AML/CTF Program

Your AML/CTF program is the written document that sets out how your business will meet its compliance obligations. It must be tailored to your business, approved by a senior manager, and kept current. Verifia uses AI to generate a customised draft based on your risk assessment, which you then review, edit, and publish.

Generating your program

1. Navigate to AML/CTF Program from the sidebar
2. Ensure your risk assessment is complete — the program is generated based on your assessment results
3. Click Generate Program
4. Verifia's AI generates a draft covering:
   • Your risk assessment summary and key risk drivers
   • Customer identification and verification procedures for each CDD tier
   • Ongoing CDD policies and review schedules
   • Transaction monitoring procedures
   • Reporting procedures (SMR, TTR, annual compliance report)
   • Record-keeping requirements
   • Personnel obligations (training, due diligence, roles)
   • Program review and maintenance procedures

The draft is tailored to your:

• Industry type and specific designated services
• Risk rating and the risk factors identified in your assessment
• Business size and structure (sole practitioner, small firm, larger organisation)
• Regulation scope (for precious metals dealers — Options 1–4)

Reviewing and editing

1. Open the generated draft in Verifia's built-in editor
2. Review each section carefully — the AI-generated content provides a strong foundation, but you must customise it to accurately reflect your specific business operations and procedures
3. Edit, add, or remove content as needed to ensure the program reflects how your business actually operates
4. Use the clause library for pre-written, compliance-reviewed paragraphs on common topics
5. All edits are tracked with change history

Important: Your AML/CTF program must be a genuine reflection of your business practices, not a generic template. AUSTRAC expects your program to be tailored to your specific circumstances. The AI-generated draft is a starting point — invest time in customising it.

Approval and publishing

1. When you are satisfied with the program, click Submit for Approval
2. A senior manager (typically the Compliance Officer) reviews and formally approves the program
3. Click Publish — the published version becomes your official, operative AML/CTF program
4. Previous versions are preserved in the version history
5. A copy is automatically archived in the Compliance Vault

Staff acknowledgment

After publishing a new or updated program:

1. Verifia sends notifications to all team members
2. Each staff member must read and acknowledge the program — confirming they have read, understood, and will comply with it
3. The dashboard tracks who has and has not confirmed
4. Acknowledgment records (with timestamps) are stored in the audit trail

Staff acknowledgment is an important compliance control. AUSTRAC expects you to be able to demonstrate that all relevant personnel are aware of and have committed to following the program.

Version management

Verifia maintains a complete version history of your program:

• View all previous versions with publication dates and the approver's identity
• Compare versions side-by-side with highlighted changes
• Understand which trigger events prompted each revision
• Reference or restore previous versions when needed

Version history demonstrates to AUSTRAC that your program is a living document that evolves with your business.

Program Maintenance Triggers

AUSTRAC requires your program to be reviewed when specific events occur. Verifia provides a structured trigger management system to track these events and ensure timely program updates.

The 8 AUSTRAC-defined trigger types

How trigger management works

1. Automatic triggers — Verifia creates trigger events automatically when it detects changes (e.g., a new independent review finding, a scheduled review date approaching)
2. Manual triggers — you can record trigger events manually (e.g., you learn of a regulatory update or an internal incident occurs). Record the trigger type, description, date, and your assessment of its impact.
3. Review workflow — each trigger links to a structured review process: reassess risk → confirm risk appetite → update controls → update program → communicate changes → retrain staff
4. Dashboard integration — unresolved triggers appear in your Smart To-Do list and are factored into your Compliance Health Score
5. Version linking — when you publish a new program version, you record which trigger events prompted the update

This creates a clear, auditable chain showing why your program was updated, not just when — exactly what AUSTRAC expects to see during a review.