What Tranche 2 firms must put in the AML/CTF program
An AML/CTF program is what you can show in writing before a designated service starts. The starter kit is the official draft, not the finished program.
Quick answer
An AML/CTF program is the written pack a Tranche 2 firm has in place before it provides a designated service: a money-laundering risk assessment, and the policies that manage it. A starter kit is AUSTRAC’s starting point. It is not the finished program.
People search “aml ctf program” looking for a template they can file. AUSTRAC’s program overview says the program must include both the risk assessment and the AML/CTF policies, documented before you start providing a designated service, and approved by a senior manager. This page is the writing list for a new reporting entity. It is general information, not legal advice, and it does not replace that overview. Who the reforms cover is on /tranche-2.
Put these in writing
The pre-reform habit was to split a program into Part A and Part B. AUSTRAC’s current overview is a single program built from the risk assessment and the policies. Write to that shape. Step 3 of AUSTRAC’s program guidance is where the policy list lives. In practice a small firm’s document needs six blocks a reviewer can find.
What the writing has to cover. The how-to stays on AUSTRAC.
| Block | What “written” means | Official page |
|---|---|---|
| Governance | Who oversees the program, who the compliance officer is, and which senior manager approves it | Compliance officer |
| Risk | The money-laundering, terrorism-financing, and proliferation risks of your services, customers, and delivery channels, and why you rated them | Program overview |
| Customer due diligence | Initial and ongoing checks, when enhanced steps apply, PEP and sanctions, and when you will not start the service | Initial CDD overview |
| Reporting | How staff escalate a suspicious matter, how you avoid tipping off, when a cash threshold report applies, and who signs the annual compliance report | Suspicious matter reports |
| Training | Who is trained, on what, how often, and where the completion register lives | AML/CTF training |
| Review | The triggers that make you update the program, the independent evaluation, and the records you keep | Independent evaluation |
AUSTRAC’s policies guidance expects you to review and update when triggers hit and, in any case, on a cycle that does not stretch past three years, and to have the program independently evaluated. Do not paste a review date you will not keep. Name the trigger: a new service, a new channel, a control that failed, or a change in who you act for.
A starter kit is not the finished program
AUSTRAC publishes program starter kits for eligible accounting, conveyancing, legal, real estate, and dealer businesses. The real estate kit’s “use your program” step is a good picture of the tone: official, practical, and still yours after you edit it. The kit tells you to customise it to the services you provide. A downloaded kit with the firm’s name on the cover is not approval, and it is not evidence you followed it.
On this site, AML program starter kits points at those official kits, and the free program template is a drafting aid. Neither page is your program. If a sentence in a template does not match your services, delete it. AUSTRAC owns the how-to. You own the document that describes this firm.
Reporting belongs in the same document
A program that stops at identity is incomplete. Write who may form a suspicion, how fast it reaches the compliance officer, and how you lodge a suspicious matter report without telling the customer. Threshold reports matter if you deal in physical currency at or above the amount AUSTRAC publishes. Many professional firms rarely see that cash. Say so, and say what you would do if you did. The annual compliance report needs an owner and a date. AUSTRAC’s reporting section is the procedure. Your document is the local version: names, inboxes, and the escalate path from AML training for non-specialists.
FreeAML is the evidence layer, not the program
When the written program says a customer must be checked, the firm sends the request by email from the FreeAML suite. The firm suite is A$0. Verification is client-pays. Amounts are on FreeAML pricing. Training completion in the same suite is the sign-off the firm files. That is operations evidence: the check, the risk note, the training attestation.
It is not the program. FreeAML does not approve the document, appoint your compliance officer, tell AUSTRAC you have enrolled, or lodge reports for you. If you need the scope of the check itself, use what an AML check covers. If you are still unsure the matter is in, use the designated services decision tree and then get advice.
📚 Related Resources
Free KYC Check →
Verify customer identity in 60 seconds. Government ID + AML screening.
Free AML Program →
Board-ready AML/CTF Program template. All 10 AUSTRAC sections included.
Risk Assessment Generator →
AI-powered ML/TF risk assessment. 20-page compliant report in 5 minutes.
Free AML Training →
Online courses for staff. CPD-certified certificates included.
AUSTRAC Reporting Tools →
File SMRs, TTRs, IFTIs directly to AUSTRAC. Pre-filled forms.
Frequently Asked Questions
Keep the program and the check apart
Write the program with AUSTRAC’s guidance. Use FreeAML for the client-pays check. The firm suite is A$0.
View pricingQuestions: team@freeaml.com.au