AUSTRAC guide to reporting entity enrolment and ongoing anti-money laundering compliance

Reporting entity status arises from actually providing one or more statutory designated services, not from having ‘financial’, ‘payments’ or ‘advisory’ in a company name, and not only after a business voluntarily obtains a number. Designated services cover financial services, remittance, foreign exchange, virtual assets, bullion, gambling and certain real estate and professional services added in 2026. Providing only software infrastructure, general advice or non-designated activities should not be treated as requiring registration in every case merely because it ‘involves money’.AUSTRAC Regulatory scope

The practical value of the regime is that it brings the business within a clear AML/CTF reporting and regulatory framework and establishes traceable customer information, funds flows and internal responsibilities. The registration status of RSP / VASP can be checked by counterparties, but enrolment or registration is not financial product approval, a guarantee of investment returns, insurance for client funds or a guarantee of opening a bank account. Business communications should accurately describe the entity name, registration category and current conditions, and must not claim AUSTRAC accreditation, a safety rating or a licence covering all business activities.

• List, item by item, the services, clients, funds or asset flows, delivery channels and statutory items.
• Separately check AUSTRAC, ASIC, APRA and relevant state/territory licences; do not extend one regulatory number to business activities for which authorisation has not been granted.
• Banks, lending, investment, payments and life insurance are regulated only where the specific designated service requirements are met; not all insurance, advice or technology platforms are automatically regulated.

For existing reporting entities, new AML/CTF plan and governance reforms, among other changes, begin to apply from 31 March 2026, unless formally extended under transitional rules. New sectors covering real estate, professional services, and precious metals and stones must meet the relevant obligations from 1 July 2026. The registration platform opening on 31 March does not mean that all obligations for these sectors take effect on that date. For businesses already providing newly designated services on 1 July 2026, the registration date then applicable was 29 July; those that start operating later calculate the deadline under the 28-day rule after commencing the service.Reform overview Announcement on new industry registration

Existing digital currency exchanges DCE automatically transition to VASP on 31 March 2026. Existing enrolment/registration does not lapse because of the reforms, and no repeat application is required for the change of name. For newly registrable virtual asset services, some substantive obligations other than Item 50A are deferred until 1 July; certain existing providers of new services that submit a registration application on time may continue operating before a decision is made. This transitional eligibility is not a general permission for new companies to operate without registration after November 2026.2026 transition rules

The initial CDD transition is available only to entities that were already registered on 30 March 2026 and maintained a compliant old-rules ACIP policy. Applicable customer categories and transition dates must be recorded by 1 July 2026; the transition period ends on 31 March 2029. New ongoing CDD has applied since 31 March 2026, and monitoring cannot also be suspended merely because initial CDD remains in transition.

• 2025-01-07: The Financial Transaction Reports Act 1988 was repealed; confidentiality and record-keeping obligations for older transactions may continue.
• 2025-03-31: Reforms to the tipping-off offence have commenced, with the core offence concerning disclosure that would or could reasonably be expected to prejudice an investigation.
• 2026-03-31: major reforms for existing reporting entities, DCE transition to VASP and launch of new forms.
• 2026-07-01: substantive obligations for new industries and some newly added virtual asset services commence.
• From 2029-03-31: IVTS reporting and the special reporting for unverified self-hosted wallets apply under transitional provisions; they cannot be described in a 2026 guide as having already fully replaced IFTI.

Enrolment involves reporting details of the reporting entity to AUSTRAC and joining the Reporting Entities Roll. Identity, structure, designated services, addresses, personnel and business information must be provided; system receipts and an AAN account number should not be presented as proof that an additional registration has been approved. Most financial, gambling, real estate and professional services entities need only enrol, but must still implement substantive compliance at the applicable time.Registration overview

Registration is a process for additional risk assessment of RSP and registrable VASP services. AUSTRAC considers compliance readiness, personnel experience, criminal and regulatory history, resources and the likelihood of genuine operations; it may approve, approve subject to conditions, or refuse. Generally, registration approval must be obtained before providing the relevant registrable service; mere enrolment, AAN or a submission receipt is not sufficient to commence operations.Official registration guide

Lawyers, accountants, conveyancers, real estate agents／developers and precious metals dealers generally do not need separate RSP／VASP registration solely because of reasonable incidental payments and receipts in their main business. Exceptions and the actual nature of the business should still be analysed case by case; casinos, financial institutions and certain international value transfer activities have separate arrangements, and cannot all be classified on the basis of the words ‘transferring money for a client’ alone.

• Registration: submit business details, obtain AAN and wait for registration confirmation.
• Registration: submit any additional forms, information and risk documents required for the applicable category, and check the approval decision and conditions.
• Ordinary registration does not generally expire after 3 years; RSP / VASP registrations are generally renewed every 3 years.
• Existing RSP／VASP must provide the additional registration information required under the reforms before their next scheduled renewal.

Designated services must have an Australian geographical connection: they are provided in or through an Australian permanent establishment; by an Australian resident in or through an overseas permanent establishment; or by a subsidiary of an Australian resident company in or through an overseas permanent establishment. A permanent establishment may include a place where business is carried on through an agent; mobile or temporary operations may also trigger the rules. This AML/CTF assessment should not simply adopt the permanent establishment conclusion under a tax treaty.Official guidance on geographical connection

Having Australian customers, a website accessible in Australia, a registered address or an Australian bank account does not, by itself, necessarily establish a geographical connection. It is necessary to analyse where the designated service is actually carried out and how accounts, servers, personnel or agents participate in the service. An RNP operating an Australian affiliate network has a specific exception and may become a reporting entity without relying on the ordinary geographical connection test.

• Map the location of personnel, offices, agents and servers in each country, who owns or operates them, and the purposes of bank accounts.
• A foreign company operating through an Australian branch may be a reporting entity; AUSTRAC does not accept only Australian Pty Ltd companies.
• Record the analysis of residency, parent and subsidiary companies, and permanent establishments, to avoid reaching an incorrect compliance conclusion based solely on a nominal address.
• Where overseas law prevents compliance, give prior notice under the applicable provisions to AUSTRAC; a ‘strictest standard’ approach cannot be used to disregard a conflict of laws.

Eligible registration structures include individuals/sole traders, companies, trusts, partnerships, associations and other statutory entities. A Pty Ltd company is a common business choice, not a required structure for AUSTRAC registration. Companies provide director and ultimate holding company details; trusts provide the type of trust, trustee and, for a corporate trustee, its directors’ details; partnerships report information about the managing partner responsible for governance and executive decisions.Registration information checklist

An Australian Pty Ltd must have at least one director who ordinarily resides in Australia; a secretary is not compulsory, but if one is appointed, at least one must ordinarily reside in Australia. Directors must be aged 18 or over and apply for a Director ID before appointment; the company must retain written consent to act. Shareholders may be overseas persons, but must comply with the company-type, fundraising and membership-number restrictions; it should not be stated that the number of shareholders is entirely unrestricted. The Australian residency requirement for the AUSTRAC compliance officer comes from a separate set of rules and is not automatically met by appointing a local director.ASIC Directors and secretary Company type

A beneficial owner is generally a natural person who ultimately owns, directly or indirectly, 25% or more of the interests, or otherwise exercises control. Disclosing the beneficial owners of the business for registration and identifying the beneficial owners of customers for CDD are two different tasks; neither can stop at an intermediate holding company. For complex overseas structures, provide the register of shareholders, an explanation of control and a verifiable structure chart.

• Companies: legal name, applicable numbers such as ACN／ARBN／ABN, directors, control hierarchy, shareholdings and voting rights.
• Trusts: deed, type of trust, trustee, and the shareholders, directors and control arrangements of a corporate trustee.
• Partnership: partnership agreement, managing partner, interests and decision-making arrangements.
• Key persons: prepare identity documents, CVs, responsibilities, training, regulatory/criminal/insolvency and conflict-of-interest information as required by the form and risk considerations.

This topic does not set a minimum share capital or NTA amount that can be applied uniformly to all reporting entities under AUSTRAC. Current official forms focus on business structure, risk policies, personnel, banking and transaction forecasts, rather than a uniform capital verification threshold. This must not be presented as meaning that businesses do not need operating funds, nor should NTA requirements for other AFSL categories be imported as registered capital for AUSTRAC. Where custody of financial products, client money or banking activities are involved, the applicable licences and their financial rules should be checked separately.AUSTRAC Registration information ASIC digital assets and financial products

An Australian company’s registered office must be a physical street address in Australia, not a post office box. An accountant’s address may be used with written consent, even if the company does not operate there; the principal place of business should reflect the genuine operating location. The applicable business address, registered office and website must be declared to AUSTRAC. An address service cannot replace an analysis of the actual permanent establishment, and a virtual address does not mean that every application is necessarily eligible or necessarily ineligible.ASIC Company address

The budget should separately account for company establishment/annual review, consultancy services, translation and background checks, personnel, CDD systems, monitoring, data storage, independent assessment and applicable industry levies. The AUSTRAC application fees of AUD 5,000 to 15,000 and uniform annual fees of AUD 3,000 to 10,000 listed in the original source are not supported by the official evidence reviewed on this occasion and will not be carried forward. Industry levies are not fixed annual fees for all entities; the current model takes into account annual revenue reaching AUD 100 million, as well as relatively large reporting volumes or amounts. Any levy invoice received must be handled in accordance with that invoice; a model review or consultation does not mean that new rates have been implemented.Industry levy

• List separately share capital, eligible NTA, liquid cash, client assets and forecast compliance expenditure; client funds must not be treated as the entity's own capital.
• Estimate compliance resources for 12 months by reference to staff, channels, services and customer risks, rather than using a single capital figure as a substitute for operational readiness.
• Check consent to use the registered office, the genuine place of business, receipt of correspondence and ability to retrieve records.
• The quote specifies who receives each fee, the scope of services and whether an independent assessment is included; consultancy fees must not be presented as government approval fees.

Enrol through AUSTRAC Online. Prepare in advance the designated services, start date, legal structure, identification numbers, directors, beneficial owners, addresses, domain names, compliance officer, employees, and information on operations and levies for the previous financial year. Report ABN, ACN, ARBN, ARSN and LEI as applicable; do not claim that every entity must have all these numbers at the same time.Prepare registration forms

Registration is not a licensing process that invariably involves prior review and certification of a complete AML manual for every applicant. Businesses must still meet requirements such as risk assessment, policies and customer due diligence before providing services, and retain documents demonstrating implementation; AUSTRAC may request further information. ‘Compliance documents that must be in place and implemented’ should be listed separately from ‘documents required to be uploaded with the form on this occasion’.

• Identity and structure pack: company/trust/partnership evidence, ownership and control chart, applicable registration numbers, and information for each relevant director.
• Business pack: mapping to specified services, client types, delivery channels, countries of operation, and start date or expected start date.
• Business operations pack: business and registered addresses, website, employees, turnover, tax residency and income and profit information.
• Governance pack: compliance officer’s name, position, date of birth, telephone number, email and mailing address; retain records of appointment and fit and proper assessment.
• Group package: names and AAN of the Lead Entity and its members; if not obtained initially, enter them later within the official timeframe for AAN.

Registration requires demonstrating effective identification, management and mitigation of money laundering, terrorism financing and proliferation financing risks. Prepare a risk assessment, senior management approval, policies, customer due diligence, personnel due diligence, training, supplier details, bank account details, countries of operation and transaction forecasts for the next 12 months. Key personnel must disclose their responsibilities, relevant business experience, domestic and overseas financial licence or registration applications, and any legal or regulatory matters.Registration document checklist

Overseas structures may require company searches, certificates of registration, constitutional documents, shareholder and director registers, trust deeds and a control chart certified by an authorised person. Australian Pty Ltd companies and sole traders are not required to provide the same proof of existence in every case; supporting material may still be required where ownership is overseas. Police checks, statutory declarations and other background checks should be prepared according to the application and circumstances; notarisation in every case, a ten-year address history or an independent network audit must not be presented as a fixed statutory checklist for all applications.

• Independent remittance: receipt and payout methods, netting or third-party settlement, channels, overseas licences, and estimated transaction volumes and amounts.
• RNP: the projected number of Affiliates to be onboarded over 3 years, registration commencement timing, Affiliate suitability, consent, training and SMR allocation policy.
• Affiliate: network/super-agent information, written network consent and arrangements for adopting the network risk policy.
• VASP: asset classes, wallets under control, deposit and withdrawal methods, transaction/time limits, channels, expected transaction volumes and comparable overseas registrations.

The application sequence should start with determining the nature of the services, not buying a company or a registration number. After preparing the entity and personnel, create a user in AUSTRAC Online, set up multi-factor authentication, submit the registration form, and retain the receipt, AAN and confirmation. A form can be saved and continued within 14 days; a new business with a different ABN requires an additional business profile.Registration operations

An entity required to register must continue completing the registration form, submitting supporting material and responding to enquiries in the same account. AUSTRAC indicates that assessment may take up to 90 days, with the period restarting after further information is provided; therefore, it must not be promoted as ‘approval guaranteed within 90 days’, nor should enrolment and registration both be described as taking a fixed 3 to 6 months. The business may go live only after completing internal systems and CDD testing and checking the approval conditions, and then only to the extent permitted by applicable law.

• Step one: Confirm the designated services, customers, geographical nexus and any other required licences or authorisations.
• Step two: Identify the entity, shareholders and directors, address, compliance officer and resources; obtain the necessary evidence.
• Step three: Develop and approve the applicable risk assessment and AML/CTF policies, and put CDD and reporting mechanisms in place.
• Step four: Submit the Enrolment; for RSP／VASP, also submit the corresponding Registration.
• Step five: Respond fully to requests for further information and retain version records; check the approval decision and its conditions, and do not treat a receipt as approval.
• Step six: Before launch, test customer verification, the SMR clock, TTR／IFTI, the Travel Rule and backup retrieval, and establish an ongoing compliance calendar.

Except where an applicable exemption applies, such as for item54 only, an AML/CTF compliance officer must be appointed within 28 days of starting a designated service, and AUSTRAC must be notified within 14 days of the appointment. If the officer leaves or ceases to be eligible, a qualified successor must also be arranged and notification made as required by the rules. A special transitional date for the first notification in 2026 has expired and should not continue to be cited for new appointments.Official compliance officer guidance

A compliance officer must be employed or appointed by the entity at management level; they must be an Australian resident when services are provided in or through an Australian permanent establishment, and must be a fit and proper person. The role may be outsourced or performed concurrently by an appropriately authorised business owner or director, but the officer must have sufficient authority, independence, resources and professional support. There is no uniform statutory AML qualification certificate or blanket requirement for a full-time employee. The fit and proper assessment should cover competence, integrity, serious criminal offences, adverse regulatory findings, bankruptcy and material conflicts of interest.

At least every 12 months, the compliance officer must report to the governing body on policy implementation, risk controls and legal compliance; this is not an annual compliance report submitted to AUSTRAC. Senior management approves the risk assessment and policies, while the governing body retains oversight responsibility. Outsourcing does not transfer the entity’s or governing body’s responsibilities, and reporting and day-to-day oversight should also be covered during short-term leave.

• Keep records of appointments, fitness assessments, role authorities, budgets and backup arrangements.
• Conduct risk-proportionate personnel due diligence and ongoing training for key compliance roles.
• There are clear escalation pathways for high-risk customer approvals, significant deficiencies, SMR backlogs and insufficient resources.
• Internal reports must retain the factual content and management’s remediation decisions; adverse findings must not be removed to meet business objectives.

The reformed programme comprises a risk assessment and policies, procedures, systems and controls proportionate to the business. The official five steps are guidance for building the programme, not a 'five-step certification' issued by AUSTRAC; mechanically replacing the old Part A/Part B wording does not establish compliance with the new law. The assessment must cover customer, product, channel and geographic risks, including proliferation financing. Changes in the business or law, feedback from AUSTRAC and adverse findings from independent evaluations may trigger review and updates.Reform overview Independent assessment and updates

Policies must be implemented in onboarding, transactions, investigations and reporting, not merely kept as templates. A small, low-complexity business may use manual controls proportionate to its risks; a large, high-speed business may need automated monitoring. The law does not impose a uniform requirement on every business to have a real-time AI system, an independent internal audit department or software from a particular brand. Before launching a new product or channel, assess anonymity, source of funds, asset flows and personnel capability.

• Risk register: inherent risks, controls, residual risks, responsible persons and assessment basis.
• Policies: personnel due diligence and training, CDD, SMR / TTR / IFTI, the Travel Rule, records, independent assessment and change governance.
• Implementation evidence: approval records, sample checks, alert investigations, system parameters, remediation verification and version control.
• Outsourcing contracts: data access, scope of services, disaster recovery, reporting responsibilities, compliance checks and termination migration.

In principle, complete initial CDD before providing a designated service. Establish on reasonable grounds the customer’s identity; any agent and their authority; the person on whose behalf the service is received; the beneficial owners of a non-individual customer; PEP; and targeted financial sanctions status. Understand the nature and purpose of the business relationship or occasional transaction. Collect and verify information appropriate to the customer’s risk, using reliable, independent data. In principle, do not provide the service if the required matters cannot be established. The law provides for delayed CDD, alternative identification and exemptions for specified services; these are subject to conditions and are not discretionary exemptions.Initial CDD

Simplified CDD is not an exemption from due diligence: the client must be low risk, must not trigger enhanced CDD, and the policy must provide for it. Company clients are not invariably high risk, and not all PEP are treated under the same rules; foreign PEP, as well as high-risk domestic / international organisations PEP, require consideration of the relevant source-of-funds and source-of-wealth requirements. Where enhanced CDD is required, take additional identification, verification, information-gathering and approval measures according to risk.

Government-issued identity documents, company information, trust deeds and reliable electronic identity data may be used, with explanations provided where necessary for discrepancies in names, addresses or ownership. Customers without standard identity documents should be assessed under formal alternative procedures; vulnerable or remote customers should not be rejected as a rule. Identity documents do not all need to be scanned and retained, but the information verified, the process and the conclusion must be recorded.

• Individuals: applicable minimum identity information, independent verification evidence, authority to act as agent and customer risk.
• Companies/trusts: legal existence, chain of control, ultimate interests of 25% or more and other controllers, trustee and agency relationships.
• Source of funds and source of wealth: collect and verify this information where required by law or relevant to risk, rather than imposing the same number of documents on every client.
• Remote onboarding: identify risks of stolen, forged and duplicate identities, and assess the reliability of data sources and the audit trail.
• Client classification transition: only eligible existing entities may rely on ACIP; new entities must not automatically rely on the three-year initial CDD grace period.

Continual CDD requires monitoring unusual transactions and behaviour, and, in an ongoing business relationship, reviewing client risk, updating and, where necessary, re-verifying KYC. Clients undertaking occasional transactions should also be subject to applicable behaviour and transaction monitoring. The intensity of review is risk-based; do not present annual reviews for high-risk clients, reviews every two or three years for medium-risk clients, or every three to five years for low-risk clients as AUSTRAC uniform statutory timeframes.Continual CDD

Rules can be established for unusual amounts, transaction splitting, third-party payments and collections, rapid in-and-out transactions, inconsistencies with the customer profile, complex structures and high-risk destinations. Each alert should have a risk rating, timely assessment, evidence, the time when reasonable suspicion was formed, and a basis for reporting or closure. If services continue after submitting SMR, enhanced CDD must apply; if some due diligence could disclose a suspicion, avoid tipping off where legally required, while completing as much monitoring as possible without causing disclosure.

• Monitor client behaviour and transactions, not only payments reaching a specified amount.
• A change in shareholder/controller, PEP status, sanctions, source of funds or services triggers a reassessment.
• Sample-check alert completeness, false positives and false negatives, processing backlogs and the timeliness of SMR.
• Customer complaints and scam leads must be referred for compliance investigation; information must not be isolated simply because it belongs to the customer service department.

A SMR must be submitted where there are reasonable grounds to suspect that information relates to crime, a false identity, or the use or proposed use of a designated service for money laundering or terrorism financing. There is no minimum amount, and proof that the customer has committed an offence is not required. A customer request, a proposed service or a service that is not ultimately completed may still trigger the obligation. A suspicion of terrorism financing must be reported within 24 hours of forming the suspicion; other suspicions must be submitted within 3 business days after the day on which the suspicion is formed. Not all SMR should be described as requiring “immediate” reporting, nor should the clock mechanically start when an automated alert first appears.SMR Official guidance

Where legal professional privilege is claimed over some information, an arrangement is generally available to submit the SMR and LPP forms within 5 business days; the extension does not apply to terrorism financing time limits. Cases where all information giving rise to suspicion is protected by LPP must be assessed under the formal rules. Do not treat privilege as an exemption from reporting for a lawyer’s entire business. If a new reasonable suspicion arises, submit a separate report and refer to the earlier number; do not delay an SMR that is already due while waiting for enhanced CDD to be completed.

From 31 March 2025, the tipping-off framework focuses on disclosure that would, or could reasonably be expected to, prejudice an investigation; access to sensitive reports must be strictly restricted. Not all information exchange within the scope of compliance is absolutely prohibited, but you must not disclose to a client that an SMR has been made or must be made if doing so would prejudice an investigation. Do not include tax file numbers TFN in material submitted to AUSTRAC, and do not invent unknown facts.

• Record the date and time an anomaly was identified, the assessment of the material and who formed the reasonable suspicion.
• The report explains who, what, when, where, why the suspicion arose and how it occurred; related transactions and previous report reference numbers must be accurate.
• New entities registered after 2026-03-30 must use the new SMR forms from 2026-07-01; eligible existing entities may convert under the rules before 2029-03-30.
• Submitting an SMR is not a conviction and does not automatically require ending a customer relationship; continuing the relationship requires being able to manage the risk and apply applicable enhanced CDD.

When providing a designated service, actually receiving or paying banknotes or coins totalling AUD 10,000 or more in a single transaction, or the foreign currency equivalent, generally triggers TTR. It must be submitted within 10 business days after the day of the cash transaction. Electronic transfers, cards and cheques do not trigger TTR merely because the amount reaches AUD 10,000; where a customer deposits cash into a merchant's bank account, the financial institution that actually receives the cash generally reports, not the merchant that did not handle the cash.TTR official guidance

TTR is generally assessed for each cash transaction. There is no general rule, as stated in the original guide, that ‘the same customer’s total of 10,000 within 24 hours triggers TTR’. Structuring to evade reporting may trigger SMR. The new designated service for precious metals and gemstones has a separate threshold based on a single cash/virtual asset transaction or the aggregate of related transactions: this regulatory threshold must not be conflated with the TTR single cash transaction threshold.

RNP submits TTR for Affiliates' transactions that meet the threshold; other relief must be assessed against its specific conditions. Newly enrolled entities use the new TTR form; entities already enrolled on 30 March 2026 may transition under the transitional rules between 1 July 2026 and 30 March 2029.

• Identify the actual dates on which cash is received or paid; do not wait for the contract signing or property settlement date.
• For transactions mixing cash and non-cash components, check only the reportable cash portion.
• A single payment for multiple services must not be artificially split into several payments to circumvent TTR.
• Where splitting is suspected, assess SMR; an amount below TTR does not mean that CDD or risk enquiries are unnecessary.

IFTI covers instructions accepted in Australia that make funds or property available overseas, or instructions accepted overseas that make them available in Australia. The relevant sending/receiving entity usually reports within 10 business days after the day the instruction is sent or received; the period does not start when the transaction actually settles, and it is not the case that every ordinary customer who pays an overseas bill personally reports IFTI. IFTI-E and IFTI-DRA responsibilities are assessed by reference to the financial institution or designated remittance chain; where a network affiliate uses the RNP network, RNP bears the corresponding reporting responsibility.IFTI Official guidance

The current transition preserves the old IFTI until the IVTS conversion date, usually 31 March 2029. Eligible entities may choose an alternative date that is no earlier than that date and no later than 30 September 2029; additional restrictions apply to international transfers of virtual assets. Entities that provide only items 29／30 virtual asset transfer services and do not transfer money or property are not currently required to report under IFTI on that basis alone. Using virtual assets as a settlement method for money remittances does not automatically qualify for an exemption. To meet the specific non-reporting conditions for unexecuted instructions, it must be reasonably determined within 10 business days that no transfer will occur, and reasonable steps must be taken to prevent it.2026 transition rules

The Travel Rule is a regime for collecting, verifying and transmitting payer, payee and tracing information in a value transfer chain, and is distinct from submitting IFTI to AUSTRAC. For virtual assets, identify custodial／self-hosted wallets, the other party institution's appropriate licensing and information security; an exemption from transmitting messages to another institution for self-hosted wallets does not mean that identity and tracing information need not be collected. No deferral has been verified for special reporting on self-hosted wallets until 31 March 2029; this does not affect current SMR or other obligations.Travel Rule Additional virtual asset rules

An additional CBM obligation applies when carrying, mailing or receiving physical cash and bearer negotiable instruments across borders totalling AUD 10,000 or more. Carried items must be reported before passing through Customs; mailed or transported items must be reported before sending; currency instruments received from overseas must be reported within 5 working days of receipt. CBM is not a domestic electronic transfer report, nor is it the ECTR conflated in the source.CBM Official guide

• Distinguish the customer, ordering institution, intermediary and beneficiary institution, and clarify IFTI and travel rule responsibilities.
• Establish procedures to investigate, supplement, reject or mitigate risks arising from missing or inaccurate transfer messages.
• Do not accept instructions from, or make assets available to, an unlawful virtual asset counterparty institution that ought to be licensed but is not.
• Treat 2029 as a system planning milestone; do not tell 2026 users that all IFTI have changed to IFTR.

The seven-year period does not start uniformly from the last transaction for all documents. CDD records must be kept for 7 years from completion of an occasional transaction or the end of an ongoing business relationship; general transaction records for 7 years from the date they are created; transaction documents provided by customers for 7 years from receipt; and AML/CTF plan records for 7 years from when they are no longer relevant to demonstrating compliance. Therefore, a policy still in use cannot be deleted simply because it was written seven years ago.Official record-keeping guidance

Records must be capable of demonstrating CDD and plan obligations and accurately reconstructing transactions, including the customer, counterparty, amount, asset, time, instructions and reporting decisions. Records may be paper or electronic and kept on-site or off-site; they must be secure, access-controlled, searchable and convertible into English. The law does not universally require every passport scan to be retained, but records of the verification process and information must be kept. Reporting entities, including small businesses, must comply with applicable Privacy Act requirements.

• Set retention and destruction periods by record category, taking account of litigation／investigation holds and any longer requirements under other laws.
• Retain policy versions, approvals, independent assessments, remediation, personnel due diligence and training, and supporting material for reports.
• Apply least-privilege access, logging, backups and recovery testing to SMR and identity information.
• After outsourcing, sale, cessation of business or system migration, lawful access and adequate retention periods must still be arranged.
• The results of assessments of reliance on third-party CDD must be retained in accordance with official record-keeping and time-limit requirements; supplier assurances are not a substitute for evidence.

Under the new regime, Independent Evaluation assesses the entire AML/CTF programme, including risk assessment, policy design and actual implementation, not just the former Part A. The general minimum is once every 3 years; frequency must suit the nature, size and complexity of the business and be explained in the policy. It may be conducted by an independent internal person or an external evaluator; there is no universally mandatory qualification certificate. A compliance officer responsible for designing, assessing the risks of or maintaining the programme cannot independently evaluate their own work.Official independent assessment guide

The initial transition arrangements must be calculated separately. For newly regulated entities or entities previously covered only by item54, the deadlines depend on whether the final two digits of AAN are odd or even: both odd, 30 June 2029; penultimate digit odd and final digit even, 31 December 2029; both even, 30 June 2030; penultimate digit even and final digit odd, 31 December 2030. For entities already enrolled on 30 March 2026 that had undergone an independent review under the previous arrangements, the first assessment is due no later than the later of 4 years after the most recent review and 31 March 2027. Other cases must be checked against the applicable policies and rules; a deferral must not be applied where the eligibility requirements are not met.Initial assessment transition rules

The assessor issues a written outcome to the governing body and the senior manager responsible for approving the plan. Adverse findings must be reviewed and, where necessary, the risk assessment and policies updated, with the responsible person, deadline, verification and reasons for non-adoption recorded. After updating a policy or risk assessment, record the update within 14 days as required by official requirements; obtaining a report does not mean that the regulator has determined that remediation is complete or granted certification.

• Calculate the date of this entity’s first assessment and retain the supporting basis; an earlier voluntary assessment may identify issues, but is not a uniform statutory commitment.
• Check the assessor’s independence, industry and AML knowledge, sampling and reporting capabilities.
• Provide appropriate customer files, transaction, systems, training and management records.
• Close issues through remediation and retesting; having been audited is not a substitute for effective controls.

Annual compliance reporting is now based on the financial year. The next reporting period is 1 July 2026 to 30 June 2027, with filing due within 3 months after the end of the period—that is, between 1 July and 30 September 2027. Generally, the same window applies each year thereafter. It is no longer correct to say that all reports are filed from January to March after the calendar year. The administrator of the AUSTRAC Online account must submit the report and ensure that the designated services and contact details are accurate.Official annual reporting guide

Pure RNP affiliates that provide no other designated services; AFSL holders providing only item54; small venues licensed to hold no more than 15 electronic gaming machines and providing no other designated services; and entities expressly exempted on an individual basis may be exempt from lodgement. A group is generally reported by one member on behalf of the group. A sale, closure or merger, or having provided no services during the year, should still be explained in the form and the register removal process addressed; no transactions does not automatically mean that all obligations have ceased.

Annual reporting to AUSTRAC, compliance officer reporting to the governing body at least every 12 months, ASIC company annual review and financial reporting, and tax returns are separate tasks. It should not be stated as a universal rule that every reporting entity must lodge audited financial statements with AUSTRAC.

• Keep evidence supporting report responses, submission permissions, reviews and acknowledgements.
• Check whether eligibility for the exemption is lost on the addition of a specified service.
• Record the membership scope of group reporting and notify members of what has been submitted.
• List compliance officer reports, independent assessment, company annual review and tax separately in the internal governance calendar.

Registration information and circumstances that may affect RSP／VASP registration generally must be updated within 14 days of a change, including beneficial owners, key personnel, addresses, countries, third-party arrangements, overseas licences and significant enforcement or litigation information; RNP must notify AUSTRAC within 7 days of receiving a change relating to an affiliated business. The 28-day requirement for changes to most company details under ASIC is a separate regime and must not be treated as the AUSTRAC notification deadline.Registration updates Registration updates

An acquisition is not the purchase of a freely transferable ‘AUSTRAC licence’. Although a share transaction may retain the original legal entity, check its current registration, conditions, genuine business activity, new beneficial owners, management and risk resources. For an asset transaction, a new ABN or a change to another service provider, the actual new provider must confirm its registration and any required service-provider registration; do not assume the old number can be used. A shell or long-dormant VASP may have been deregistered or face registration-related action. Commercial due diligence must verify this rather than relying only on an old certificate.Official explanation of cleaning up shell registrations

RSP／VASP registration is valid for 3 years, and a renewal application may be submitted within the 90 days before expiry. If submitted on time within that window, registration may continue until AUSTRAC makes a decision. Without renewal, registration expires and the relevant services cannot continue; a subsequent application is treated as a new registration. Enrolment alone has no equivalent general renewal cycle, but information, compliance and reporting must always be kept accurate.

• Before acquisition: verify the legal entity, AAN, registration category, expiry, conditions, suspension/cancellation and public regulatory records.
• Compliance due diligence: sample testing of CDD, the timeliness of SMR／TTR／IFTI, independent assessments, remediation, historical client funds and record integrity.
• Personnel and funding due diligence: new controllers, directors, senior executives, compliance officer, source of acquisition funds, and consents to bank and supplier contracts.
• Completion conditions: necessary licences and registrations, approval of new management, data migration and access to historical records, and allocation of responsibility for reportable changes and reporting.
• After completion: review the plan against the risks of new customers, products and countries; do not continue using the seller’s template mechanically.

AUSTRAC Registration documents ask about bank accounts, but this does not mean that every reporting entity must first open an account with a local bank to register. Banks separately assess the business, ownership, source of funds, customers and risks; existing registration does not guarantee account opening or that an account will not be closed. Preparing information on actual fund flows, settlement countries, monitoring and the intended use of the bank account can assist discussions. Remittances or virtual asset activities must not be concealed, and transaction-splitting must not be encouraged to reduce scrutiny by the bank.

Systems should support identity verification, alerts, reporting, access controls and seven-year retrieval, with manual or automated processes chosen according to the scale and risk of the business. The use of AI, blockchain analytics or biometrics must be assessed for data, errors, privacy, failures and human review; these must not be described as technologies certified by AUSTRAC. Outsourced consultants, CDD providers and reporting services can assist with compliance, but the entity retains responsibility and must have access to evidence.Initial CDD data requirements Record retention

Customer complaints, leads concerning scam victims, unauthorised transfers and security incidents must have a compliance escalation channel. If also subject to AFSL client money rules, applicable client money must be segregated as required by ASIC; this must not be described as a uniform client money protection regime imposed by AUSTRAC on all foreign exchange, remittance or virtual asset businesses.ASIC client money and custody overview

• Account-opening pack: genuine business model, legal structure, source of funds, approved registration and conditions, forecasts, and compliance governance.
• Supplier pack: due diligence on services and data sources, contracts, searchable evidence, review and exit arrangements.
• Continuity: system backups, cover for reporting, bank channel outages and emergency client payments.
• Do not address de-banking by hiding business activities, using another company’s account or splitting payments.

High registration risk, false or omitted key information, a lack of genuine operations, insufficient personnel capability, a history of legal breaches or failure to comply with conditions may lead to refusal, approval subject to conditions, suspension, cancellation or refusal to renew. Statutory consequences may include remedial directions, infringement notices, and civil or criminal consequences. Penalties depend on the specific provision, penalty units and circumstances of the case; the original fixed range of AUD 50,000 to AUD 5 million should not be presented as a general statutory fee schedule. Whether internal or external review is available should be determined by reference to the notice and current procedures; do not copy outdated agency names.Registration decisions and review

When ceasing to provide designated services, apply through AUSTRAC Online to be removed from the Roll and any applicable register; annual reporting and other obligations may continue while you remain on the Roll. Before exit, deal with outstanding reporting, customer funds and assets, suppliers, account access, tax and other licences, and appoint a records custodian. Ceasing sales or deregistration does not erase historical breaches or record-retention obligations for the required period.Removal from the register

• Regulatory enquiries: confirm the scope and deadline, preserve evidence, and have the responsible person coordinate an accurate response without deleting or altering records.
• Defect handling: identify impacts on customers/transactions, stop non-compliant steps, assess further reporting and legal advice, and retest remediation.
• Exit: specify the actual cessation date and removal from the register, and report sales, closures or absence of services using the annual form.
• Retain historical records and responsible contacts, and arrange for practicable long-term custody before deregistering the entity.

Rengangyongsheng (Hong Kong) Limited can assist, as agreed, with assessing business activities and geographical connections, compiling structural information, preparing registration materials, risk assessment and policy design, personnel training, system requirements, regulatory enquiries, acquisition compliance due diligence and ongoing maintenance. Translation, notarisation, Australian company incorporation, addresses, account opening, accounting and tax services, or independent assessments must be agreed separately according to the actual scope. Legal, tax and professional judgements are handled by appropriately qualified professionals. Services do not include a guarantee of approval, a guarantee of account opening, any special relationship with a regulator or certification of the safety of funds.

Use official AUSTRAC guidance on registration procedures, CDD and statutory reporting, as well as guidance on building procedures, for role-related learning, then adapt the material into the business’s own scenarios and practical exercises. When arranging an independent assessment, check for conflicts of interest between the assessor and those who designed the plan; the people who prepared the same plan must not independently certify their own work. This guide consolidates and deduplicates the user’s own original guide and makes corrections based on the official sources listed; it does not repeat unverified claims about numbers of successful cases, years of experience, regulatory relationships or qualifications.

Byline: Drew Tang (Mr Tang/Drew), Business Manager; Rengangyongsheng (Hong Kong) Limited; Rengangyongsheng (Hong Kong) Limited. Website: afsl8.com. Content verified up to 5 November 2026. This is a general business guide, not legal, tax or investment advice for any particular case. Before implementation, check the specified services, statutory exemptions, current rules, approval conditions and professional advice.

• Application support: business interviews, mapping of specified services, document checklist, forms and coordination of supplementary information.
• Operational support: CDD and reporting processes, training, compliance calendar, policy changes and remediation follow-up.
• Transaction support: pre-acquisition compliance document review, completion conditions, and arrangements for personnel and records migration.
• Commitment boundaries: no fabrication of AUSTRAC certification and no operating the business on behalf of clients; actual statutory responsibilities remain with the reporting entity.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions