Writing the policy is the easy part

A compliance program is judged on what you can show you did — not on what the document says you would do. That difference decides what you need to keep.

23 September 2026 · Amanda Dunn · 5 min read

Most businesses newly caught by the AML/CTF obligations start in the same place: they get a program written. A risk assessment, a set of policies, the customer due diligence forms. It feels like the hard part, and finishing it feels like finishing.

It is not the hard part. The hard part is everything that happens afterwards, every week, for years — and being able to prove it happened.

A policy says what should happen. Records say what did.

Your program document describes the checks you intend to run, the risk ratings you intend to apply, and the reviews you intend to do. It is a statement of intent. On its own it evidences nothing about any actual customer.

What evidences your compliance is the trail underneath it: this customer, identified on this date, by this person, against these documents, rated this way, for this reason. Multiply that by every customer and every service, and keep it for the full retention period.

If those two things disagree — if the policy says every customer is screened at onboarding and the records only show screening for some — the records are what you have. The policy just makes the gap easier to see.

What that means in practice

Reading your own program back with that lens is uncomfortable but useful. For each thing it commits you to, ask a blunt question: if someone asked me to show this for a customer from eight months ago, what exactly would I hand over?

Customer due diligence — what you collected, what you verified it against, and when.
Risk ratings — not just the rating, but what drove it.
Sanctions screening — that a check ran, what it ran against, and what it returned. A clear result is a result worth keeping.
Ongoing reviews — that a review was actually done, not just that one was due.
Training — who was trained, on what, and when.
Decisions — particularly the judgement calls. Why you concluded what you concluded.

The last one is where spreadsheets tend to fall over. A date in a column tells you something happened. It rarely tells you what was considered, and nobody remembers eight months later.

Why this is an administrative problem, not a legal one

None of this is conceptually difficult. Every one of those records is something a careful practitioner would know to keep. The difficulty is volume and consistency — doing it the same way, every time, while running an actual business, and being able to find any of it later.

That is the honest description of the problem: not that the obligations are impossible to understand, but that running them properly is a standing administrative load most small practices were never staffed for.

Where software helps, and where it does not

Software cannot make your compliance decisions. It cannot tell you whether a customer is high-risk, whether a matter is suspicious, or how the Act applies to your business. Anything sold as a "done for you" compliance button deserves your scepticism.

What it can do is make the record-keeping a by-product of the work rather than a second job. If the due diligence is completed in a system, the record exists because the work was done in it — not because someone remembered to write it down afterwards.

That is what Curlew Comply is for. Guided CDD forms matched to the customer type, automatic screening against the DFAT Consolidated List as part of the flow, review dates set when you complete the due diligence, and an audit trail that accumulates without anyone maintaining it. You still own every compliance decision. You just stop rebuilding the paperwork around them.

Where to start

If you already have a program written, you are further along than you think. Take one section of it and try to produce the evidence for a single real customer, end to end. Whatever you cannot lay your hands on in a couple of minutes is the part of your program that currently exists only on paper.

That exercise costs an afternoon and tells you more than another read-through of the policy ever will.