Core AML/CTF Obligations Explained: What Reporting Entities Must Actually Do
How ComplyIQ helps Australian reporting entities understand and operationalise core AML/CTF obligations.
Disclaimer: This article is general information only and isn’t legal advice. AML/CTF obligations vary depending on your designated services and circumstances. AUSTRAC has flagged reforms commencing from 31 March 2026, with Tranche 2 commencing 1 July 2026.
Once a business is classified as a reporting entity, AML/CTF compliance becomes an ongoing operational responsibility. While legislation sets out clear obligations, many organisations struggle to translate those requirements into consistent, auditable day to day practices.
At ComplyIQ, a common failure pattern is not the absence of policies. It is that obligations are understood individually but do not operate as a connected system. The result is fragmented evidence and decisioning that cannot be defended quickly when required.
If AUSTRAC asked for evidence next week, could you produce a clear end to end chain showing risk settings, customer due diligence, monitoring, escalation, reporting decisions, and records retained?
Could you show who did what, when, and why with supporting evidence attached?
If not, the issue is usually how your obligations operate not what they are.
What AML/CTF obligations do I actually have to comply with?
Australian reporting entities must comply with obligations under the AML/CTF Act and Rules. In practice, these obligations form a connected system rather than a checklist.
Core obligations typically include
- Maintaining an AML/CTF program including enhanced due diligence where required
- Customer due diligence (CDD) and enhanced CDD for higher risk situations
- Ongoing monitoring of customers and transactions
- Regulatory reporting to AUSTRAC including SMRs, TTRs, IFTIs and compliance reporting
- Record keeping that is complete, consistent and retrievable
AUSTRAC commonly assesses how these obligations operate together especially when evidence is tested under audit conditions.
What is an AML/CTF program and why is it required?
An AML/CTF program is the framework that defines how your organisation identifies, mitigates and manages money laundering and terrorism financing risk.
Key principle
Your program should not just exist as a document. It should actively drive operational decisions across identification, monitoring, escalation and reporting.
Where higher risk exists, your program must include enhanced customer due diligence procedures and clearly define when and how they are applied.
What customer due diligence is required under AML/CTF law?
Customer due diligence is about understanding who your customers are and maintaining that understanding throughout the relationship.
It includes identity verification, understanding the purpose of the relationship, and adjusting controls when risk changes.
Customer identification, monitoring, and risk assessment often sit in separate systems with no clear linkage. This makes it difficult to demonstrate how decisions were actually made.
What ongoing monitoring obligations apply?
Reporting entities must monitor customers and transactions to detect unusual or suspicious activity.
Monitoring expectations include
- Identifying suspicious activity
- Reviewing and updating customer risk profiles
- Maintaining records of monitoring activity
In high volume environments, reliance on manual processes often leads to inconsistent detection and weak evidence trails which increases regulatory exposure.
What regulatory reports must be submitted?
AUSTRAC requires reporting entities to submit several types of reports depending on the situation.
Key reporting obligations
- Suspicious Matter Reports (SMRs)
- Threshold Transaction Reports (TTRs) for cash transactions of 10,000 dollars or more
- International Funds Transfer Instructions (IFTIs)
- Compliance reporting as required
Reports must be submitted within 24 hours for terrorism related suspicion and within 3 business days for other matters. The timing starts when suspicion is formed, not when the transaction occurs.
Defensible decisioning requires records
It is critical to document what triggered suspicion, what checks were performed, what conclusion was reached, and what action was taken. This is what supports your decisions under review.
What record keeping obligations apply?
Record keeping underpins every other AML/CTF obligation. AUSTRAC expects records to be accessible, consistent and retrievable.
When records are spread across spreadsheets, emails, shared drives and individual staff notes, organisations struggle to demonstrate a complete and consistent evidence trail.
How does AUSTRAC assess compliance?
AUSTRAC assessments focus on whether controls operate in practice and whether evidence supports that claim.
What is typically tested
- Whether staff apply controls consistently
- Whether monitoring and escalation occur as intended
- Whether reporting decisions are timely and supported
- Whether records can be produced quickly and reliably
Organisations that rely on post event reconstruction often face increased scrutiny because the evidence chain is weaker.
What are the risks of fragmented compliance?
Fragmentation occurs when AML/CTF obligations are managed across disconnected systems and processes.
Common risks include
- Missing or incomplete records
- Inconsistent decision making across teams or locations
- Delayed escalations
- Longer audits and more expensive remediation
How can reporting entities operationalise AML/CTF obligations?
Operationalising AML/CTF means embedding compliance into daily workflows so evidence is captured as part of the work rather than recreated later.
Where ComplyIQ fits
ComplyIQ provides a centralised environment where AML/CTF programs, customer records, monitoring activity, escalations, reporting actions and supporting evidence are captured consistently.
This improves governance visibility and audit readiness while reducing operational friction.
Turn AML/CTF obligations into a working system
ComplyIQ helps reporting entities move from fragmented compliance to structured, auditable workflows where evidence is captured as part of day to day operations.