Step 3: Maintain and review your legal profession program
Learn how to keep your anti-money laundering and counter-terrorism financing (AML/CTF) program current, and support governance and oversight.
On this page
- Keeping your program up-to-date and effective
- What triggers a program review
- What happens when a review is triggered
- Documents to maintain and review your program
- Updates to the starter kit
Keeping your program up-to-date and effective
Your AML/CTF program is not static. It must remain current as risks, operations and regulatory expectations change.
Read the Maintain the AML/CTF program policy in the policy document (Word, 1.04 MB) you customised at Step 1 to understand how to maintain and review your program.
Risks change as your clients, services or jurisdictions change, or as new risk indicators emerge.
Your program includes regular reviews to:
- identify new or emerging risks
- check that current controls are still suitable
- spot gaps or weaknesses
- make updates where needed.
What triggers a program review
Your program identifies events that need a review, including:
- significant changes to your services, delivery channels or clients
- changes to ML/TF risk
- regulatory or legislative updates
- adverse findings from an independent evaluation
- internal incidents or control failures
- scheduled periodic reviews.
What happens when a review is triggered
When a review is needed, you follow the processes in your program to:
- review and update the risk assessment
- confirm whether risks remain within your risk appetite
- update controls where required
- update affected policies, processes and forms
- communicate changes and provide training if needed.
This ensures all parts of your program remain aligned.
Documents to maintain and review your program
The Maintain the AML/CTF program policy in the policy document (Word, 1.04 MB) explains the processes and forms you use and when.
The following table summarises review triggers and the relevant process or forms to help you check that your program is running effectively.
The forms are available in the document library.
| Review trigger | What this means | Supporting process and forms |
|---|---|---|
| Changes to your designated services | When you introduce, change or stop providing a designated service that may affect ML/TF risk. This also applies to changes in new or emerging technologies which may affect how you provide designated services to clients. |
Process
Form
|
| Changes to the clients you deal with | When you begin or stop servicing kinds of clients. |
Process
Form
|
| Changes to countries you deal with | When you begin or stop servicing clients linked to a particular country, or there are changes to the risks associated with that country. |
Process
Form
|
| Other changes to ML/TF risk | New or emerging risks identified internally or externally. |
Processes
Form
|
| AUSTRAC communications |
We communicate information relevant to your ML/TF risk. This includes national risk assessments, indicators of suspicious activity and direct communications from us. We may provide feedback directly to you or your sector on relevant ML/TF risks.
|
Process
Form
|
| Adverse findings from independent evaluation | Where an independent evaluation report identified issues with parts of your AML/CTF program, you will need to address those issues as soon as practicable. |
Process
Forms
|
| Internal incident or control failure | Where a breach, error or weakness in AML/CTF controls is identified |
Form
|
Updates to the starter kit
We will update the starter kit when new ML/TF risks are identified, existing risks or obligations change or small practices in your profession change how they operate.
We will notify you when updates are available.
If you customised the starter kit to build your AML/CTF program, you must review these updates and decide if they should be incorporated into your program.
The program starter kits are intended to be used as a complete package and have been designed for use by those reporting entities who satisfy certain suitability criteria. That suitability criteria is set out in the ‘Getting Started’ web page under the heading “Who the starter kit is for” in each program starter kit. In particular, those Tranche 2 entities who, from 1 July 2026, are for the first time subject to Anti-Money Laundering and Counter-Terrorism Financing legislation (AML/CTF).
The program starter kits have been designed for the purpose of providing practical guidance to those reporting entities to assist them to build their own AML/CTF programs. The program starter kits represent AUSTRAC’s interpretation and application of the law to the eligible reporting entities only and are not intended to represent an interpretation and application of the law in all circumstances. The program starter kits are not a substitute for legal advice about any reporting entity’s AML/CTF compliance obligations. Australian courts are ultimately responsible for interpreting the AML/CTF Legislation and determining if any provision of these laws are contravened.
This guidance sets out how we interpret the Act, along with associated Rules and regulations. Australian courts are ultimately responsible for interpreting these laws and determining if any provisions of these laws are contravened.
The examples and scenarios in this guidance are meant to help explain our interpretation of these laws. They’re not exhaustive or meant to cover every possible scenario.
This guidance provides general information and isn't a substitute for legal advice. This guidance avoids legal language wherever possible and it might include generalisations about the application of the law. Some provisions of the law referred to have exceptions or important qualifications. In most cases your particular circumstances must be taken into account when determining how the law applies to you.