ongoing manual | Automated — VERA stores all records |
Be Compliance-Ready Before July 1 — Without the Admin Burden
VERA automates client verification, AML/CTF screening, risk scoring, document generation, and record keeping. What takes 45 minutes manually takes 3 minutes with VERA. Deploys in 2 weeks. No lock-in contract. Book your free demonstration today.
👉 Book Your Free VERA DemoP.S. This checklist covers the obligations — but building your AML/CTF Program document is a separate exercise that takes weeks, not hours. If you have not started yet, start today. AUSTRAC’s Accounting Program Starter Kit, available at austrac.gov.au, is a good foundation for smaller practices. Larger firms should engage a compliance specialist.
About Nex Automate
Nex Automate is an Australian accounting automation platform built by accountants, for accountants. VERA is our AML/CTF client verification automation tool — designed specifically for accounting firms preparing for Tranche 2 compliance. VERA handles VOI checks, sanctions screening, PEP checks, risk scoring, engagement letter generation, and record keeping automatically.
Visit nexautomate.com.au
