AUSTRAC's AML/CTF Compliance: The accountant's checklist

Now that Tranche 2 obligations are in force, the question is where your firm stands. When anti-money laundering and counter-terrorism financing (AML/CTF) checks sit outside your onboarding workflow, missing evidence can stall engagement approval and billing before you realise it.

An AUSTRAC AML/CTF compliance checklist gives accounting firms an operational framework for assessing whether their designated services bring them into scope. It can also help document the required enrolment, governance, customer due diligence (CDD), monitoring, reporting, and record-keeping controls. 

Each obligation needs an owner, a deadline, an evidence record, and a workflow trigger. This checklist gives partners and operations leads a shareable, practical starting point, not legal advice.

Whether Tranche 2 applies comes down to the specific services your firm provides and whether they carry an Australian geographical link, not whether you run an accounting practice.

Start with a complete list of your services and check each one against AUSTRAC's designated services guidance. If none match, routine accounting work alone doesn't create scope. If one does match, confirm whether it has an Australian geographical link. 

A designated service with that link can create reporting entity obligations: enrolment, a documented program, CDD, reporting, and record-keeping. For services that sit in grey areas, check AUSTRAC's current definitions and get appropriate legal advice before settling on your firm's status.

AML/CTF compliance works best as a sequenced operating process. When each obligation has an owner, a deadline, an evidence record, and an onboarding trigger, shared responsibilities stay visible and accountable.

The five steps below cover enrolment, governance, program design, CDD, reporting, monitoring, and records. Confirm your legal duties against AUSTRAC guidance and the final Rules before implementing. The operational recommendations here support execution and don't replace that step.

If your firm provides a designated service, enrolment needs to happen within 28 days of starting that service. Before you begin, confirm the current AUSTRAC process and prepare the ownership and business information the enrolment requires.

• Owner: Assign someone to check AUSTRAC's current guidance and gather the requested information.
• Deadline: Complete enrolment within the applicable 28-day window and check guidance before starting any new designated service.
• Evidence: Record service applicability, the commencement date, submission confirmation, and any AUSTRAC correspondence.
• Trigger: Start the enrolment workflow when your firm plans to begin a designated service.

Your AML/CTF compliance officer needs the seniority, authority, resources, and access to oversee controls and escalate concerns across the firm.

• Owner: Assign a senior person and document their decision-making authority, reporting lines, training, budget, and access to partners or the board.
• Deadline: Complete the written appointment before the officer begins overseeing AML/CTF controls.
• Evidence: Retain the written role description, escalation paths, conflict controls, and backup coverage arrangements.
• Trigger: Review the appointment when responsibilities change or the officer is absent.

Also notify AUSTRAC of the appointment within the applicable timeframe.

Your AML/CTF program needs to translate your firm's actual exposure into documented governance, controls, training, monitoring, review processes, and customer identification procedures. These records connect identified risks to the responsibilities and approval controls that address them.

• Owner: Assign the compliance officer to maintain the program and an accountable person for each risk and control.
• Deadline: Set a completion date for the program and a documented review date for each risk and control.
• Evidence: Document requirements in your AML/CTF program and maintain a single register covering risks, controls, owners, and review dates.
• Trigger: Review the program when services, customer types, delivery channels, jurisdictions, beneficial ownership structures, or emerging risks change.

Map these requirements to your client engagement process so compliance steps have clear owners and supporting evidence from the start.

CDD needs to function as a documented gate in your onboarding process. Service activation and billing should proceed only after required checks and approvals are complete.

• Owner: Assign an onboarding owner to complete CDD and a designated decision-maker to approve higher-risk clients.
• Deadline: Complete all required checks and approvals before service activation and billing.
• Evidence: Record customer and beneficial owner information, verification steps, engagement purpose, risk rating, approval, and ongoing monitoring requirements.
• Trigger: Start CDD for each new engagement and escalate when a client receives a higher-risk rating.

Aligning this sequence with your client engagement letter process keeps responsibilities and approval status visible throughout.

AML/CTF compliance continues after onboarding through ongoing monitoring, risk reassessment, confidential escalation, regulatory reporting, and secure record retention.

• Owner: Require staff to escalate concerns confidentially, and assign the compliance officer to assess reporting duties and authorise next steps.
• Deadline: Complete actions at each defined review point and whenever a monitoring event or staff concern requires escalation.
• Evidence: Record each review, decision, action, and supporting document in a secure location with controlled access.
• Trigger: Start the workflow after a monitoring event, risk change, scheduled review, or staff concern.

When a concern arises, staff should escalate internally without alerting the client while the officer assesses duties, documents the decision, and authorises next steps.

A defensible AML/CTF program matches its governance, documentation, and review depth to your firm's actual risks and complexity. Document why each control fits the money laundering and terrorism financing risks your firm has identified. That reasoning is part of what makes the program defensible, and AUSTRAC expects to see it.

The right approach looks different depending on firm size:

A solo or small practice can centralise everything with one accountable officer: a reusable checklist covering CDD, approval, evidence, review, and billing readiness, with one location for all supporting documents. Build reusable risk templates into that central record with scheduled review dates. When specialist expertise or independence is limited, bring in external advice rather than leaving a gap.

Keep escalation and review mandatory, and avoid duplicate data entry across onboarding, proposals, and billing.

Multi-partner firms and reporting groups need shared controls and consolidated oversight while keeping entity-level risks, decisions, and accountability clearly visible. Related entities should assess whether a group compliance structure suits their ownership, services, and risk profile.

Build a role matrix that assigns responsibilities and sets approval thresholds for customer risk decisions, escalations, and service activation. Apply central templates across offices, monitor at the office level, and consolidate results into partner-level reporting. Record every approved exception with the reason, decision-maker, and review date. That documentation lets partners demonstrate consistent execution while keeping local risks traceable.

AML/CTF checks work best inside your client engagement workflow, not running alongside it as a separate process. Connecting compliance gates to proposals, acceptance, service activation, and billing reduces duplicate admin and prevents stalled handoffs that delay onboarding and revenue.

For each stage, document the owner, required fields, approval step, client communication, and billing trigger. Use shared client data across approved systems to avoid repeated entry and unclear handoffs. 

Ignition supports these touchpoints through proposals, e-signatures, engagement letters, billing, payments, and workflow automation, helping your firm connect AML/CTF checks with client engagement while regulatory accountability stays with the firm.

Weak AML/CTF processes generate operational drag long before any regulatory action. Stalled engagement approvals, delayed invoicing, disrupted revenue collection, remediation costs, professional advice fees, rework, and partner review time all add up.

Let’s say a new company client accepts an engagement, but their beneficial ownership evidence is incomplete. Approval and invoicing stop while staff chase documents, repeat checks, seek advice, and escalate to a partner. If that scenario repeats across onboarding, it becomes a significant and avoidable cost.

Predefined owners and approval gates prevent it from becoming routine. Assign one owner to review beneficial ownership evidence, record the decision, and release the engagement only after approval. Connect that gate to service activation and billing readiness, and keep regulatory decisions with authorised firm personnel.

Compliance becomes manageable when it follows the client journey rather than running beside it. Build checks into engagement and billing workflows to protect your firm's capacity, evidence trail, and cash flow. Ignition supports those workflows while your firm retains responsibility for its AUSTRAC compliance program.