Define the activity you are monitoring
Identify the designated services, customer relationships and transaction or behaviour information available to the practice. Record enough expected activity to recognise a meaningful change, without collecting unrelated personal detail. For a transaction engagement, relevant events may include changed parties, unexpected funding or instructions inconsistent with the stated purpose. Avoid claiming the register monitors a customer's entire financial life when the practice sees only a small part of it.
Build a register around accountable reviews
Useful fields include the customer and service reference, event date, factual trigger, supporting evidence, review owner, next action, due time and current state. Separate new, under-review and resolved items. Keep protected reporting material in a restricted location rather than a general team spreadsheet. AUSTRAC expects timely identification and response to unusual transactions and behaviour; choose review arrangements that can actually meet the risks, not a convenient universal monthly schedule.
Record an outcome that explains the response
For example, a client changes the source of purchase funds shortly before implementation. Record the original expectation, new facts, explanation requested, corroboration and decision. An unusual event can have a legitimate explanation; document it rather than deleting the alert. Where concerns remain, escalate the specific facts for CDD, risk or reporting review. A closed task should show why it was closed and any continuing monitoring requirement.
Test whether the process still works
Review overdue items, missed information, repeat events and the time taken to investigate. Check a sample against source files to see whether staff actually entered the relevant triggers. Arrange cover during absence. AUSTRAC expects automated transaction monitoring where effective manual monitoring is not possible. Increasing volume, fragmented records or recurring unreviewed alerts should prompt a capability decision, rather than adding rows to a register that no longer controls the risk.
Official sources
Use these primary sources to confirm the current rules and apply them to your circumstances.
Sources checked .
Frequently asked questions
Is a spreadsheet always an acceptable monitoring system?
No. The process must be effective for the business and its risks. A tool that cannot support timely monitoring and review is not adequate merely because it records data.
Should every alert become an SMR?
No. Investigate and assess the statutory grounds. Keep the factual review and respond appropriately when the reporting threshold is reached.
Can automated screening replace customer monitoring?
No. A screening result is one input. Monitor relevant transactions, behaviour and changes in the customer's use of designated services as well.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.