How Long Does It Actually Take to Build an AML Program From Scratch? A Timeline Breakdown
How Long Does It Actually Take to Build an AML Program From Scratch? A Timeline Breakdown
If you are a small firm just starting your AML/CTF program, the first question is usually simple: how long will this take? Here is an honest answer, along with a realistic week by week plan.
The honest answer first
AUSTRAC does not publish a standard “this takes X weeks” figure. Nobody can give you one exact number that is true for every business. The time depends on your size, how many designated services you provide, how complex your clients are, and how much of your time you can give it.
The effort and timing estimates in this article are my own planning guides for a small firm. They are not AUSTRAC figures. The rules, steps, and deadlines that do come from AUSTRAC are marked as such.
What AUSTRAC says the work involves
AUSTRAC breaks building a program into five steps:
- Set up your governance
- Identify and assess your risks
- Put policies in place to manage those risks
- Review and update the program
- Arrange independent evaluations
Your program must be documented and approved by a senior manager. AUSTRAC also publishes free program starter kits for the newly regulated sectors, including accountants, legal professionals, and real estate. The accounting kit, for example, walks you through a 4-step process to customise the documents and forms that become your program. Starting from a kit instead of a blank page is the biggest thing that shortens your timeline.
Why the timing feels different now
Obligations for newly regulated businesses started on 1 July 2026, and the enrolment deadline of 29 July 2026 has passed. So for most people reading this, “from scratch” no longer means getting ready before a deadline. It means catching up sensibly. The goal is to get a working, honest program in place quickly, then keep improving it, rather than waiting for a perfect one.
A timeline for a small firm
Imagine a small practice with one or two designated services, and someone who can give the project a few hours each day.
Days 1 to 3: Governance and ownership.
Decide who your AML/CTF compliance officer will be. AUSTRAC expects someone senior and properly resourced. Enrol with AUSTRAC if you have not yet, and notify AUSTRAC of your compliance officer. If you enrolled after 29 July 2026, you have 14 days from your enrolment date to do this. Also write down which of your services count as designated services.
Days 3 to 7: Risk assessment.
Work through who your customers are, what services you offer, how you deliver them, and which countries are involved. AUSTRAC’s sector risk guidance for your profession is a very useful guide here. Once the assessment is complete, AUSTRAC expects a record of the results to be prepared within 10 business days, so do not let the write-up drift. If you use the pre-built risk assessment in a starter kit, this step is shorter, but you still need to adjust it to fit your real business.
Week 2: Policies and procedures.
Customise the starter kit documents so they describe how your firm actually works. Cover customer identification, beneficial ownership, PEP and sanctions checks, risk ratings, suspicious matter reporting, and record keeping. Give each task to a named person, and have a senior manager approve the program, as AUSTRAC requires.
Weeks 2 to 3: Build the daily workflow.
Add AML questions to the matter opening or client onboarding process you already use. Decide where records will live and how you will find them quickly. Set up your record keeping rules, remembering that the 7 year period starts at different points for different records. Prepare simple templates for recording risk ratings and the reasons behind them.
Weeks 3 to 4: Training and a trial run.
Train everyone who deals with clients or money, and keep a record of who was trained and when. Then run two or three real matters through the new process and fix what does not work. This is also a good time to practise the reporting clocks:
- Suspicious matter reports: 3 business days, or 24 hours if it relates to terrorism financing
- Threshold transaction reports: 10 business days
After week 4: Keep it alive.
Document any change to your program or risk assessment within 14 days of making it. Review the program when your business changes or the rules change, and start planning for your independent evaluation.
What can slow you down
Several things commonly stretch the timeline. Providing more than one designated service means more risks to assess. Clients that are companies, trusts, or foreign parties make beneficial ownership take real effort to trace. A lack of protected time for whoever leads the work is a big one. So are records scattered across email, paper, and personal files, and starting from a generic template that then needs heavy rework. Staff changes in the middle of the build can also set you back.
What can speed you up
Starting from AUSTRAC’s free starter kit for your sector helps the most. One clear owner with the authority to make decisions also makes a big difference. A small, simple client base keeps things lighter. And building AML questions into the intake process you already use, instead of creating a separate system, saves a lot of effort.
Where better workflow software can help
Writing the program is only half the work. The other half is running it every day, and this is where many small firms lose the most time. Checks end up in one place, risk ratings in another, and training records somewhere else. Then someone has to chase the deadlines by hand.
Get Duely’s stories in your inbox
Join Medium for free to get updates from this writer.
This is where software built for the job can make your work both faster and better. When your checks, records, and reminders sit in one workflow, you spend less time hunting for information and less time repeating the same steps on every matter. It also leaves behind a clear trail of what was done and when, which makes reviews far less stressful.
Tools made for the newly regulated professions are starting to appear, and Duely is one example of an Australian platform built with Tranche 2 firms in mind. Whichever tool you look at, the useful question is the same: does it fit how my firm really works, and does it make the daily routine lighter? Remember that the responsibility still stays with your business, but the right workflow can make carrying it much easier.
A note about independent evaluation
AUSTRAC requires independent evaluations of your whole program, not just one part of it. Your own policies must set how often they happen. The sources I checked say this must be at least once every 3 years. For newly regulated businesses, the date of your first evaluation is staggered under AUSTRAC’s transitional rules and depends on your AUSTRAC account number, so check your own deadline rather than assuming a date.
You do not need to build this at the end. It is far easier to prepare for if your records are kept tidy from day one.
A small firm that starts from a starter kit and gives it real focus can usually get a first working version in place in a few weeks. That is my estimate, not an AUSTRAC number. A larger or more complex firm should expect longer.
Done is better than perfect, as long as your program is honest, approved, and actually followed. And remember that the program is never really finished when it is written. It needs updating as your business and the rules change.
This article is for general information only and is not legal advice. Time estimates are rough planning guides, not AUSTRAC requirements, and your situation may differ. For full and current requirements and deadlines, always check AUSTRAC’s official resources at austrac.gov.au.
