Treat the program as a system of work
An AML/CTF program connects the risk assessment and policies to daily work. AUSTRAC’s overview includes governance, approval, operation, monitoring and review. Adapt a template to your own services and processes. A Starter Kit does not confirm compliance.
Ask staff to show how they use a policy. Identify the instruction, action and resulting record. If these are unclear, revise the procedure so staff can use it.
Source: AUSTRAC: Your AML/CTF program.
- Policy trigger
State when staff must act.
- Person and information
Identify who receives the case and what they need.
- Decision and response
Return the decision to the person handling the customer.
- Record and check
Keep the result and inspect a sample file.
Turn a policy into a working instruction
Invented example. Illustrative implementation exercise. A documented policy needs a working process. This sequence is not a complete evaluation method.
Follow the process from top to bottom.
Trace one policy into practice
Choose a policy requirement and follow it through the customer process. Identify the trigger, the person who acts, the information used, the decision and the record produced. Then inspect a sample file to see whether those elements are present. This is a suggested implementation exercise, not a complete evaluation method. It can reveal missing access, an unclear handover or a form that omits information staff need.
Source: AUSTRAC: Your AML/CTF program.
Invented example: an escalation rule
Suppose a policy tells staff to escalate unresolved information. The firm identifies who receives the case and what staff must include. It defines how the decision returns to the customer team. It also identifies what happens while the issue remains unresolved. The example is intentionally about a process, not a particular legal trigger. A short, tested instruction can be more useful than a long paragraph that leaves staff to invent the route each time.
Source: AUSTRAC: Your AML/CTF program.
Maintain the connection
When you update a policy, update the related forms, system prompts and staff instructions. Record the approved version and examine whether the revised process works after introduction. Use incidents and recurring questions to identify where instructions need attention. Keep the business risk assessment connected to the controls it supports, so changes in services do not leave old procedures in place by accident. The aim is a traceable relationship between the risk, the approved response and the evidence of what staff actually did.
Source: AUSTRAC: Your AML/CTF program.
Use staff questions as evidence
Ask staff to explain one procedure in their own words and show where they record the result. Differences can reveal unclear instructions or training needs. Correct the source of the confusion and test again on a later sample. The exercise tests whether staff can use the procedure. It does not replace independent evaluation.
Source: AUSTRAC: Your AML/CTF program.