For Australian accounting firms, building an AML compliance program from scratch means turning requirements into a working system, not just a policy folder. A practical program helps staff complete client checks consistently, record why decisions were made and keep follow-up on track.
If you’re unsure where to begin, or concerned that compliance will create inconsistent admin, that’s understandable. For accounting firms within scope, Tranche 2 obligations commenced on 1 July 2026. A clear program can help your firm organise its work and manage its responsibilities.
This guide explains the core components of a firm-wide AML/CTF program and how to connect them in repeatable workflows. You’ll learn how to document risk assessments, client due diligence and ongoing actions, keep records that support review and improvement, and track compliance activity so your firm can assess whether work may be recoverable from clients. The aim is a working system for your firm, not a policy document that sits on a shelf.
Key Takeaways
- Confirm which services and obligations apply to your firm before choosing tools or designing controls.
- Assign clear ownership, escalation paths and review responsibilities so staff know what to do and decisions can be traced.
- When building an AML compliance program from scratch, connect client checks, risk decisions, monitoring and record keeping in repeatable workflows.
- Use a practical implementation sequence to establish or remediate arrangements without adding unnecessary administrative steps.
- Track training, completed workflows, exceptions and follow-up actions to keep evidence accessible and identify opportunities to improve.
Before building an AML compliance program, confirm what applies to your firm
Start with scope, not software selection. An AML/CTF program documents how your firm identifies and manages the money-laundering and terrorism-financing risks relevant to its services. Before choosing tools or workflows, establish which services may bring your firm within the regime and check current AUSTRAC guidance about what applies.
For accounting firms within scope, Tranche 2 obligations commenced on 1 July 2026. The date has passed, so the practical task is to assess your current arrangements, identify gaps and establish or remediate the processes your firm needs. Check AUSTRAC’s current guidance and designated-service information as you do this. Scope depends on the services provided and the circumstances in which they’re provided.
How to check whether your accounting services are in scope
List the services your firm actually provides, then compare each one with AUSTRAC’s current designated-service guidance. Don’t infer coverage from a business name or professional label alone. Two firms described as accounting practices may provide different services, so assess your own service mix and circumstances. For a related readiness resource, see this AUSTRAC enrolment checklist.
Record what you reviewed, the basis for your conclusion and anything that needs clarification. If scope is uncertain, seek appropriate professional or legal advice rather than relying on a generic template or assumption.
What a working AML/CTF program needs to achieve
A functioning program connects governance and risk assessment with client identification and due diligence, monitoring, reporting, staff training and record keeping. These elements should work together. Your risk assessment informs client processes, while monitoring and escalation help determine what action and documentation may be needed. Anti-money laundering (AML) is a broader global framework. Australian firms should use AUSTRAC guidance to understand the requirements relevant to their services.
A policy describes the approach; an operating program assigns, evidences and reviews the processes that put it into practice. That distinction matters when building an AML compliance program from scratch. A document alone won’t show who completes a check, how a concern is escalated or where a decision is recorded.
This guide focuses on practical implementation, not legal advice or every technical obligation. Use it to organise the work, then verify the detail against current AUSTRAC guidance and your firm’s circumstances. A template can help you start, but tailor it to your services, risks and operating arrangements rather than treating it as automatically suitable.
Design the AML/CTF program around governance and firm-specific risk
Once you understand what applies to your firm, design the program around how your practice operates. Governance clarifies who oversees the work and how decisions are made. A firm-specific risk assessment helps ensure your controls reflect your services and circumstances, rather than simply repeating a generic framework.
Consider the services you provide, the types of clients you work with, how services are delivered and other relevant features of your operating context. These factors help explain where your firm may face different types or levels of risk. The aim isn’t to reproduce a full assessment methodology here. It’s to give your program’s responsibilities and controls a documented rationale.
Assign ownership, oversight and escalation
Make responsibilities explicit. Identify who coordinates program tasks, who approves key decisions and where staff should raise unresolved questions or concerns. One person may perform several roles, depending on your firm’s structure, but each responsibility should still be clear. Record who provides oversight and how decisions or issues are escalated.
Written responsibilities reduce reliance on informal knowledge. If a staff member is away or a concern needs attention, colleagues should be able to find the process and understand the next step. Trancher provides program-management tools and support, but it doesn’t act as your firm’s outsourced AML officer. Your firm remains accountable for its program and decisions.
Document a risk-based approach that can be reviewed
Record the factors considered, how the firm assessed them, which controls it selected and why those controls are suitable. For example, if your service mix or a client’s circumstances affect the firm’s view of risk, document the reasoning and any resulting control decisions. A reviewer should be able to trace the decision from identified risk to action without relying on unwritten explanations.
Risk records should be revisited as the firm changes. New services, different delivery channels or material changes in client circumstances may prompt reassessment, subject to current requirements. Note what changed, who reviewed it and whether the program or controls need updating. For more detailed guidance, see this AML risk assessment methodology.
Controls should respond to documented risks, not be copied unchanged from another firm’s program. This keeps the framework relevant and makes decisions easier to explain. When building an AML compliance program from scratch, structured tools can help connect risk decisions with assigned workflows and records. Explore AML/CTF program management support as one way to organise the work, while keeping oversight and accountability within your firm.
Turn AML/CTF controls into repeatable client and record-keeping workflows
Controls are easier to apply when they form a connected workflow. Client identification and due diligence inform a risk decision, which guides the next steps, including monitoring where relevant. If a finding needs attention, staff should know who reviews it, how it is escalated and where the outcome is recorded. This end-to-end view makes building an AML compliance program from scratch more practical than assembling disconnected tasks.
Connect client checks, risk decisions and ongoing monitoring
Map each step from the first client interaction onwards. Record the identity information and due diligence gathered, the risk rationale, any required approval and the next action. Monitoring findings should reach a responsible reviewer, who records the decision and any follow-up. The exact checks and triggers depend on your circumstances, so avoid unverified thresholds or assuming one generic process suits every client.
Use a simple workflow map to make ownership and evidence visible:
| Stage | Responsible role | Evidence retained | Escalation route |
|---|---|---|---|
| Client identification and due diligence | Assigned staff member | Information collected and check completion | Reviewer or designated internal contact |
| Risk decision and approval | Approver under firm procedures | Rationale, decision and approval record | Senior decision-maker or next escalation point |
| Ongoing monitoring | Assigned staff member or team | Finding, review and resulting action | Responsible reviewer |
| Concern and reporting consideration | Staff member, then authorised reviewer | Escalation and decision record | Firm’s reporting process |
For detailed client-check considerations, consult the CDD and KYC requirements guide. Check current AUSTRAC guidance for the exact triggers, timeframes and reporting requirements that apply to your firm.
Make reporting, training and records part of daily operations
Staff need a clear route for raising concerns, and reviewers need a consistent way to assess and document what happens next. Build this route into ordinary work so a concern isn’t left in an inbox or passed on informally. Follow current AUSTRAC guidance for reporting decisions and requirements. This suspicious matter report guide provides further detail.
Keep training evidence relevant to each person’s responsibilities, alongside workflow completion, decisions and follow-up records. Store compliance documentation with controlled access so authorised people can find the evidence they need and sensitive information is appropriately managed. A platform can help organise tasks and records, but the firm must ensure its procedures and decisions remain aligned with current requirements.
Build the program from scratch without making compliance administratively unmanageable
Compliance doesn’t have to mean repeating the same work across disconnected spreadsheets, emails and client files. Start by looking for duplicated tasks, unclear hand-offs and decisions that aren’t recorded. Then design a proportionate workflow around your firm’s processes. A well-documented process can reduce avoidable repetition, but it doesn’t remove the firm’s accountability or the need for staff to exercise judgement.
Tranche 2 obligations commenced on 1 July 2026, so firms in scope should focus on establishing or remediating current operating arrangements, not planning around a future start date. Confirm applicable requirements against current AUSTRAC guidance before treating a particular task as mandatory.
A practical sequence for establishing the operating model
Build in stages. For each stage, name an owner, define an output and specify who reviews or approves it. Focus first on workable processes, then consider further improvements once the essentials are operating consistently.
- Confirm scope. The owner records the services reviewed and the scope conclusion. A partner or appropriate reviewer checks the basis against current guidance.
- Assign ownership. A designated coordinator documents responsibilities, decision-makers and escalation routes. Leadership reviews and approves the arrangements.
- Assess firm-specific risk. The responsible person records relevant risk factors, the assessment approach and the rationale for proposed controls. An appropriate reviewer checks whether the reasoning fits the firm.
- Design workflows. Process owners map how client checks, decisions, monitoring, escalation and records connect. Review a sample workflow to confirm roles and evidence are clear.
- Guide staff and organise records. The coordinator prepares role-relevant guidance and a consistent record structure. Managers check that staff can follow the process and locate required documentation.
This sequence is an implementation aid, not a statement that every step or control applies identically to every firm. Verify the relevant obligations before finalising your design.
Reduce duplication while keeping human decisions accountable
Spreadsheets may suit some tasks, but assess whether they make ownership, version control, hand-offs and decision history easy to follow. Fragmented files can make it harder to see what’s complete and what needs attention. A structured workflow can connect criteria, assigned actions, reminders and retained evidence in a more consistent sequence.
Automation may support verification tasks, reminders, record keeping and activity tracking. It shouldn’t replace staff judgement. A person still needs to review relevant findings, make or approve decisions under firm procedures and document the outcome. For further efficiency considerations, read the AML compliance cost reduction guide.
Implementation succeeds when ownership is assigned, controls are repeatable and evidence is retrievable. Trancher’s AML/CTF program management platform can help organise these workflows, while your firm retains oversight and responsibility.
Maintain, evidence and improve your AML compliance program with the right support
A documented program needs ongoing oversight, not just a completed launch. With Tranche 2 obligations having commenced on 1 July 2026, firms in scope should keep checking that their arrangements align with current AUSTRAC guidance and their services. Set a review process, assign an owner and record what was checked, what needs attention and who will follow up. Where an obligation or its application is unclear, seek qualified advice.
Keep reviews practical. Track whether relevant training is complete, workflows are progressing, exceptions have been reviewed, decisions are recorded and follow-up actions are closed. Patterns can show where guidance needs clarification or a process needs adjustment. This turns activity records into useful management information, rather than evidence gathered only when requested.
Keep program records ready for internal review
Maintain accessible, organised records that show how the program operates. Dated risk assessments and decisions help explain the basis for action. Training records show who received guidance, while workflow evidence helps trace checks, escalations and follow-up. Make clear who owns each record and how authorised staff can locate it. Confirm any retention requirements against current authoritative guidance rather than assuming a standard period applies.
For practical ideas on organising evidence, see the audit-ready compliance records guide.
Where a compliance platform can support implementation
Once your firm has defined its responsibilities and processes, a platform may help connect the work. Trancher supports client verification and due diligence, risk workflows, ongoing monitoring, reporting, staff training, record keeping and compliance activity tracking. Workflow automation and integrations may also help organise hand-offs and records. These tools support implementation; they don’t replace firm oversight, professional judgement or the need to check current requirements.
Trancher states a guarantee of AML/CTF compliance readiness within 30 days of starting. Check the guarantee’s current scope and terms before relying on it. A complimentary three-month trial is also available to a limited number of accounting firms, with an ROI report at the end. Confirm current availability and terms. A trial or platform supports the firm’s work; it doesn’t transfer the firm’s responsibilities.
If you’re considering support for your firm’s implementation, start a conversation with Trancher.
Make your AML/CTF program practical and sustainable
A strong program starts by confirming what applies to your services, then assigning clear ownership and documenting the decisions behind your controls. Connect client checks, risk decisions, monitoring, escalation and record keeping in workflows staff can follow. Review the evidence and current AUSTRAC guidance so your arrangements can adapt as your firm and its services change.
Building an AML compliance program from scratch doesn’t have to mean adding disconnected administration. A structured approach can help reduce duplication and make responsibilities, actions and records easier to track, while your firm retains accountability for its decisions.
Trancher supports Australian accounting firms with program management, dedicated onboarding and local Australian support. The business states a 30-day AML/CTF compliance-readiness guarantee; confirm its current scope and terms. A complimentary three-month trial and end-of-trial ROI report are also available to a limited number of accounting firms, subject to current availability and terms.
Start a conversation with Trancher about building your AML/CTF workflows to explore a practical way to organise implementation. With clear ownership and repeatable processes, your firm can take the next steps with greater confidence.
Frequently Asked Questions
What is an AML compliance program?
An AML/CTF program is a documented framework a business uses to manage relevant money-laundering and terrorism-financing risks. It connects governance, risk assessment, client processes, monitoring, reporting, staff training and record keeping. The right design depends on the services the business provides and its circumstances. If you’re an Australian firm, check current AUSTRAC guidance to confirm which requirements apply rather than relying on a generic template.
How do I build an AML compliance program from scratch?
Start by checking whether your firm provides a designated service, then assign ownership, assess relevant risks and map the client and monitoring workflows you need. Establish escalation and reporting processes, guide staff and organise records. Test the processes in practice and document improvements. Tranche 2 obligations commenced on 1 July 2026, so firms in scope should assess their current arrangements and address gaps against up-to-date AUSTRAC guidance.
What should an AML/CTF program include for an accounting firm?
An accounting firm’s program should explain how it manages applicable obligations across governance, risk, client due diligence, ongoing monitoring, escalation, suspicious matter reporting, training and records. The exact design depends on the firm’s designated services and current requirements. Check AUSTRAC guidance to confirm what applies, then make sure documented procedures reflect the firm’s actual work, assigned responsibilities and decision-making processes. A generic template may provide a starting point, but needs careful tailoring.
Does a small accounting firm need AML compliance software?
Software isn’t the starting point. First establish your firm’s scope, risks, responsibilities and processes. A platform may help organise client checks, monitoring, reporting and records, but it won’t make every decision or take away the firm’s accountability. Compare options against the workflows you need to manage, how staff will use them and whether records remain accessible. Check that the system fits current requirements and your existing operating arrangements.
Can an AML compliance program be built using spreadsheets?
Spreadsheets may help organise some information, but their suitability depends on your processes, access controls and record needs. Check whether staff can consistently identify who owns each task, record decisions, track follow-ups and retrieve evidence without duplication or gaps. A structured platform may support repeatable workflows, but no format is automatically right for every firm. Compare the options against your documented risks, operating requirements and ability to manage updates.
How often should an AML compliance program be reviewed?
There isn’t one review frequency to assume for every firm. Check current AUSTRAC requirements and establish an approach suited to your obligations, risk profile and operations. Revisit the program when relevant services, client circumstances, workflows or regulatory guidance change, and record the review, decisions and follow-up actions. If you’re unsure how a requirement applies, seek appropriately qualified advice rather than relying on a generic review schedule.
Is an AML software platform enough to make a firm compliant?
No. A platform can support workflows, records and monitoring, but it can’t replace understanding which obligations apply, making appropriate decisions or maintaining firm oversight. Check its capabilities against current AUSTRAC guidance and your firm’s services and risks. Staff also need to understand their responsibilities, and the firm should retain evidence that its documented processes are being followed. Treat software as operational support, not a substitute for accountability.