What AML/CTF training does AUSTRAC require?

The reformed Act requires a reporting entity's AML/CTF policies to deal with providing training to the people it employs or engages, and the Rules set the minimum content of that obligation. AUSTRAC's AML/CTF training guidance ties the obligation to section 26F(4)(e) of the Act and section 5-9 of the Rules.

Section 5-9 of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 contains two operative requirements. Subsection (2) says the policies "must deal with both initial training upon a person's employment or engagement and ongoing training during a person's employment or engagement". Subsection (3) requires that the training provided to a person is appropriate having regard to the particular function they perform, the particular risks of money laundering, financing of terrorism and proliferation financing relevant to that function, and their particular responsibilities under the AML/CTF policies, and that it "is readily understandable by the person".

AUSTRAC states the purpose plainly: training must make sure personnel understand the entity's obligations under the Act, Rules and regulations, and its ML/TF risks. The standard is therefore not a course completion target. It is whether each person can apply the entity's policies in their role, which is the difference described in completion tracking vs competency verification.

The reforms commenced in stages: March 31, 2026 for businesses already regulated, and July 1, 2026 for newly regulated professions. Parliament passed the AML/CTF Amendment Bill on November 29, 2024, and the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 amended the 2006 Act.

AUSTRAC's reform overview lists the newly regulated sectors as real estate professionals, dealers in precious stones, metals and products, lawyers, conveyancers, accountants, trust and company service providers, and businesses providing certain virtual asset services. The transitional rules guidance explains which obligations were deferred and for whom.

The main change is a shift from a generic risk awareness program to training tailored to each person's function, risks and responsibilities. Under the pre-reform Rules, Part A of an AML/CTF program had to include an "AML/CTF risk awareness training program" giving employees appropriate training at appropriate intervals, having regard to the ML/TF risk the entity may reasonably face (Part 8.2 of the pre-reform Rules).

• Scope of people: the obligation now covers persons employed or otherwise engaged, which AUSTRAC reads as anyone employed or engaged to perform AML/CTF functions, including contractors.
• Tailoring: training must be appropriate to the person's particular function, risks and responsibilities, not only to the entity's overall risk.
• Comprehension: training must be readily understandable by the person, which AUSTRAC links to comprehension and language skills.
• Governance roles: the governing body, senior manager and AML/CTF compliance officer each have defined responsibilities, and AUSTRAC expects each to understand the obligations attached to their role.
• Evaluation: independent evaluations of the whole program replace independent reviews of Part A, so training design and operation are in scope.

Anyone who performs functions relevant to the entity's AML/CTF obligations needs initial training at the start of their engagement and ongoing training after that. AUSTRAC says the frequency and extent of ongoing training depend on the functions a person performs and the ML/TF risks involved, and that training should also be given before a person takes on new duties that expose them to other risks.

AUSTRAC gives example frequencies, which it describes as examples only: compliance officers and senior management every 6 to 12 months, customer facing personnel every 12 months, personnel in onboarding, transaction monitoring or enhanced CDD roles every 12 months, third party vendors at onboarding and when a contract is renewed or changed, and general awareness at onboarding for other staff. It also expects training to be updated as soon as practicable after changes to law, new risks, program changes, evaluation findings, significant breaches or new AUSTRAC guidance. The guide on mandatory training refresh cycles explains how to set and justify intervals.

The most defensible approach maps each role's AML/CTF obligations to a learning outcome and a specific piece of assessment evidence. The table below is an original, illustrative mapping built from the role examples in AUSTRAC's guidance. It is a starting point, not a template AUSTRAC has endorsed.

AUSTRAC says entities must keep records reasonably necessary to demonstrate compliance with training obligations (it refers to section 116 of the Act). Its examples include who completed training, the topics and content version delivered, how understanding was assessed and the results, and each person's training history. The guide to preparing training records for an audit covers how to structure that register.

AUSTRAC expects entities to monitor whether training is completed, understood and applied, and it keeps the entity responsible for training even when delivery is outsourced. Suggested monitoring tools include post-training assessments, incident reviews that look for missed red flags or late suspicious matter reports, staff feedback, performance reviews, and compliance reporting to the governing body.

When monitoring reveals a gap, AUSTRAC expects targeted or remedial training, documentation of the action taken, reassessment, and escalation, which may include reassigning the person's AML/CTF functions. AUSTRAC's own e-learning modules can be used but "can't be relied on solely" because training must be tailored to the person. If an external provider is used, AUSTRAC expects due diligence on the provider, confirmation that content reflects the entity's own risks and policies, and alignment with the AML/CTF program. The guide on showing a regulator that training works sets out evidence types that meet this expectation.

Personnel due diligence assesses whether a person has the skills, knowledge, expertise and integrity for their AML/CTF role, and training is the usual remedy when a capability gap is found. Section 5-8 of the Rules requires the policies to assess, both before and during a person's employment or engagement, their skills, knowledge and expertise relevant to their responsibilities, and their integrity.

AUSTRAC's personnel due diligence guidance suggests knowledge-based assessments, interviews and checks of prior qualifications, and says that where gaps are identified an entity might provide targeted training before the person starts the AML/CTF function or delay assigning responsibilities until training is complete. A competency assessment that serves both purposes avoids duplicate testing.

Knowledge Foundry models the AML/CTF obligations, roles and risks as a structured framework first, then links each role to the concepts and assessment points it must demonstrate. When the Rules or an entity's policies change, affected roles and assessments are identified from the framework rather than by rereading every course, and the evidence record shows which version each person was assessed against.