The AML/CTF acronym cheatsheet

Every acronym you will meet running an AML/CTF program, in plain English, on one page. Built to be printed and kept next to the desk.

23 September 2026 · Amanda Dunn · 4 min read

AML/CTF compliance arrives with its own alphabet, and most of it lands on someone who did not ask to become a compliance officer. This is the whole vocabulary on one page, written the way you would explain it to a colleague.

Print it, pin it up, and stop looking things up mid-conversation.

The acronyms

Term	Stands for	In plain English
AML/CTF	Anti-Money Laundering / Counter-Terrorism Financing	The framework that stops criminals using ordinary businesses to hide money or fund terrorism. The AML/CTF Act 2006 is the Australian law behind it.
AUSTRAC	Australian Transaction Reports and Analysis Centre	Australia’s financial intelligence agency, and your regulator. You enrol with them and you report to them.
CDD	Customer Due Diligence	Working out who your customer actually is, and recording how you know. Identity, ownership, and why they want the service.
EDD	Enhanced Due Diligence	Deeper checks for customers you have assessed as higher risk. Goes beyond standard CDD.
KYC	Know Your Customer	The everyday name for the same practice. CDD is the formal obligation; KYC is what people call it.
ML/TF	Money Laundering / Terrorism Financing	The two risks your risk assessment has to address. ML is washing illegal money through legitimate business; TF is funding terrorism.
UBO	Ultimate Beneficial Owner	The actual human being behind a company or trust. For a trust, look to the settlor, trustees, appointors and beneficiaries.
PEP	Politically Exposed Person	Someone holding or formerly holding a prominent public position — plus their family and close associates. Higher corruption risk, so they warrant closer scrutiny.
PDD	Personnel Due Diligence	Background checks on your own people who hold AML/CTF responsibilities, done before they take the role.
SMR	Suspicious Matter Report	What you file with AUSTRAC when something about a customer or transaction does not add up. You never tell the customer you have filed one.
TTR	Threshold Transaction Report	A report triggered by a large cash transaction. No suspicion required — it is automatic once the threshold is met.
CBMR	Cross-Border Movement Report	A report for physical currency or bearer instruments moving across the Australian border. Rarely relevant to most professional services firms.
goAML	AUSTRAC’s reporting portal	The online system where you enrol and lodge your reports. Curlew prepares the content; you submit it through goAML.
Designated service	The trigger for the whole thing	The specific services listed in the Act that bring a business under AUSTRAC regulation. Provide one, and you are a reporting entity.
Reporting entity	You, if you provide a designated service	The regulated business itself. The obligations sit with the entity — you can get help, but you cannot hand the obligation to someone else.
Compliance officer	AML/CTF Compliance Officer	The named individual responsible for your program — reporting, training, and reporting up to the governing body. A person, never a job title.
Governing body	Your board, principal or owner	Whoever oversees the business. For a sole trader, that is you. They receive the annual compliance report.
Risk assessment	ML/TF risk assessment	Your documented view of the money-laundering and terrorism-financing risks your particular business faces. Everything else in the program flows from it.

This sheet explains what the terms mean. It does not carry thresholds, deadlines or retention periods — those change, and they are worth reading from AUSTRAC’s current guidance rather than off a printout.

How often to review a customer

This one is not a legal threshold — it is the schedule Curlew applies when it sets a review date, based on the risk rating you gave the customer at CDD.

Risk rating	Next review
High	1 year
Medium	2 years
Low	3 years

Two things worth remembering

You can get help building a program, but the obligation stays with the reporting entity. It is not something you can outsource away.
A program you can describe is not the same as a program you can evidence. The records are what you have when someone asks.