Blogs
AUSTRAC's step 2.1: Managing AML/CTF personnel under Tranche 2
If your business has already built its AML/CTF program under the Tranche 2 reforms, and enrolled with AUSTRAC, the next obligation is ongoing: managing the people who sit in AML/CTF roles.
This means due diligence before appointment, training appropriate to the role, monitoring while they serve, and a documented process for when issues arise or roles change.
AUSTRAC's requirements for managing people can look daunting on paper, but they follow common sense principles, and we've broken them down for you.
Where does personnel management fit after enrolment closed?
Tranche 2 obligations became enforceable on 1 July 2026, and AUSTRAC's enrolment window for real estate agents, lawyers, conveyancers, accountants, and other newly regulated entities closed on 29 July 2026. AUSTRAC had estimated that Tranche 2 would bring an additional 90,000 or so entities into the regime, spanning real estate, legal, accounting, conveyancing, and precious metals and stones.
Enrolment and program creation sit under AUSTRAC's Step 1. Once those are in place, Step 2 shifts the focus to the people carrying out the program day to day. For you, that typically means the AML/CTF compliance officer, members of the governing body, and any staff involved in customer due diligence, reporting, or transaction review.
Who counts as personnel in an AML/CTF role?
AUSTRAC's definition of personnel covers anyone whose duties touch the AML/CTF program directly, which can include principals, the nominated AML/CTF compliance officer, governing body members (such as directors or partners), and administrative staff who conduct or record customer due diligence.
For small businesses, it’s likely to have one nominated compliance officer.
Where a business is a one-person practice, AUSTRAC provides simplified forms so that a sole principal can identify their own role and responsibilities without duplicating documentation designed for larger businesses.
What do businesses need to do before someone starts an AML/CTF role?
Before a person takes on an AML/CTF role, AUSTRAC requires a business to complete initial personnel due diligence, confirm the person is suitable and eligible, and provide training appropriate to that specific role.
In plain terms, you check the person out properly, make sure they're fit for the role, and train them for the job they'll actually be doing, all before they touch a client file, not after.
AUSTRAC specifies that personnel due diligence at this stage should assess integrity, relevant expertise, and any conflicts that might compromise the role. This means looking honestly at whether someone can be trusted, whether they actually know what they're doing, and whether anything in their background or relationships could get in the way of them doing the job properly. AUSTRAC's document library has dedicated forms for this.
AUSTRAC also requires that training be role specific. Put simply, a governing body member overseeing the program needs a different depth of training to a staff member conducting day to day customer due diligence. One size fits all training will not meet the standard.
What happens when an issue arises with someone in an AML/CTF role?
AUSTRAC's program requires controls for responding to issues that arise while a person holds an AML/CTF role, whether that is a performance gap, a conflict of interest, or a concern about ongoing suitability. In practice, this means having a plan ready before something goes wrong, not scrambling to invent one after it does. The business's own personnel due diligence and training policies should set out how to assess the concern and document the response.
This is a point worth being precise about, because AUSTRAC audits look for a documented trail, not just an outcome. A concern that is identified and resolved without any record does not demonstrate program effectiveness if AUSTRAC later reviews the file. Businesses should log the concern, the assessment steps taken, and the resolution, whether that is additional training, a change in duties, or removal from the role.
What should businesses do when a role changes or a person leaves?
When someone changes roles or leaves the business, AUSTRAC expects you to update and retain records, appoint a replacement where the role is still required, and revise role-based controls and system access. In other words, when someone walks out the door, their access and responsibilities need to walk out with them, not linger on a system somewhere. This closes the loop so that AML/CTF accountability never sits with a person who has left or moved on without a formal handover.
This often means updating the AML/CTF roles form and the assign responsibilities form, reassigning the compliance officer designation if that person has left, and confirming the incoming person completes initial due diligence and training before taking on the role. Skipping this step is one of the more common gaps AUSTRAC identifies in smaller reporting entities, particularly sole principal practices where a single departure can leave a program technically unmanaged.
Which AUSTRAC forms apply to personnel management?
Identify your personnel against key AML/CTF roles. Use this if you only have one person in an AML role.
📋 Assign responsibilities form
Record the AML/CTF roles and responsibilities of your personnel. Use this if you only have one person in an AML role.
📋 AML/CTF compliance officer and governing body personnel due diligence form
Appoint the AML/CTF compliance officer and record due diligence when they’re also the governing body. Use this if you only have one person in an AML role.
📋 AML/CTF compliance officer PDD form
Appoint the AML/CTF compliance officer and record due diligence. Don’t use this form if you only have one person in an AML role.
📋 Personnel due diligence form
Record due diligence for personnel with AML/CTF roles (other than the compliance officer. Don’t use this form if you only have one person in an AML role.
How does APLYiD support ongoing personnel management?
APLYiD's policy builder generates all our AML/CTF policies needed, using AUSTRAC aligned templates and reviewed by compliance specialists. Because personnel management sits downstream of these documents, having them accurate and current makes the due diligence and training steps much faster to execute.
The training platform's automatic recording of completions, results, and certifications means an agency's audit trail builds itself as staff complete courses, rather than being reconstructed manually before a review. For businesses managing personnel across New Zealand, Australia, and the UK under different regulators (AUSTRAC in Australia, the DIA in New Zealand, the FCA under the UK's Money Laundering Regulations), this consistency matters, since the underlying due diligence and training discipline is similar even where the specific regulatory language differs.
APLYiD's AML training platform is built to match AUSTRAC’s requirement directly. Monthly and annual plans give a whole team unlimited access to AML/CTF courses, quizzes, and certifications, covering AML fundamentals through to the client scenarios that come up in real estate transactions. Completions, results, and certifications are recorded automatically, so an agency has an audit ready record of who was trained, on what, and when, without chasing spreadsheets.
