You're offline, showing the last version we saved.
Playbook

AML/CTF for accounting firms: ready in 90 days

For Australian firms that provide designated services. You finish enrolled, with an approved program, due diligence built into onboarding and the cost priced.

At a glance

  • 6 steps
  • 5 min to read
  • 90 days to put in place
  • 1 template included

What you’ll walk away with

  • A list of the designated services you provide, flagged in your systems
  • Enrolment with AUSTRAC, a compliance officer and a program approved in writing
  • No designated-service job opening without completed due diligence
  • A saved, reviewed risk rating for every new designated-service client
  • Existing clients tagged, training recorded, letters updated and next year’s dates booked

Learning check · before you start

What do you already have in place?

A few quick questions, so you can skip the steps you have already done. Each one has a line explaining what it means. Not sure, or never heard of it? Choose “Not yet / not sure”: that is where most firms start, and the playbook walks you through it.

  1. Do you know which of your services are caught by the AML/CTF rules (designated services), and are those jobs flagged in your systems?

    Designated services are the work AUSTRAC's anti-money laundering rules apply to, such as setting up a company or trust, helping a client buy or sell a business or real estate, or acting as a nominee. Tax returns, BAS and bookkeeping on their own are not on the list.

  2. Are you enrolled with AUSTRAC, with a compliance officer notified and a program approved in writing?

    AUSTRAC is Australia's anti-money laundering regulator. A firm providing designated services enrols with it, appoints a compliance officer at management level (in a small firm, often the owner) and notifies AUSTRAC, then approves a written program: a risk assessment plus the policies that manage those risks.

  3. Does your onboarding stop work starting on a designated service until the client's identity and risk checks (due diligence) are complete?

    Customer due diligence means confirming who the client is and who owns and controls it, and checking sanctions and politically exposed person lists. It must be complete before a designated service starts, so the job stays closed in your system until the file is done.

  4. Are your existing clients tagged, and is your team's AML/CTF training recorded?

    Tagging marks clients you were already acting for on 1 July 2026, who can continue without initial due diligence until a suspicious matter arises or a significant change raises their risk. AML/CTF means anti-money laundering and counter-terrorism financing; anyone in an AML/CTF role is trained before they start.

  1. Step 1: Check which of your services are caught

    Done when: You have a list of the designated services you provide, and they are flagged in your systems.

    Your task list every service your firm provides, mark the ones that are designated services under the AML/CTF rules, and set up a separate job type for them in your practice management system.

    How to do it, and what to read

    The regime attaches to services, not to your firm. List every service you provide and mark the ones on AUSTRAC’s list of designated services: setting up or restructuring a company or trust, helping a client buy, sell or transfer a business, trust or real estate, acting as a nominee or officeholder, and providing a registered office. Tax returns, BAS and bookkeeping on their own are not on it. Then add a designated-service job type in your practice management system, so those jobs cannot open without the due diligence step.

    Learning check

    What would you do? Pick one; every answer is explained.

    Under Australia's anti-money laundering rules (the AML/CTF Act), accountants have obligations only when they provide certain listed services, called designated services. Your firm mostly does tax returns, BAS and bookkeeping, and sets up three or four companies a year. Do the rules apply to you?
    Before your firm starts a designated service (such as setting up a company), the client's identity and risk checks, called customer due diligence, must be finished. How do you stop one of these jobs starting before the checks are done?
    A client asks if their company can use your office address as its registered office. Under the AML/CTF rules, is providing a registered office a designated service?

  1. Step 2: Enrol, appoint a compliance officer and approve the program

    Done when: You are enrolled, the compliance officer is notified, and the program is approved in writing.

    Your task enrol with AUSTRAC if you have not, appoint a compliance officer at management level and tell AUSTRAC who it is, and get your AML/CTF program approved in writing.

    How to do it, and what to read

    If you provide a designated service, enrol with AUSTRAC; the deadline for most firms was 29 July 2026, so if you have not, do it now. Appoint a compliance officer at management level and notify AUSTRAC; in a small firm that can be the owner. Then build the program: a risk assessment of the money laundering and terrorism financing risks your firm faces, plus the policies that manage them. AUSTRAC’s starter kit suits practices of 15 or fewer people that meet its other criteria; outside those, adapt it. Get it approved in writing.

    Learning check

    What would you do? Pick one; every answer is explained.

    AUSTRAC is Australia's anti-money laundering regulator. Accounting firms that provide designated services (such as setting up companies or trusts) must enrol with it, and for most firms the deadline was 29 July 2026. Your firm sets up companies for clients and has not enrolled. What do you do?
    Every firm under the AML/CTF rules needs a compliance officer: the person responsible for its anti-money laundering program, who must be at management level and whose name is given to AUSTRAC. You run a three-person firm. Who should it be?
    Your AML/CTF program is a written risk assessment plus the policies that manage those risks. AUSTRAC publishes a starter kit to help, designed for practices of 15 or fewer people that meet its other criteria. Your firm has 25 people. How do you use the kit?

  2. Step 3: Build due diligence into onboarding as a gate

    Done when: No designated-service job opens without completed due diligence on file.

    Your task make customer due diligence a gate in onboarding, so choosing a designated service on the intake form opens the due diligence form and the job stays closed until the file is complete.

    How to do it, and what to read

    Initial customer due diligence must be complete before you start a designated service. Build it as a gate, not a step at the end: the intake form asks which service is wanted, a designated-service answer opens the due diligence form, and the job stays closed until the file is complete. Run the identity, sanctions and politically exposed person check first. Collect by client type: individuals, companies and their beneficial owners, trusts with their trustee, settlor and beneficiaries. The risk rating sets how much evidence you need.

    Learning check

    What would you do? Pick one; every answer is explained.

    Customer due diligence means confirming who a client is and who owns and controls them, and checking sanctions and politically exposed person lists. At your firm it gets finished at the end of onboarding, often after work on a designated service (such as setting up a trust) has begun. What needs to change?
    A new client wants help buying a business, which is a designated service under the AML/CTF rules, so you must complete due diligence first. Which check do you run first?
    A new client wants you to restructure their family trust, which is a designated service under the AML/CTF rules. For a trust, whose details do you collect for due diligence?

  3. Step 4: Assess each client’s risk and write it down

    Done when: Every new designated-service client has a saved risk rating with reasons, reviewed by a person.

    Your task for each new designated-service client, record a risk rating and the evidence behind it, gathered in your normal onboarding call, and have a person review it.

    How to do it, and what to read

    For each new designated-service client, record a risk rating and the evidence behind it: what the business does, where its funds come from, who owns and controls it, and anything unusual. Most of this comes up in a normal onboarding call, so ask the questions there instead of sending clients another long form. If the call is recorded, AI can draft the assessment from the transcript and list what is still missing; you review it, correct it and own the rating. High-risk clients get enhanced checks and senior manager approval.

    Learning check

    What would you do? Pick one; every answer is explained.

    Under the AML/CTF rules, each new client for a designated service needs a risk rating (low, medium or high) with the evidence behind it: what the business does, where its money comes from and who owns it. You plan to email every new client a long risk questionnaire. What is the better approach?
    You recorded a new client's onboarding call, and an AI tool has drafted their anti-money laundering risk assessment from the transcript. What do you do with the draft?
    Your anti-money laundering risk assessment rates a new client as high risk. What follows?

  4. Step 5: Tag existing clients, train the team and keep the records

    Done when: Existing clients are tagged, training records exist and engagement letters are updated.

    Your task tag the clients you were already acting for on 1 July 2026, train everyone with an AML/CTF role (including on tipping off), keep the records for seven years, and have your lawyer review updated engagement letters.

    How to do it, and what to read

    Tag the clients you were already acting for at 1 July 2026: they can continue without initial due diligence until a suspicious matter arises or a significant change makes them medium or high risk. Make “new structure, new country, new controller” a question at every job opening. Train everyone in an AML/CTF role before they start, including on tipping off: never tell a client you suspect or have reported them. Keep program, due diligence and training records for seven years, and update engagement letters with your lawyer’s review.

    Learning check

    What would you do? Pick one; every answer is explained.

    The AML/CTF rules began applying to accountants on 1 July 2026. You were already doing designated-service work, such as company secretarial work, for a client before then, and nothing about them has changed. What do you need to do?
    At the start of a new job, a long-standing client mentions they have set up a new trust, controlled by a relative who lives overseas. Under the AML/CTF rules, what do you do?
    A staff member is uneasy about one of a client's transactions and wants to warn the client that the firm has concerns. What is the answer?

  5. Step 6: Price the work and book the annual cycle

    Done when: Your fee position on AML work is decided, and next year’s compliance dates are booked.

    Your task time each due diligence file by client type and risk level for a few weeks, decide how to recover the cost, and put the first annual compliance report in the diary.

    How to do it, and what to read

    For a few weeks, time each due diligence file by client type and risk tier. Keep the fixed cost of running the program (reviews, training, the compliance officer’s time, the annual report) apart from the cost on each engagement. Then choose how to recover it: absorb it, build it into the designated-service fee, tier it by structure, or show it as its own line. Set the number from your own data, not someone else’s rate. Diarise the first annual compliance report, due between 1 July and 30 September 2027.

    Learning check

    What would you do? Pick one; every answer is explained.

    The AML/CTF checks add time to every designated-service job, and you need to decide how to recover that cost. How do you work out what the work costs you?
    Running an anti-money laundering program has fixed costs, such as the annual review, staff training and the compliance officer's time, plus a cost on each client file. Right now you lump all of it into each job's cost. What is the better approach?
    Firms under the AML/CTF rules must send AUSTRAC, the regulator, an annual compliance report. Your first one is due between 1 July and 30 September 2027. When do you put it in the diary?

Free to join

Join The Firm free to read the rest

Members get every playbook in full, plus free templates, downloads and tools across the site. Join more than 35,000 accounting professionals. All it takes is your email.

Already a member or subscriber? Enter the same email and the playbook opens. Privacy policy.

Your one-page summary

Your answers, choices and decisions, on one page

Copy this

AML risk assessment template

A client risk rating with the evidence behind it, ready to save to the file. Editable .docx.

Get the template

Frequently asked questions

Is this playbook legal advice?

No. It is general information drawn from The Firm’s reporting. AUSTRAC is the source of truth for your obligations, read with guidance from CA ANZ, CPA Australia or the IPA. Check anything that affects your firm with AUSTRAC or a qualified adviser.

Do I need to re-identify every existing client?

No. Clients you were already providing designated services to at 1 July 2026 can continue without initial due diligence until a suspicious matter arises or a significant change makes them medium or high risk. You still monitor them, so the task is tagging them, not collecting documents from everyone.

Does preparing tax returns bring a firm into the AML regime?

Not on its own. Tax returns, BAS, bookkeeping and payroll are not designated services. The obligations attach when you provide a listed service, such as setting up or restructuring a company or trust, or helping a client buy or sell a business.

More for: Keep, fix or part ways with a client