CC-101 · Lesson 3 · The core obligations, one screen each

What an AML/CTF program is actually made of

People talk about "the AML/CTF program" as though it is a document. It is six moving parts, and knowing which is which makes the whole thing far less daunting.

23 September 2026 · Amanda Dunn · 5 min read

Ask around an agency what the AML/CTF program is and you will get "the folder" or "the policy". Both undersell it, and both lead to the same failure — a firm that has written something and is not running anything.

Here is the whole structure, named plainly.

One — the risk assessment

Your documented view of the money-laundering and terrorism-financing risks your particular business faces. Your customers, your services, the countries involved, how you deliver. Everything else is built on it, which is why doing it generically is such a waste — a copied risk assessment describes somebody else’s business.

Two — the policies

What you will actually do about those risks. The rules your firm operates by: who checks what, at what point, what happens when something is flagged, who decides.

Three — customer due diligence

Knowing who you are dealing with before you provide the service. Identity, the people who really own or control a customer that is a company or trust, and a risk rating that reflects what you found.

The ordering matters more than anything else in this list: due diligence comes before the service, not after. When exactly that bites, and what the backstops are for a property transaction, is worth checking against AUSTRAC’s current guidance rather than taking from any summary — including this one.

Four — reporting

Telling AUSTRAC the things you are required to tell them. Suspicious matters, transactions over a threshold, certain cross-border movements. The mechanics live in your reporting processes; the obligation sits with the business.

Five — record keeping

Keeping what you did, for as long as you must. Due diligence records, the versions of your program, training, the reports you lodged. This is the part that turns a program you ran into a program you can demonstrate.

Six — governance

Somebody owns this. A named compliance officer, a governing body that receives a report on how the program is going, and reviews that actually happen. In a small firm the governing body may be one person — that is fine, provided it is decided rather than assumed.

Why the shape matters

Most firms that get into trouble have not skipped a part. They have written all six and run two. The document set is the easy half.

Writing the policy is the easy part →What your program is actually judged on.

Where Curlew fits

Curlew generates the first two from AUSTRAC’s starter kits for your sector — a risk assessment and a policy and process set you customise to your business rather than build from a blank page — and then carries the other four: guided due diligence with risk rating, a reporting workflow, a document register with an audit trail, and the review and governance dates tracked rather than remembered.

Six parts in one place, which is mostly the point.