AUSTRAC Compliance Readiness Checklist
Interactive Self-Assessment Tool · Built to AUSTRAC Standards
AML/CTF Readiness Self-Assessment
Check the boxes below representing your agency's current operational compliance capabilities. The tool will dynamically calculate your readiness index and output a diagnostic rating.
Readiness: 0%
Rating: Critical Risk
Critical Exposure: Your agency has severe compliance gaps under the 2026 AML/CTF mandate. You are highly exposed to regulatory audit penalties.
Score yourself above, then use this guide to close whichever gaps the checklist found. Each item below is one of the five readiness pillars, with what AUSTRAC actually expects and the fastest route to done.
Do you have a written AML/CTF program — and has a senior manager approved it?
The program is the document every other obligation hangs off: your money-laundering risk assessment, your CDD procedures, your training regime, your compliance officer's authority. It must be in writing, proportionate to your agency's size and risk, and approved at senior-manager level — an unapproved draft in a shared drive does not count. If you have nothing today, a proportionate program for a suburban agency is days of focused work, not months; the trap is leaving it until June 2026.
Can you verify identity against reliable, independent sources?
Photocopying a licence into a folder fails the standard. Verification means checking identity documents against reliable and independent data — electronic verification against official sources, or certified documents handled under a documented procedure. For companies, trusts and SMSFs it extends to beneficial owners: any individual owning or controlling 25% or more. Decide now whether you verify electronically or manually, and write the procedure either way.
Can you trace beneficial ownership through structures?
A property bought by a company owned by a trust with a corporate trustee is an ordinary Tuesday in Australian real estate — and exactly the structure the regime cares about. Readiness means being able to ask for, record and verify the ownership chain until you reach humans, and knowing when the chain's opacity itself raises the risk rating. If your intake forms don't ask about structure today, that is the first form to fix.
Would your records survive an AUSTRAC enquiry?
Every obligation ends in the same place: records, retained for 7 years, capable of showing not just that you did the work but when, who did it, and what they relied on. A defensible record is timestamped, attributable and tamper-evident. Scattered PDFs across inboxes technically contain the information; they do not constitute a record you can produce under time pressure. This is the pillar where software earns its keep.
Has everyone who touches a sale been trained — with evidence?
The obligation is risk-awareness training for staff whose roles expose them to money-laundering risk, refreshed on a sensible cycle, with records of who completed what and when. A sign-in sheet from one lunch-and-learn does not evidence a training regime. The practical bar: every salesperson can recognise the red flags, knows not to tip off, and knows exactly who to escalate to — and you can prove it.
The dates that anchor all of it
Obligations commence 1 July 2026. Enrolment with AUSTRAC is required within 28 days of first providing a designated service. Suspicious matter reports run on a 3-business-day clock (24 hours for terrorism financing); threshold transaction reports on 10 business days; records on a 7-year retention. Put these in front of whoever owns your compliance calendar — they are the deadlines the whole program is built backwards from.
Secure your agency before the deadline.
Talk with a compliance strategist to assess your pipeline and secure your written AML program today.
Download Brief PDF
Download a secure, audit-vetted PDF copy of this compliance asset for offline review.