The short answer
AUSTRAC describes an AML/CTF program as two things together: the money laundering and terrorism financing (ML/TF) risk assessment, and the AML/CTF policies. The risk assessment comes first and shapes the policies.
The program is the name for both parts together. A business that has procedures but no risk assessment has, on AUSTRAC’s description, only part of a program.
Source: AUSTRAC: Program overview.
- AML/CTF program
The whole. It is documented, approved by a senior manager, followed, reviewed and independently evaluated.
- ML/TF risk assessment
Identifies and assesses the risks the business may reasonably face. It comes first and shapes the policies.
- AML/CTF policies
The policies, procedures, systems and controls that manage those risks and meet AML/CTF obligations.
The program contains the risk assessment and the policies
AUSTRAC’s description of a program. A set of procedures without a risk assessment is only one of the two parts.
Separate evidence questions. An answer to one does not settle the others.
What counts as an AML/CTF policy
The word covers more than policy statements. AUSTRAC uses AML/CTF policies for the policies, procedures, systems and controls that work together to manage and mitigate ML/TF risk and to make sure the business meets its AML/CTF obligations.
A system can be a policy in this sense. AUSTRAC’s example is transaction monitoring software used to watch for higher risk cash transactions. Material that is not needed to show how the business achieves those two outcomes sits outside the AML/CTF policies. AUSTRAC’s examples are individual lines of code and procedures for meeting software licence conditions.
Source: AUSTRAC: Why your AML/CTF policies are important; What must be documented and approved?.
What applies to the program as a whole
AUSTRAC’s overview lists what applies to the program: it is in place before the business starts providing a designated service, documented in writing, approved by a senior manager and followed. The same list includes reviewing and updating the program, periodic independent evaluation and record keeping.
The program can sit in one document or several. AUSTRAC says updates are documented within 14 days after the update occurs. A senior manager approves the first program. AUSTRAC’s summary says updates are approved too, and its detail describes which ones: new or significantly changed risks in the risk assessment, and material changes to how the policies work. A routine software update is AUSTRAC’s example of a change that would not need that approval.
Sources: AUSTRAC: AML/CTF program obligations; AUSTRAC: Document and approve your AML/CTF program; How to document and approve your AML/CTF program.
What AUSTRAC expects of the policies
AUSTRAC expects the policies to be targeted at the risks in the risk assessment, proportionate to the level of each risk, ongoing, and effective in practice. It also says they are to suit the nature, size and complexity of the business.
For a small practice this may mean short procedures tied to the few services it provides. AUSTRAC says it generally expects larger, more complex businesses to have more extensive policies than smaller ones.
Source: AUSTRAC: Tailoring to size, nature and complexity; Our expectations.
Invented example: a folder called AML policy
A fictional three-person accounting practice keeps a folder called AML policy. It holds a customer identification procedure and a staff checklist. Nothing in it records how the practice’s services could be misused.
Using the distinction on this page, the owner may see that the folder holds policies only. Possible next steps are to write the risk assessment, check that each procedure responds to a risk in it, and record senior manager approval of both parts. These are suggested steps for the example. They do not show that the practice meets its obligations.
Source: AUSTRAC: Program overview.