AML/CTF Tranche 2: what a small firm actually has to do

Does this apply to my firm?

The test is the service, not the shingle. Being an accountant does not put you inside the regime and being outside professional services does not keep you out of it. What matters is whether you provide one of the designated services set out in the legislation, and that list is written around specific activities rather than job titles.

Two firms with the same qualifications can sit on opposite sides of the line. A practice doing compliance work and tax returns may be outside. The same practice setting up company structures, holding client money, or acting on property transfers is a different conversation. The professional bodies have published guidance mapping common service lines against the designated services, and it is worth reading before you decide you are exempt.

The most expensive version of this is a firm that decided informally, in a corridor, that it was probably not caught. Write the decision down, note what it was based on, and revisit it whenever the firm takes on a new type of work.

What does the regime actually require?

Six things, in rough order of how quickly they bite.

1. Enrol with AUSTRAC. Applications were due within 28 days of first providing a designated service. Enrolment is the front door and every other obligation assumes you have walked through it.
2. Appoint an AML/CTF compliance officer. A named person, appointed within 28 days of providing designated services, with AUSTRAC notified within 14 days of the appointment. In a small firm this is usually a principal, and it should be someone with the authority to stop a matter.
3. Have an AML/CTF program. A written program covering your risk assessment, your policies and procedures, your governance, training and independent evaluation. This is the document a regulator asks for first, and it is the one most small firms have not started.
4. Do customer due diligence before you act. Identify and verify the client, identify the beneficial owners behind a corporate client, and rate the risk of the relationship. Ongoing due diligence continues for the life of the relationship, not just at intake.
5. Report. Suspicious matter reports within tight statutory timeframes, plus cash transactions at or above the reporting threshold. Confirm the current timeframes and threshold with AUSTRAC rather than relying on a summary.
6. Keep records. Generally seven years, covering identification material, your program, your risk assessments and your decisions. The decisions matter as much as the documents, because a record that shows only the outcome cannot demonstrate the reasoning behind it.

Notice how much of that is process rather than judgement. That is the useful split.

What should a firm do if it missed the enrolment date?

Enrol, and get advice about the gap rather than trying to reason your way out of it privately.

The obligation to enrol does not disappear because the date went past. A firm that enrols in September is in a materially better position than one still trading unenrolled in December, and the distance between those two positions grows every week. Continuing to provide designated services without being enrolled is the exposure, not the lateness itself.

Two practical points. First, get the professional advice before you fill in the form rather than after, because the enrolment asks you to describe the designated services you provide and that description should be accurate. Second, do not treat enrolment as the finish line. A firm that is enrolled but has no program and no due diligence process has completed the visible step and none of the substantive ones.

Which parts can a system assemble, and which need a person?

This is the same line as conflict checks, drawn in the same place. A system assembles and surfaces. A person decides.

Machine work, safely:

• Collecting identity documents through a structured intake form instead of an email thread.
• Running verification against the checks your firm has chosen, and recording the result with a timestamp.
• Pulling company and beneficial ownership extracts and laying them out for review.
• Applying your risk rating rules consistently, so the same facts produce the same starting rating every time.
• Filing every artefact into the matter with a durable record of what was checked, when, by whom and on what evidence.
• Chasing missing documents, and blocking a matter from opening while anything is outstanding.
• Reminding you when ongoing due diligence falls due, which is where most firms quietly drift.

Person work, always:

• Deciding whether something is suspicious. That is a judgement about a pattern, not a rule about a field.
• Overriding a risk rating up or down, and recording why.
• Deciding whether to act for a client at all.
• Signing off the program, the risk assessment and anything that goes to AUSTRAC.

The reason to be strict about the line is not philosophical. An automation that decides is an automation that has to be defended later, and the record it leaves says the computer cleared it. An automation that assembles leaves a record that says here is what was gathered, here is what the compliance officer concluded, here is the date. The second record survives scrutiny. The first invites it.

What does this do to intake?

It moves work forward. Firms that ran a light intake process and did their checking as they went now need the checking done before the work starts, which means the friction lands on the client at exactly the moment they are deciding whether to engage you.

That is worth measuring before you redesign anything. Take your last twenty new matters, count the minutes spent on identity collection and verification per matter, and multiply by your monthly matter volume. Then count how many of those twenty needed a second or third request for documents. The first number is your compliance overhead. The second is the part a structured intake removes without touching a single judgement call.

What to do next

Confirm whether your service list puts you inside the regime, in writing, and get advice if it is not obvious. If you are in and not enrolled, enrol. Then look at your program and your due diligence process as one thing rather than two, because a program that describes a process nobody runs is worse than no document at all.

Once the process is settled, the assembly around it is a small build rather than a project: a structured intake form, verification, extracts, a filing rule and a reminder schedule. That is where Shift would start, after the decisions are written down and never before.