Tranche 2 Compliance Checklist (Printable)

Before you start

Do these once, in this order. Tick each box as you go.

• ☐ Confirm you provide a designated service. Use AUSTRAC's tool to check whether any of your services is regulated. Check if you may be regulated
• ☐ Enrol with AUSTRAC. Create an AUSTRAC Online account and enrol your business; AUSTRAC's guidance is to do it within 28 days of starting to provide the service. Enrol with AUSTRAC
• ☐ Name your three governance roles. Identify your governing body, your senior manager (or managers) and your AML/CTF compliance officer; in a small firm one person can hold more than one role. AUSTRAC obligations summary
• ☐ Write your ML/TF risk assessment. Assess the money laundering, terrorism financing and proliferation financing risks of your customers, services, delivery channels and locations. Tranche 2 overview
• ☐ Adopt your AML/CTF policies. Write procedures and controls that respond to those risks; AUSTRAC's sector starter kits are a starting point if you qualify. Example: real estate starter kit
• ☐ Check and train your people. Run personnel due diligence on anyone with an AML/CTF role and give them training that fits that role. AUSTRAC obligations summary
• ☐ Choose your tools. Decide how you will verify identities, screen customers and store evidence so every file is handled the same way. Identity verification
• ☐ Set up reporting access. Give the right people AUSTRAC Online accounts with multi-factor authentication so you can lodge reports when needed. AUSTRAC
• ☐ Decide how you will share the load. Work out whether you will use outsourcing, a reporting group or software to help meet obligations, and record that the responsibility stays with you.
• ☐ Build your customer forms. Create one onboarding form per customer type with fields for identity evidence, beneficial owners, screening results and risk rating.
• ☐ Brief your senior manager. Walk them through the risk assessment and program, because they approve the program and key compliance decisions.

Customer checks

Run these for every new customer before you provide the service, scaling the depth to the risk rating.

• ☐ Identify the customer type and service. Individual, company, trust or other, and what you are being asked to do. Real estate example
• ☐ Collect the required information. Use one onboarding form per customer type so nothing is missed.
• ☐ Verify identity. Check a photo ID, an electronic data source, or both, and match the person to the evidence. Electronic identity verification
• ☐ Identify beneficial owners and controllers. For companies and trusts, verify the individuals behind the entity, not just the entity.
• ☐ Screen for PEPs and sanctions. Check the customer and related individuals against PEP and targeted financial sanctions lists. AML screening
• ☐ Assign a risk rating. Rate the customer low, medium or high using the factors in your risk assessment, and record why.
• ☐ Apply enhanced checks to high-risk customers. Add source of funds, source of wealth, adverse media and senior manager approval where your program requires it.
• ☐ Hold the service until checks are complete. Provide the service only once required checks are done, unless your program meets the criteria for delayed due diligence.
• ☐ Know when due diligence can be delayed. Delay the checks only where your program sets out criteria that allow it, and record the reason and the deadline.
• ☐ Plan for customers without standard ID. Define an alternative identification procedure for people who do not hold typical documents, and record how it was applied.
• ☐ Rely on others' identification only where permitted. If you use a third party's checks, record the arrangement and confirm it meets the rules for reliance.
• ☐ Look for risk indicators. Compare the customer's profile and the deal against the indicators in your risk assessment and flag anything that does not fit.

Ongoing

These repeat for as long as you serve the customer and run your program.

• ☐ Monitor customers. Watch for changes in behaviour, structure or funding that do not fit what you know.
• ☐ Keep customer information current. Update identity and risk details when something changes, and re-rate the customer.
• ☐ Escalate triggers. Send inconsistencies and unusual activity to your compliance officer with a dated note.
• ☐ Review and update your program. Revisit the risk assessment and policies on a regular schedule and whenever your services change.
• ☐ Arrange an independent evaluation. Have your program independently evaluated as AUSTRAC's guidance requires.
• ☐ Lodge your annual compliance report. Report to AUSTRAC on how you met your obligations in the previous calendar year.
• ☐ Refresh training. Retrain staff when rules, roles or your risks change.
• ☐ Re-screen on a schedule. Re-run PEP and sanctions screening periodically and when a customer's details change, because status can change after onboarding.
• ☐ Reassess when your services or customers change. A new service line, a new delivery channel or a new customer segment can change your risk and needs a program update.

Records and reporting

Evidence is what makes the rest of the list defensible.

• ☐ Report suspicious matters on time. Lodge a suspicious matter report if you form a suspicion; AUSTRAC's guidance sets the deadlines. Suspicious matter reports
• ☐ Report large cash transactions. Lodge a threshold transaction report for physical cash of A$10,000 or more.
• ☐ Keep your records. Retain program records, customer due diligence records and transaction records, which AUSTRAC says is usually for seven years.
• ☐ Store records so you can retrieve them. Keep them secure and searchable by customer and date so you can answer a request quickly.
• ☐ Log decisions as well as results. Note who decided what and why, especially when you proceed despite a flag or decline a customer.
• ☐ Test that you can retrieve a file. Pick a customer at random and check you can produce their evidence, rating and decisions within minutes.
• ☐ Avoid tipping off. Brief staff not to tell a customer that a report is being considered or has been made.
• ☐ Know the consequences. Understand AUSTRAC's enforcement options so you can prioritise gaps. Consequences of not complying

How to use this list

Tranche 2 extends Australia's AML/CTF Act to lawyers, conveyancers, accountants, real estate professionals, trust and company service providers and dealers in precious metals and stones. The dates and background are in our Tranche 2 overview. This list is general information, not legal advice, and it does not replace AUSTRAC's guidance for your sector.

• Print the page with your browser's print command and tick the boxes by hand, or copy the items into your own tracker.
• Put an owner and a date next to each unfinished item.
• For sector-specific steps, see the guide for real estate agents.
• Automate the customer-check items with AML screening and identity verification, so every file leaves the same evidence trail.