Tranche 2 obligations,explained.

Reporting entities need a process for determining each customer's risk rating, and then, based on that risk score, performing appropriate due diligence checks.

• Automatically calculates customer risk scores based on multiple factors
• Determines which due diligence checks are required based on the risk score
• Creates the due diligence checks the risk score calls for and runs the electronic ones (identity, sanctions, PEP and adverse media) once you start them, or use your preferred third-party provider

Reporting entities must verify the identity of customers who are individuals.

• Use Instant Compliance's automated KYC system or your preferred third-party provider
• Instant Compliance's KYC tools help you collect and verify customer identity information
• Automatically captures and verifies identity documents through a secure, mobile-optimised portal
• Automated status updates and completion notification workflow

Reporting entities must verify the identity of individual customers, for example through document verification and biometric checks.

• Verification of documents such as tax bills, utility bills and bank statements through our verification provider
• Biometric facial recognition and liveness detection to match the customer to their identity document
• Supports a wide range of Australian and international ID documents

Reporting entities must confirm their customers' residential or business addresses where required.

• Verifies customer addresses electronically through our identity provider, or accepts a proof-of-address document for your officer to review
• Checks documents for authenticity, image integrity, and data validity, including expiration dates and address existence.
• User geolocation checks on devices that allow it.

Reporting entities must identify Politically Exposed Persons (PEPs) and their associates during onboarding. These individuals may present higher risk due to their public roles.

• Flags which customers may require PEP screening based on their risk assessment
• Screens high risk customers against comprehensive global databases of Politically Exposed Persons (PEPs), their relatives, and close associates
• Provides ongoing, automated monitoring for any changes in a customer's PEP status
• Automated customer risk assessments and recommended actions for identified PEP matches

For higher-risk customers, reporting entities must have a process to establish the source of their funds.

• Automatically detects which customers require source of funds verification based on their risk score
• Detects Enhanced Customer Due Diligence (ECDD) triggers when abnormal customer or transaction patterns are identified
• Guides customers through structured questionnaires to document the source and nature of their funds
• Requests the supporting documentation the declared fund sources call for, and puts it in front of your compliance officer to assess

Reporting entities must verify the identity of customers that are businesses.

• Verify business customers through Instant Compliance's automated system or use your preferred third-party provider
• Connects directly to government business registries to verify company registration details
• Lets business counterparties complete their own verification through a guided portal
• Verify shareholder data and personal documents

Reporting entities must check business customers' entity registration and legal status.

• Automatically performs automated lookups against official business registries to confirm legal entity status

Reporting entities must identify the beneficial owners of business customers (generally anyone with 25% or more ownership or control).

• Automatically analyses corporate structures to surface individuals with 25% or greater ownership for your review
• Maps complex ownership chains through multiple corporate layers

Reporting entities must understand complex ownership and control structures when they encounter them.

• Creates visual representations of corporate ownership structures and control relationships
• Identifies potential risks in complex corporate arrangements
• Flags unusual structures that may indicate money laundering or tax avoidance schemes

Reporting entities must understand the nature and purpose of each business relationship and the types of transactions expected.

• Captures essential information about why customers are using your services and their expected transaction patterns through simple questionnaires
• Feeds the designated services you select into the customer’s risk score, and records what they intend to use those services for on their profile and in the audit trail

Reporting entities need a process for determining each employee's risk rating based on their role, and then performing appropriate due diligence checks based on that risk score.

• Calculates an employee risk score from a short risk questionnaire your compliance officer completes for each person, and re-scores when you update it
• Considers factors such as customer interaction, system access levels, and decision-making authority
• Updates risk assessments dynamically when employee roles or responsibilities change

Reporting entities must apply risk-based employee due diligence. The level of checking depends on the role and access to sensitive information or systems.

• Automatically determines which background checks each employee needs based on their risk level
• Provides a list of partners to conduct background checks
• Maintains secure records of all background check results
• Automated renewal schedules based on risk level

Higher-risk roles, such as staff with access to customer data or funds, may warrant national police checks under an employee due diligence program.

• Automatically determines which employees require police checks based on their risk level and role
• Provides a list of ACIC-accredited partners to conduct police checks

Higher-risk roles, particularly those with access to company or customer funds, may warrant financial probity checks.

• Automatically determines which employees require financial probity checks based on their risk level and role
• Provides a simple workflow to complete credit history and financial probity assessments

Reporting entities must control data access based on each employee's risk level, role and responsibilities.

• Recommends an access level from the employee’s risk assessment and flags anyone whose access has not been reviewed since. Your administrator accepts or overrides it, and the decision is recorded.
• Provides a standardised system to manage access controls that scales with your business
• Maintains audit trails of all access level changes and approvals

Reporting entities must monitor for unusual transaction volume patterns, such as customers who suddenly make many more (or fewer) transactions than normal.

• Monitors transaction volumes against customer profiles using rules you configure
• Scores each transaction against the customer’s cumulative activity over the window you set, and flags cash transactions at or above your threshold
• Provides trend analysis and risk scoring for volume-based anomalies

Reporting entities must monitor for transactions with unusual values, whether unusually large or small for a particular customer.

• Monitors all transactions against configurable value thresholds and customer risk profiles
• Automatically generates alerts for transactions exceeding established limits
• Tracks cumulative transaction values over specified time periods

Reporting entities must consider geography when assessing transaction risk. Some countries present higher money laundering or terrorism financing risks.

• Applies enhanced scrutiny to all international transactions based on destination country risk ratings
• Screens against sanctions lists and high-risk jurisdiction databases
• Provides detailed reporting on cross-border transaction patterns and risks

Reporting entities must lodge Threshold Transaction Reports (TTRs) with AUSTRAC for cash transactions of $10,000 or more, within the statutory timeframe.

• Implements enhanced monitoring and reporting for all cash transactions
• Prepares Threshold Transaction Report (TTR) content for cash transactions of $10,000 or more, for your compliance officer to review and lodge
• Tracks cash transaction patterns to identify potential structuring activities

Reporting entities must identify transactions that deviate from normal customer behaviour.

• Monitors transaction frequency against established customer behaviour patterns
• Identifies rapid-fire transactions that may indicate automated or suspicious activity
• Provides statistical analysis of transaction timing and frequency anomalies

Reporting entities must have a process to identify attempts to avoid reporting requirements, such as breaking large transactions into smaller ones to stay under thresholds.

• Uses advanced algorithms to detect potential structuring activities across multiple transactions
• Identifies patterns where customers may be deliberately staying below reporting thresholds
• Provides detailed analysis and evidence packages for suspected structuring cases

Reporting entities must screen against sanctions and watch lists so they do not deal with prohibited individuals, entities or countries.

• Screens all transaction parties against global sanctions and watch lists
• Flags matches against prohibited parties for your review, with detailed reporting
• Uses sanctions lists updated from official sources

Reporting entities must monitor significant changes in customer acquisition patterns or service usage. Sudden changes can indicate emerging risks.

• Tracks customer acquisition rates and identifies unusual spikes or declines in new customer onboarding
• Monitors changes in customer demographics, risk profiles, and service usage patterns
• Provides early warning alerts for potential business model or market changes that may affect ML/TF risk

Reporting entities must monitor transaction volumes and investigate unusual increases or decreases that could indicate money laundering or fraud.

• Instant Compliance scores each customer’s cumulative transaction activity against the amount and window you configure, and flags cash transactions that meet your threshold or form a sub-threshold pattern
• Provides automated alerts when transaction volumes exceed or fall below established thresholds
• Generates detailed reports on volume trends and their potential compliance implications

Reporting entities must identify transactions that deviate from normal customer behaviour.

• Applies the monitoring rules you configure: a cash threshold, and a structuring indicator that looks for several sub-threshold cash transactions for the same customer inside your aggregation window
• Provides risk scoring and detailed analysis of unusual transaction characteristics
• Generates automated alerts and investigation workflows for suspicious patterns

Reporting entities must monitor for customers who repeatedly fail identity verification or require extra checks.

• Tracks customers who repeatedly require enhanced due diligence measures or fail standard verification
• Identifies patterns that may indicate systematic attempts to circumvent CDD requirements
• Provides risk-based recommendations for customer relationship management

Reporting entities must keep their risk assessment informed by emerging financial crime trends.

• Uses external screening lists that cover emerging financial crime typologies
• Provides regular updates on new money laundering and terrorism financing methods
• Lets you update monitoring rules and risk assessments as threats emerge

Reporting entities must track regulatory changes and geopolitical events that can affect their obligations and risk profile.

• Lets you record regulatory announcements and guidance from AUSTRAC and other authorities that are relevant to your business
• Tracks geopolitical events that may affect sanctions, country risk ratings, or compliance requirements
• Provides a workflow to record external changes and your assessment of their impact

Reporting entities must respond to AUSTRAC requests and keep up with guidance that applies to them.

• Lets you record communications from regulators and track your organisation's responses
• Provides a workflow for tracking your responses to regulator requests
• Keeps a record of regulator correspondence and your organisation's responses

Reporting entities must regularly review their risk assessments and controls so the programme stays current with the business.

• Automates the annual ML/TF risk assessment process with structured questionnaires and data analysis
• Generates comprehensive risk assessment reports with recommendations for control improvements
• Tracks implementation of risk assessment recommendations and control enhancements

Reporting entities must review their programme when significant events occur, such as regulatory or business changes.

• When we publish a regulatory update, your compliance officer records what it means for your business and can start a risk reassessment from that assessment in one step. The link between the change and your response is kept.
• Provides structured workflows for conducting event-driven risk assessments
• Generates updated risk profiles and control recommendations based on triggering events

Reporting entities must regularly review external factors that could affect their money laundering and terrorism financing risks, such as changes in country risks, industry trends and regulations.

• Instant Compliance schedules regular reviews of external risk factors including country risks, industry trends, and regulatory changes
• Provides structured assessment frameworks for evaluating external risk impacts
• Updates risk ratings and control requirements based on periodic review findings

Reporting entities must review their risks following compliance incidents or security breaches.

• Records incidents in the incident register, and offers a one-step route from an incident into a risk reassessment when your compliance officer judges that it warrants one
• Provides root cause analysis frameworks and corrective action planning
• Tracks implementation of incident-based improvements and control enhancements

Reporting entities must protect the information they hold, with access controls appropriate to its sensitivity.

• Automatically classifies all compliance data based on sensitivity levels and regulatory requirements
• Implements data labelling and handling procedures based on classification levels
• Provides regular reviews and updates of data classification schemes

Reporting entities must ensure only authorised personnel can access sensitive customer and compliance information.

• Implements comprehensive role-based access controls with regular review and certification processes
• Provides automated provisioning and deprovisioning of system access based on employee roles
• Maintains detailed audit logs of all data access and modification activities

Reporting entities must keep records of their compliance activities that can be produced on request.

• Maintains append-only audit trails of all system activities, data access, and modifications, with no way to edit or delete an entry
• Provides comprehensive search and reporting capabilities for audit trail analysis
• Maintains an audit trail you can produce for regulatory examinations

Reporting entities must retain AML/CTF records for 7 years.

• Applies the retention settings you configure (the AML/CTF Act requires records to be kept for 7 years)
• Provides secure data disposal processes when retention periods expire
• Maintains comprehensive records of data retention and disposal activities

Reporting entities must report suspicious matters to AUSTRAC within 3 business days of forming a suspicion (24 hours if related to terrorism financing).

• Prepares Suspicious Matter Report content for your compliance officer to review and lodge with AUSTRAC
• Provides structured investigation workflows and evidence collection for suspicious activity
• Lets you record SMR lodgement status and keeps reporting records

Reporting entities must report cash transactions of $10,000 or more to AUSTRAC within 10 business days.

• Flags cash transactions of $10,000 or more and prepares TTR content for your compliance officer to review and lodge with AUSTRAC
• Provides comprehensive transaction data collection and validation for TTR submissions
• Maintains detailed records of all threshold transaction reporting activities

Reporting entities must report international funds transfer instructions (IFTIs) to AUSTRAC within 10 business days.

• Records international funds transfer instructions and prepares IFTI content for your compliance officer to review and lodge with AUSTRAC
• Provides comprehensive data validation and enrichment for IFTI submissions
• Keeps IFTI reporting records

Reporting entities must keep senior management informed about the compliance programme through regular reporting.

• Generates comprehensive compliance dashboards and reports for senior management review
• Provides key performance indicators and trend analysis for compliance program effectiveness
• Schedules regular management reporting with automated distribution and acknowledgment tracking

Reporting entities must document compliance breaches and the corrective actions taken.

• Provides structured incident reporting workflows with automated escalation procedures
• Maintains comprehensive incident databases with root cause analysis and corrective actions
• Tracks incident resolution and implements lessons learned across the compliance program

Reporting entities must monitor the effectiveness of their controls over time.

• Monitors key performance indicators for compliance program effectiveness and efficiency
• Provides trend analysis of your compliance metrics over time
• Generates regular performance reports with recommendations for program improvements

Reporting entities must have a process for employees to escalate suspicious matters internally.

• Implements automated escalation workflows for high-risk events and compliance issues
• Provides structured communication templates and tracking for escalation activities
• Maintains comprehensive records of all escalation activities and resolutions

Reporting entities must provide AML/CTF training to new employees, officers and relevant third-party service providers.

• Provides AML/CTF training content you can assign to new employees before they commence duties
• Provides role-specific training modules based on the responsibilities and risk exposure you define
• Tracks training completion and competency assessments with automated reminders and escalation

Reporting entities must provide ongoing training based on roles and employee risk levels.

• Schedules and delivers refresher training on the cycle you set, based on role-specific risk levels
• Provides training content that we update as laws and guidance change
• Tracks training effectiveness and employee competency over time

Training must be tailored based on responsibilities and risk exposure. Different roles need different levels of compliance knowledge.

• Assigns training modules based on the roles you define
• Delivers customised content for different role categories (compliance officers, customer-facing staff, senior management)
• Provides scenario-based exercises relevant to specific job functions and risk exposures

Training must be provided when compliance policies and regulations change. This ensures your team stays informed of new requirements.

• Lets you assign new training when requirements change
• Lets you record the impact of regulatory changes and the training you assign in response
• Tracks completion and assessment results for training on new requirements

Executive training on governance responsibilities

• Delivers specialised training for senior management on AML/CTF governance responsibilities
• Provides training content on board and executive oversight responsibilities
• Tracks senior management training completion and assessment results

Training must be monitored and measured to ensure effectiveness. This helps you identify knowledge gaps and improve your programme.

• Monitors training completion and assessment results

Reporting entities must provide AML/CTF training to external service providers, contractors and consultants who perform relevant work on their behalf.

• Instant Compliance allows you to add external contractors and service providers so they can complete streamlined, role-specific compliance training

Reporting entities must keep training records for 7 years.

• Maintains comprehensive records of all training activities, completions, and assessments
• Provides reporting on training completion across the organisation
• Keeps training records available for regulatory examinations and audits

Reporting entities must keep employees informed about compliance requirements, emerging risks and regulatory changes.

• Lets you schedule and record awareness communications to staff