An AML/CTF program includes an ML/TF risk assessment and AML/CTF policies. 

Reporting entities must have and comply with an AML/CTF program.

See

AML/CTF Act 2006 Part 1A