fbpx

End the AML Scramble: One File, One Owner

Download Now!

Financial Advisors Document Control

Need stronger financial advisors document control?

Support compliance and stay audit ready with clearer documentation.


Find out more

End the AML Scramble: One File, One Owner

Scattered KYC evidence is no longer a nuisance—it’s a material compliance and operational risk as AUSTRAC enforcement intensifies and privacy guidance is refreshed. Here’s how small businesses can move to a single, defensible AML file per client—fast.

1) What this is: New compliance obligations + operational risk

The SERP signals a convergence of new compliance obligations and an emerging operational risk. AUSTRAC’s AML/CTF reforms are widening scope while updated privacy guidance lifts the bar on how you collect, store, and evidence KYC. The exposure isn’t theoretical; it shows up as onboarding delays, remedial rework, audit gaps, and client trust issues.

Signals you can’t ignore

  • Evidence split across email, CRM notes, and laptops
  • PEP/sanctions checks done once at onboarding, not re-checked at review
  • Source-of-funds explanations buried in email threads
  • No clear owner or review date for AML files

2) Why it matters now: AUSTRAC, privacy, and widening scope

AUSTRAC places primary responsibility on the reporting entity (often the AFS licensee in advice businesses). OAIC has released updated privacy guidance for AML/CTF reporting entities, raising expectations for lawful collection, secure storage, and access control. Captured accounting and bookkeeping practices must identify clients, verify details, and retain records that demonstrate compliance—typically for at least seven years.

Impacts for small firms
  • More professions in-scope (including bookkeepers seeking clarity)
  • Higher documentation standards and audit readiness expectations
  • Need for independent evaluation of your AML/CTF program
  • Real client impacts: slower onboarding if you can’t produce a clean AML file

3) The cost of scattered AML records

Disjointed evidence creates avoidable friction and risk.

  • 48-hour onboarding delays while staff rebuild files from email and personal drives
  • Compliance escalations when PEP re-checks or source-of-funds notes are missing
  • Audit pain: you can’t defend gaps you can’t find
  • Staff burnout and repeated questions due to unclear process ownership

“We did the KYC, but it lives in three places.” That sentence is a red flag for remediation and audit findings.

4) Define your “current AML pack” (single source of truth)

Create one live AML file per client with a clear owner and review cadence.

  1. Owner and next review date
  2. Client identification and verification (KYC) evidence
  3. Beneficial ownership mapping and verification
  4. Source-of-funds/source-of-wealth rationale and supporting evidence
  5. Sanctions and PEP checks (with re-check date/time-stamp)
  6. Risk assessment and ongoing monitoring notes
  7. Client consent/privacy notices and data retention markers (7+ years)
  8. Version control and change history
Document control, not file storage
  • Single repository with permissions (no local laptop copies)
  • Named templates retired when superseded; staff acknowledgements on new versions
  • Clear file naming and indexing so any reviewer can retrieve within three minutes

5) Run the 30-minute spot-check (this week)

  1. Select five active client files across different risk profiles.
  2. Locate the AML pack within three minutes—if not, mark as FAIL (findability).
  3. Confirm owner and next review date are visible.
  4. Check evidence for KYC, beneficial ownership, source-of-funds, and sanctions/PEP re-checks.
  5. Scan monitoring notes and ensure risk rating matches evidence.
  6. Record results, assign owners for any FAILS, and retire old templates today.

Pass standard

One current AML pack with complete, dated evidence and a named owner—nothing material living in email only.

6) Systemise the workflow so staff don’t have to guess

  • Policy: AML/CTF and Privacy policy aligned with current guidance
  • Procedure: step-by-step KYC, PEP/sanctions re-check cadence, review triggers
  • Forms and templates: consistent checklists embedded in your CRM/DMS
  • Registers: training, file reviews, exceptions, and remedial actions
  • Independent evaluation: schedule and scope for your AML/CTF program
  • Version control: change logs, sunset dates, and staff acknowledgements
  • Remote-ready: clear instructions so knowledge doesn’t live in people’s heads
Privacy-by-design
  • Collect only what you need; document lawful basis and client notices
  • Secure storage and least-privilege access; redact where possible
  • Retention and disposal rules (seven years minimum, then securely destroy)

7) Strategic upside: compliance that accelerates onboarding

  • Faster client onboarding with fewer back-and-forth emails
  • Reduced repeated questions and higher staff engagement
  • Consistency across teams and sites for audit readiness
  • KPIs that matter: time-to-produce AML file, % files with current re-checks, and exception close-out time

8) Next steps and where to get help

Block 30 minutes to spot-check five files. Name owners, set review dates, and shut down superseded templates today. If gaps point to document control, change management, or compliance alignment issues, start by mapping your policies, procedures, and forms into one connected system—and brief your team. Questions? Message me, or find us at tkodocs.com.

Related Links: