Capture the source and identify the actual change
Record the official page or instrument, publication or update date, date checked and person reviewing it. Distinguish a change to legislation or Rules from updated explanatory guidance or an administrative form. AUSTRAC maintains a latest-guidance-updates page that helps locate relevant changes. Compare the changed material with the version used by the practice; do not infer a new legal obligation from a redesigned page or a vendor's summary alone.
Map the change to a working control
Identify the affected service, customer type, risk scenario and practical step. For example, revised wording about representatives might affect an onboarding question, authority record and reviewer instruction. Assign an owner for each required change. If no action is needed, record why the current control already achieves the relevant outcome. Keep uncertainties visible for qualified interpretation rather than making staff improvise different answers to the same question.
Apply the correct approval and documentation route
AUSTRAC distinguishes material policy changes and relevant risk-assessment updates from routine administrative changes. Apply the approval requirements to the substance, not merely whether software is involved. Document program updates within the applicable requirements; current guidance explains the 14-day documentation period after an update occurs. Record the decision, approver where required, effective point and affected records. Do not describe an unapproved draft as the practice's operating program.
Prove implementation with one realistic file
Before closing the change, walk through a representative case and confirm that the form, instructions, system and review decision agree. Tell affected staff what changed and what to do with in-flight matters. Keep prior versions where required and explain the approach to existing records. A completed software deployment or an email saying policy updated does not by itself demonstrate that the revised control is understood and being used.
Official sources
Use these primary sources to confirm the current rules and apply them to your circumstances.
Sources checked .
Frequently asked questions
Does every software update need senior-manager approval?
Not automatically. Assess whether the change materially affects how the AML/CTF policies meet their outcomes, applying the current requirements and guidance.
Should old decisions be overwritten with the new wording?
Preserve necessary history. Assess whether existing files need review, and record a new decision where appropriate instead of rewriting what was known earlier.
Can a vendor update replace the practice's assessment?
No. Determine whether it fits the practice's services and risks, meets applicable approval requirements and has been implemented effectively.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.