How often to review the AML/CTF program
How often you review the AML/CTF program is the cycle written in the program, plus an earlier look when the services, offices, or customer types change.
Quick answer
Put a review date in the program and keep it. Also review when you add a designated service, open another office, or take on a customer type you did not have. This page does not copy AUSTRAC’s step on program review and does not invent a statutory number of months. The senior manager signs the review; software does not.
People search “AML program review” when the program was approved last year and nobody has opened it since a new service was added. Checked against AUSTRAC’s AML/CTF program overview on 4 October 2026. This is general information, not legal advice. This page does not reproduce that guidance. What you write into the program is the AML/CTF program for Tranche 2. A change in customer risk over time is ongoing customer due diligence. The sector map is /tranche-2.
A diary date and a trigger
An AML program review is two habits, not one slogan. The diary habit is the date the program itself names. The trigger habit is an event that makes the old program untrue: a new designated service, a second office, a new customer type, or a risk you assessed and then ignored. Waiting for the diary while the firm has changed is how the document goes stale.
This page will not print a number of months and call it the law. If AUSTRAC’s program guidance states a period, read it there. The overview this article is checked against is not reproduced here. A small firm can keep the review short; it still needs a record of what was read, what changed, and who approved it.
- Use the program’s date. If the program says when you review, that is the diary. An unwritten annual intention is not a date.
- Review on a real change. A new service or a new office does not wait for the anniversary. Update the pages that are no longer true.
- Sign it. The senior manager approval is the review. A file left in a folder is a draft.
- Separate it from a customer review. Looking at one file is ongoing due diligence. Looking at the program is this page’s subject.
What the review is looking at
A small-firm review sort. This table does not reproduce AUSTRAC’s program overview.
| Trigger | What you reopen | What it is not |
|---|---|---|
| Diary date in the program | The whole program, at the level the program describes | A new program bought off the shelf |
| New designated service | The services list and the customer types | A silent edit nobody approved |
| New office | Whose records you can see, and who covers the officer role | An assumption that head office is enough |
| One odd customer | That file, under ongoing due diligence | A rewrite of the program for a single matter |
Where this page stops
This page is the review habit. It is not the risk assessment method. How a firm starts that assessment is the risk assessment quick start.
What the client pays
On FreeAML the firm suite is A$0. The firm emails the client a link. Verification is client-pays. On the public list a personal KYC check is A$20 and a company or trust KYB check is A$40. Use KYB when the customer is a company or a trust. A program review is not included in the firm suite, and it is not a KYC or KYB check. Confirm the live amounts on FreeAML pricing. FreeAML does not set your review date or approve the review.
📚 Related Resources
Free KYC Check →
Verify customer identity in 60 seconds. Government ID + AML screening.
Free AML Program →
Board-ready AML/CTF Program template. All 10 AUSTRAC sections included.
Risk Assessment Generator →
AI-powered ML/TF risk assessment. 20-page compliant report in 5 minutes.
Free AML Training →
Online courses for staff. CPD-certified certificates included.
AUSTRAC Reporting Tools →
File SMRs, TTRs, IFTIs directly to AUSTRAC. Pre-filled forms.
Frequently Asked Questions
The program is the firm’s. The check is the client’s.
The firm suite is A$0. The client pays a check the approved program requires.
Open the Tranche 2 guideQuestions: team@freeaml.com.au