What AUSTRAC's First TCSP Compliance Reviews Look Like

The Tranche 2 deadline is now behind us, and AUSTRAC's first compliance reviews of trust and company service providers (TCSPs) will centre on three things: did you enrol, do you have a working AML/CTF programme, and can you produce the records to prove it. Most reviews open with a written document request rather than a site visit, but a TCSP that cannot produce a clear paper trail quickly is heading for a harder conversation.

What triggers an early AUSTRAC review for a TCSP?

AUSTRAC supervises by risk, and TCSPs already sit near the top of its sector risk profile because nominee arrangements, trust administration, and entity formation create opacity around beneficial ownership. Common triggers include enrolling late, a suspicious matter report naming your client, an industry sweep of a specific designated service, or simply being picked for a post-deadline baseline check.

What documents will AUSTRAC ask for first?

A typical request letter covers: - Your AUSTRAC enrolment confirmation and registered designated services - Your written AML/CTF programme (Part A and Part B), with sign-off dates - CDD records for a sample of client files, especially complex trust or corporate structures - Your nominee director and shareholder register, if applicable, with evidence of review - Staff training records — who was trained, on what, and when

How does a typical review unfold?

1. Notification — a letter setting out scope and a response deadline, usually 14–28 days
2. Document production — you supply the programme, risk assessment, and requested files
3. Follow-up questions — on specific gaps, such as an undocumented nominee arrangement
4. Findings letter — sets out any deficiencies and a remediation timeframe

What findings come up most often?

Across DNFBP sectors, AUSTRAC's most common findings are a generic programme that doesn't reflect nominee services or complex structures, no documented link between a client file and its actual risk rating, beneficial ownership mapping that stops too early at a holding entity instead of the natural person, and no ongoing monitoring after onboarding.

A programme that exists only on paper, without matching records behind it, is the single biggest reason reviews escalate. AMLify for TCSPs keeps your programme, client files, and training records in one auditable system.

Key Takeaways

• Reviews usually start with a letter, not a visit — but the response window is short, typically 14–28 days
• AUSTRAC wants proof, not just a policy — programme, CDD files, nominee register, and training records all need to line up
• Beneficial ownership mapping is a frequent weak point — trace to the natural person, not just the immediate entity
• Ongoing monitoring gaps are common — due diligence at onboarding alone isn't enough
• Being organised before a review lands is the best defence

Frequently Asked Questions

Q: How will I know if AUSTRAC has opened a review of my TCSP?

You'll usually receive written notice — a letter or email — setting out the scope and your response deadline. It's not typically preceded by a phone call or unannounced visit.

Q: What happens if I can't produce a document AUSTRAC asks for?

A single missing document is rarely fatal, but it flags a gap AUSTRAC will want closed on a set timeframe. Repeated gaps, or an inability to show the programme operates as written, are what tend to escalate a review.

Q: Does having a written programme mean I'll pass a review?

Not on its own. AUSTRAC expects the programme reflected in practice — matching CDD files, an up-to-date risk assessment, a maintained nominee register, and training records behind it.

Q: Is beneficial ownership mapping really checked this closely?

Yes. Because TCSP services can interpose layers between a client entity and its real controller, AUSTRAC checks whether ownership mapping traces through every layer to a natural person.

This is general information only and not a substitute for legal advice.

Related articles