If the AML provider is down, the deadline still runs

People ask for a backup plan after a colleague cannot log in on the morning a suspicion is formed. Checked against AUSTRAC's suspicious matter reporting obligations on 5 October 2026. This is general information, not legal advice. This page does not reproduce that guidance. How to lodge is the SMR filing guide. What the report is for under the new services is suspicious matter reports for Tranche 2. Enrolment, which is a separate login, is enrol within 28 days. The sector map is /tranche-2.

The clock belongs to the suspicion, not the vendor

AUSTRAC says you submit a suspicious matter report within 24 hours of forming the suspicion if it relates to terrorism financing, and within 3 business days after the day you formed the suspicion for other suspicions. Where you claim the report includes information protected by legal professional privilege, other suspicions can be submitted up to 5 business days after the day you form the suspicion. That longer period does not apply to a terrorism-financing suspicion. You do not need to be certain a crime has occurred. You do need a way to lodge when the commercial platform you prefer is showing an error.

AUSTRAC Online is the channel for that lodgement. It is not the same website as an AML software vendor. A firm that has only ever clicked “submit” inside a vendor screen should still know the AUSTRAC Online username, who can reset it, and where the draft facts are written down so they can be typed again. The officer's name belongs in the program for this reason. A backup plan that says “call the vendor” is not a plan on the day their status page is red, Email the vendor if you need them. Lodge with AUSTRAC yourself if the deadline is the thing that matters today.

What to keep when the login works

• The current program, outside the vendor. A PDF or a document the officer can open if the site does not load. Date it. Do not leave the only copy in a tool you might leave.
• The AUSTRAC Online arrangement. Who has access, who covers leave, and where the enrolment details are. Updating enrolment details has its own 14-day rule when they change.
• Customer due diligence results you must retain. Export them on a schedule you actually do. A result trapped in a lapsed subscription is a record you cannot show.
• A second way to send a check. If verification is an emailed link, a second mailbox and a written step is the backup. You do not need a second annual contract to have that step.
• A note of the suspicion. The facts, the time you formed the view, and who else in the firm knows. That note is what you type into AUSTRAC Online if the vendor form will not open.

Pay-per-check changes the backup, not the duty

A subscription platform often holds the program, the training record and the check in one tenant. If that tenant is down, or if you stop paying, you feel the loss all at once. A pay-per-check arrangement is narrower. FreeAML emails a link and returns a result. It does not hold your program and it does not lodge your reports. That is a smaller outage, not a reason to skip the export. The program is still yours. The suspicion is still yours. AUSTRAC Online is still the place the report goes.

Write the backup as five lines in the program: where the program is stored, who the officer is, who can lodge, how a check link is sent if the usual screen fails, and where yesterday's results were exported. Review it when you review the program. A plan that has never been read by the person who would use it is a plan you do not have.

Where this page stops

This page is the outage. It is not how to decide that a matter is suspicious. What you must not tell the client is tipping off.

What the client pays

On FreeAML the firm suite is A$0. The firm emails the client a link. Verification is client-pays. On the public list a personal KYC check is A$20 and a company or trust KYB check is A$40. There is no subscription. Confirm the live amounts on FreeAML pricing. FreeAML does not operate AUSTRAC Online for you and does not insure a third party's uptime. The check, when you send it, is client-pays.

Frequently Asked Questions