Using AUSTRAC's starter kit is not the same as implementing your AML/CTF program

AUSTRAC's real estate program starter kit has removed much of the complexity that small agencies might otherwise have faced in developing an AML/CTF program from scratch.

That is a good thing.

AUSTRAC has also provided an important degree of regulatory certainty. Where a business fits the characteristics for which the starter kit was designed and prepares its program using the kit, AUSTRAC considers the kit's risk assessment, policies and procedures appropriate for the common risks faced by those businesses.

For eligible agencies, there is little value in reinventing that material simply for the sake of producing something bespoke.

The more important challenge begins after the documents have been prepared.

A program has to reflect the business

The starter kit is not suitable for every real estate business.

AUSTRAC itself notes that businesses need to consider whether they fit the characteristics for which the kit was designed. Larger or more complex businesses may face risks that require additional controls, while agencies providing other designated services may need to expand their risk assessment and program accordingly.

Even where the starter kit is appropriate, it still needs to be customised and implemented.

That means allocating responsibilities, establishing customer processes, training staff, keeping appropriate records and ensuring people understand what the requirements mean in the circumstances they encounter.

The difference is important. A procedure can be appropriately designed but inconsistently performed.

Implementation creates a different set of risks

Consider a requirement to identify higher-risk customers.

The program may clearly describe the circumstances that increase customer risk and the additional steps required. That establishes the control.

Operating effectiveness depends on something else: whether staff recognise those circumstances when they occur, apply the correct process, record what they have done and escalate matters where necessary.

The same applies across an AML/CTF program. Training can be delivered without staff understanding how to apply it. Customer identification procedures can exist while files contain inconsistent evidence. A suspicious matter escalation process can be documented while employees remain uncertain about what should trigger it.

Governance arrangements can allocate responsibility to an AML/CTF Compliance Officer without providing that person with useful information about how the controls are operating.

None of those problems necessarily means the program itself is defective. They indicate a gap between program design and program implementation.

This is where assurance becomes useful

AUSTRAC has said that, for eligible businesses using its starter kits, its regulatory engagement will focus on the application of the AML/CTF program.

That is where agencies should increasingly focus as well.

A practical implementation review does not need to recreate the program or impose a large compliance exercise on the business. It can instead examine a sample of actual activity, speak to the people responsible for applying key requirements and determine whether the evidence supports what the program says should be happening.

The objective is to identify where the system is working, where practice differs from design and which weaknesses matter enough to address.

The starter kit provides a strong foundation for eligible agencies. Effective AML/CTF compliance comes from what the agency builds on top of it.

Argus Assurance provides targeted AML/CTF Health Checks for real estate agencies, examining whether programs, responsibilities and controls have been effectively implemented in practice.

Need independent assurance over how your AML/CTF controls are operating?