For a lot of small firms the AUSTRAC starter kit is a real answer, not a consolation prize. AUSTRAC built it so a low-complexity agency or practice could stand up a working AML/CTF program without paying someone to draft one from scratch. If you fit the profile it was written for, and you actually customise it, it can be enough. Both of those conditions carry weight.
I get some version of this question most weeks. A principal downloads the kit, opens the templates, and wants to know whether signing the back page counts as being compliant by 1 July 2026. It does not. The kit is a starting point you finish, and AUSTRAC says exactly that on its own pages: you cannot rely on the starter kit as it comes to meet its expectations of a program for your business.
The reason this trips people is that the kit looks finished. It has a risk assessment, policies, forms, the lot. So it reads like a document you adopt, when it is really a document you rewrite.
A principal showed me the starter kit and said they were sorted. Small agency, sharp operator. But they had just bought another agent’s rent roll and were folding those clients in. The kit’s own suitability page rules that out. If you are transferring customers in from another business, separate procedures apply and the kit is not built for you. They were about to adopt a program the document itself says does not fit their situation. We spent an afternoon on the parts the acquisition touched: the inherited clients, how each one got transitioned, what risk each carried. The template could not see any of that. The people running the business could.
So the real choice is not “kit or custom” in the abstract. It is 2 questions. Do I fit the profile the kit was built for. And have I done the customisation the kit assumes I will do. 2 agencies in the same suburb, same headcount, can land on different answers because of a single structural feature.
Figure 1. The starter kit fits only if every suitability gate is true. Miss one and you build a program around your own risk.
Here is what the kit is, who it suits, and where it stops being enough.
The regulatory detail
What the AUSTRAC starter kit actually is
AUSTRAC began publishing sector-specific program starter kits from late January 2026 for certain Tranche 2 entities: real estate and buyer’s agents, the legal profession, conveyancers, accountants, with more to follow. Before you open one, AUSTRAC asks you to do 2 things: confirm you are a regulated reporting entity, and get ready to enrol with AUSTRAC. Each kit is free to download. It helps a small, low-complexity business build the 2 components of an AML/CTF program: a documented ML/TF risk assessment, and AML/CTF policies. Alongside those it gives you initial customer due diligence forms, a process document, and sector-specific risk insights and indicators of suspicious activity. It also ships with a Customise the program starter kit guide that walks you through a 4-step process.
Who the starter kit is built for
The real estate and conveyancing kits set out a suitability test, and it is strict. The kit is built for you only if every one of these is true. The funds you handle relate only to real estate transactions. You do not offer fully remote self-service that lets a customer obtain a designated service without dealing with your people. You do not sell property you own yourself, so property developers are out. You are not acquiring all or part of another business and not transferring customers in from another business. You are not part of a large reporting group, foreign branch or subsidiary. Meet all of them and the kit is suitable. Miss one and AUSTRAC’s own position is that you cannot rely on it to meet its expectations of an appropriate program. The legal profession and accounting kits carry equivalent framing, because the professions most exploited for money laundering in Australia are exactly these.
The customisation the kit assumes
The kit is not designed to be used as it comes, and AUSTRAC states this plainly. The 4-step customise guide has you rework the risk assessment, the policies, the process document and the forms so they reflect your real business model, services, customers and risks. Once those documents are customised and approved by your senior manager, they become your AML/CTF program. For a real estate agency that approver is usually the licensee in charge or the business owner. For a law practice it is a principal or managing partner. That sign-off is not a formality. It is the governing-body approval the program reform requires, and it is the point where someone with authority takes ownership of the risk.
When you need a custom program instead
Any feature outside the suitability gates pushes you past the kit. The common ones I see: a client base heavy with trusts and company structures, where working out who actually owns and controls the customer takes longer than the deal; overseas buyers, where you need source of funds and source of wealth, not a passport check; multiple service lines under one roof; membership of a reporting group or a franchise structure that pools functions; a higher-risk customer mix that the kit’s low-risk assumptions do not match. None of these make the kit useless. They make it a floor you build well above, and at some point it is cleaner to build the program around your risk from the start. This is also where compliance tooling earns its place, by carrying the customer due diligence and the evidence trail that a template cannot run for you.
How this sits inside the program reform
Under the reformed Act a reporting entity must maintain a single risk-based AML/CTF program built from 2 parts: a documented ML/TF risk assessment and AML/CTF policies, overseen by the governing body, with a fit and proper compliance officer at management level. The relevant provisions sit at sections 26B to 26L. The starter kit produces precisely those 2 parts, which is why it is a legitimate starting point. The reform is outcomes-based. The test is whether your program actually addresses your risk, not whether you hold a document that looks right. A kit copied without customisation fails that test on its face, because it describes a generic low-risk business and not yours.
What it costs to get this wrong
Not having a compliant program is the contravention, whether you skipped the kit entirely or adopted it unchanged. Program and CDD contraventions carry civil penalties up to 100,000 penalty units for a body corporate and 20,000 for an individual. A penalty unit is $330 from 7 November 2024, and it reindexes on 1 July 2026, so the dollar figure moves while the unit count stays fixed. At the current rate that is up to $33 million for a company and $6.6 million for an individual. The number is not really the point. The point is that a signed template gives you the paperwork of compliance without the substance, and the substance is what gets tested.
Starter kit vs custom program, side by side
Same obligations sit behind both columns. The difference is who the document was written for and how much of it you have to build yourself.
| AUSTRAC starter kit (customised) | Custom-built program |
Built for | Small, low-complexity firms that meet every suitability gate | Firms outside that profile: reporting groups, cross-border, trust-heavy, multiple service lines |
What you get | Risk assessment, policies, CDD forms, process document, sector risk indicators | The same components, drafted around your actual risk from the start |
Cost | Free to download | Consultant or in-house time, higher up front |
Customisation | Mandatory 4-step customise before any use | Bespoke throughout |
Approval | Senior manager or licensee in charge signs off | Governing body signs off |
Where it breaks | Any feature outside the suitability gates | Built to fit, so the limit is the quality of your risk work |
Ongoing | You maintain and review it as the business changes | Same |
Common questions
Is the AUSTRAC starter kit free?
Yes. Each sector kit is free to download from AUSTRAC. The cost sits in the work of customising it and, where needed, the tools and advice you bring in around it.
Do I have to use the starter kit?
No. The kit is optional. It is a baseline AUSTRAC offers to reduce the burden on small firms. You can build your own program instead, and firms outside the suitability profile effectively have to.
Is the starter kit enough on its own?
Only if you fit the suitability profile and you customise it. AUSTRAC is explicit that you cannot rely on the kit as it comes. A signed but uncustomised kit is not an AML/CTF program.
Can a law firm and a real estate agency use the same kit?
No. The kits are sector-specific. There is a legal profession kit, a conveyancing kit, a real estate kit, an accounting kit and more. A practice that does both legal and conveyancing work may need to customise more than one risk assessment.
Who signs off the customised program?
Your senior manager. For a real estate agency that is usually the licensee in charge or business owner. For a law practice it is a principal or managing partner. That approval is the governing-body sign-off the reform requires.
Sources
AUSTRAC, Real estate program starter kit: Getting started
AUSTRAC, Legal profession program starter kit: Getting started
AUSTRAC, Step 1: Customise your real estate program using the starter kit
Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
