AUSTRAC engagement starts politely. The first contact is almost always a letter or an email requesting documents — not an unannounced visit. How you handle the first 48 hours sets the tone for the entire engagement.
Hour 0–4: stop, read, and acknowledge
- Read the letter twice. Identify exactly what is being requested and the deadline.
- Acknowledge receipt to AUSTRAC the same day, even if the full response is weeks away.
- Notify your AML compliance officer, your senior partner or director, and your insurance broker.
- Do not start mass-emailing staff — circulation creates noise and risk.
Hour 4–24: assemble the audit pack
Most AUSTRAC requests can be answered with a standard audit pack: current Part A and Part B program, latest risk assessment, training records, sample CDD files across risk tiers, SMR/TTR register, last independent review, and evidence of board oversight. If your AML platform can export this on demand (most can), the first 24 hours is a tidy-up exercise — not a scramble.
Hour 24–48: scope the response
- Map every request to a specific document or evidence item.
- Identify gaps honestly — do not pad weak evidence.
- Decide whether to engage external AML counsel (worth it if the request mentions a specific transaction or customer).
- Draft your response with version control; treat every word as discoverable.
What not to do
- Do not amend program documents to look better than they were on the relevant date.
- Do not destroy or 'tidy up' records after the request arrives.
- Do not engage with AUSTRAC informally outside the documented response channel.
- Do not assume silence means the matter is closed — confirm closure in writing.