Training is written into the obligation
An AML/CTF program is not only documents. The Act requires a reporting entity’s policies to deal with training the people who perform its obligations — on the risks the business faces and the rules it must follow. Here is what the law actually says, and why no software or adviser replaces it.
In the law’s own words
Two provisions carry the training obligation
Since 1 July 2026, the AML/CTF regime has applied to designated services provided by the Tranche 2 professions. A reporting entity must have an AML/CTF program, and the Act lists the matters its policies must deal with. Training is one of them — and the Rules then say what that training has to look like.
“… providing training to persons who are employed or otherwise engaged by the reporting entity and who perform, or will perform, functions relevant to the reporting entity’s obligations under this Act in relation to: (i) the risk of money laundering, financing of terrorism and proliferation financing that the reporting entity may reasonably face in providing its designated services; and (ii) the obligations imposed by this Act, the regulations and the AML/CTF Rules on the reporting entity;”
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), s 26F(4)(e) — Compilation No. 62 (C2026C00274)
“The AML/CTF policies of the reporting entity must deal with both initial training upon a person’s employment or engagement and ongoing training during a person’s employment or engagement. … the training provided to a person: (a) is appropriate having regard to: (i) the particular function performed by the person; and (ii) the particular risks of money laundering, financing of terrorism and proliferation financing that are relevant to the person’s function; and (iii) the particular responsibilities of the person under the AML/CTF policies; and (b) is readily understandable by the person.”
AML/CTF Rules 2025, s 5-9(2)–(3) — Compilation No. 1 (F2026C00274)
The Explanatory Memorandum to the 2024 amendment puts it plainly: the policies must cover “how a reporting entity will provide risk awareness and management training to staff engaged by the reporting entity”. And training is visible to the regulator in other places too — registration applications under the Rules ask for the name and address of any training provider used in the previous 12 months.
Explanatory Memorandum, AML/CTF Amendment Bill 2024, para 100 · AML/CTF Rules 2025, s 4-6(2)
The part no one can do for you
Software and advisers help. They don’t understand for you.
Software keeps the record. People make the calls.
A workflow tool — ours included — can hold your program, your evidence and your audit trail. It cannot notice that a settlement feels wrong, decide a customer needs enhanced checks, or know what must never be said once a report is made. Those judgments happen at the desk, in the moment, and the person at the desk has to understand why.
An adviser can draft the program. You have to run it.
A consultant can write you an excellent risk assessment and policy set. But the Act’s next sentence is the one that lasts: “A reporting entity must comply with the AML/CTF policies of the reporting entity” (s 26G). Complying is daily work done by your own people — and people follow policies they understand.
AUSTRAC’s own starter kits say the same.
The regulator’s program starter kits make personnel training a named part of every sector’s policy document — “We train our personnel to make sure they can carry out their AML/CTF roles and responsibilities” — with initial training for new starters, ongoing training, scenario-based exercises, and tracked completion dates. Training is not an add-on to a program; it is a chapter of one.
This is why the Rules pin training to the person — their function, their risks, their responsibilities, in language they can actually use. A program binder on a shelf trains nobody.
At every size
The obligation scales. It never disappears.
Sole practitioners
When you are the practitioner, the compliance officer and the governing body at once, there is no one to delegate understanding to. The obligation is scaled to the nature, size and complexity of your business — but it is still yours, and training is how one person carries it with confidence.
Small firms
AUSTRAC’s starter kits are designed for practices of fifteen people or fewer — and they assume every one of those people is trained for their role: who onboards clients, who escalates, who signs off. In a small firm, one untrained person is a large share of the program.
Larger organisations
The governing body carries a duty of ongoing oversight of the program and its compliance (s 26H), and the compliance officer reports up the line. At scale, the honest answer to “are our people trained?” has to be a record — names, dates, results — not an impression.
Not once — ongoing
Training is how a program stays alive
Initial and ongoing, by rule
The Rules require policies to deal with training when a person starts and training during their engagement. When your program changes, the people affected need to understand what changed — AUSTRAC’s starter-kit maintenance forms track exactly that.
Reported up the line
The compliance officer reports to the governing body at least every 12 months, and AUSTRAC’s starter-kit annual-report form asks specifically about training provided and capability gaps. Training activity is something a governing body is expected to see.
Kept as a record
Records reasonably necessary to demonstrate compliance with the program obligations must be retained — for 7 years after they stop being relevant (s 116). “Who was trained, on what, and when” is a record-keeping question before anyone ever asks it out loud.
Current against the law
The regime is new for these professions and still moving. Training that names the exact compilation of the Act and the Rules it teaches from makes it obvious when a refresher is due — because the law it was taught against has been superseded.
This is the job the Training Academy was built for
148 short lessons taught from the Act and the Rules, assessed at 80%, ending in certificates and a training record your program keeps as evidence. Foundations — the first 15 lessons — is free for everyone; the full course is AUD $199 + GST per learner for 12 months. Whether it meets the training your program requires is your decision to make and record — the course is built so that judging it is easy.
Whether your business is a reporting entity depends on the designated services you provide — not on having an ABN or being based in Australia. Check AUSTRAC’s sector guidance, and seek professional advice for your situation.
Foundations is free for every person in your practice — a first honest hour on why this regime exists and what it asks.
Lex-AML supports compliance workflows and record keeping. It does not provide legal advice, does not guarantee compliance, and does not replace professional judgement or advice from a qualified AML/CTF adviser or legal professional.