What Is an AML/CTF Program — and Do I Actually Need One?

If you've been hearing about AUSTRAC Tranche 2 and aren't sure what an AML/CTF program actually is — or whether your business needs one — this guide explains everything in plain English.

No legal jargon. Just what you need to know before 1 July 2026.

What Does AML/CTF Stand For?

AML = Anti-Money Laundering. CTF = Counter-Terrorism Financing.

An AML/CTF program is a documented set of policies, procedures and controls that your business puts in place to prevent criminals from using your services to launder money or finance terrorism. It's not about assuming your clients are criminals — it's about having systems that would detect and report suspicious behaviour if it occurred.

Why Does My Business Need One?

From 1 July 2026, Australian law requires all businesses providing certain "designated services" to have an AML/CTF program in place. This is a legal obligation — not optional best practice.

The businesses now required to have a program include accountants, lawyers, real estate agents, conveyancers, and other professional service providers who assist clients with financial transactions, property dealings or business structures.

What Does an AML/CTF Program Actually Include?

AUSTRAC requires your program to have two parts:

Part A — Governance: How your business manages AML/CTF risk. Who is responsible, how the program is overseen, and how it's reviewed and updated.
Part B — Customer Due Diligence: How you identify and verify your clients before providing services. Who needs enhanced checks and what triggers a suspicious matter report.

Beyond the two-part program, you also need:

A risk assessment specific to your business and client types
A nominated AML/CTF Compliance Officer
Staff training — all relevant staff must complete it and records must be kept
A process for reporting suspicious matters to AUSTRAC
Record keeping for 7 years minimum

How Long Does It Take to Build?

For a small-to-medium professional services firm, building a compliant AML/CTF program from scratch takes significant time if you do it yourself — reviewing AUSTRAC guidance, customising templates, training staff, and enrolling with AUSTRAC.

The good news: Stratos AI builds the entire program for you. We use AUSTRAC's own Starter Kit as the foundation, customise it to your specific firm, and review it with a CPA lens — so you get a program that actually holds up, not just a template with your name on it.

What Happens If I Don't Have One by 1 July?

Operating a designated service without a compliant AML/CTF program after 1 July 2026 is a contravention of the Act. Civil penalties can reach $33.5 million per breach for companies, with personal liability for directors and responsible officers. AUSTRAC also publishes enforcement actions — meaning your professional body and clients can see them.

The Bottom Line

If your business provides designated services — and the definition is broader than most people assume — you need an AML/CTF program in place by 1 July 2026. The time to act is now, not next month.

Stratos AI makes it straightforward. A free 30-minute assessment tells you exactly where you stand — and whether you need a program at all. If you do, we build it for you. $2,500, all-inclusive, delivered before the deadline.