What the AML/CTF Act requires of a Tranche 2 reporting entity from 1 July 2026, and how each obligation maps to a screen: program, clients and KYC, reviews, reports, training, audit trail.
What the law asks. A firm that provides a designated service must enrol with AUSTRAC as a reporting entity within 28 days of starting to provide it. Enrolment is done on AUSTRAC Online; it is free and takes under an hour.
In LedgerAML. LedgerAML keeps enrolment on your Overview checklist so it is not forgotten, and records the designated services you selected so your enrolment and your program say the same thing.
What the law asks. The Act requires a written program with two parts: an assessment of the money laundering and terrorism financing risk your firm faces, and the policies and procedures you use to manage that risk. It must be approved by senior management and kept current.
In LedgerAML. You answer a short questionnaire about your practice: services, staff, the risk factors that apply, and who your compliance officer is. The program is generated from those answers as a document you can print, sign and adopt. Every save creates a new version with a date, so when AUSTRAC asks when the program was last reviewed, the answer is on file.
What the law asks. Every reporting entity must appoint an AML/CTF compliance officer at management level. In a small firm that is usually the principal. The officer is responsible for the program, staff training and reporting to AUSTRAC.
In LedgerAML. The officer is named in your program and shown on the Overview, and the annual review reminder is addressed to them.
What the law asks. Before you provide a designated service you must collect and verify the identity of the client, and of the beneficial owners of a company or trust, using a reliable and independent document. You must also understand the purpose of the relationship.
In LedgerAML. The Clients screen records the client type, the document sighted, who verified it and when, and any extra risk factors such as a politically exposed person, cash payments, a third party instructing, or an unclear source of funds. A rule set scores each client and rates them low, medium or high risk as you type.
What the law asks. Due diligence does not end at onboarding. Client files must be reviewed on a schedule set by risk, and high-risk clients need enhanced due diligence: source of funds, senior approval and closer monitoring.
In LedgerAML. The Reviews screen lists everything due, in date order: high-risk clients every 6 months, medium every 12, low every 24, plus the annual review of the program itself. One button marks a review done and records it in the audit trail.
What the law asks. If you form a suspicion that a matter may involve money laundering or terrorism financing, you must lodge a suspicious matter report within 3 business days (24 hours for terrorism financing). Cash transactions of AU$10,000 or more need a threshold transaction report within 10 business days. Each year you lodge a compliance report.
In LedgerAML. The Reports screen logs the suspicion or the cash transaction, starts the clock and shows the due date. When you lodge with AUSTRAC you mark it done. At year end it generates a summary of the year from your records to help with the annual compliance report.
What the law asks. Identification records, transaction records, reports and the program itself must be kept for 7 years after the client relationship ends.
In LedgerAML. LedgerAML never physically deletes a client record; archiving removes it from your register but keeps it stored. Every action in the firm is written to an audit trail with a timestamp that cannot be edited, and you can download it as a CSV at any time.
Fourteen days free. No card details until you decide to keep it.