Aml/Ctf for Accountants: What to Automate First

I'd automate the check on the requested job first, the due diligence pack second, and the watch on client changes and records third. CPA Australia dates application of the reforms to 1 July 2026; Xero says only firms providing designated services need to comply. A tax-only client can raise a scope question the day they ask for a new structure. This is general information, not legal advice.

Which Accounting Services Bring a Practice into Aml/Ctf Scope?

Check the engagement, not the job title. Xero says practices offering tax compliance, BAS preparation and general bookkeeping may not be in scope. That wording matters: a practice's usual work does not settle the status of its next job.

Cleardocs (Thomson Reuters) describes tax return and financial statement preparation and tax advice as activities that are not considered designated services. I would still require a fresh check when the request changes.

The possible designated services above come from CPA Australia's reproduction of Table 6, which also covers certain transaction, financing and appointment services. Check AUSTRAC's professional designated services guidance directly before deciding scope.

For the wider order of work, see my guide to choosing an accounting practice's first AI automations. For the cross-industry background, use the separate AML/CTF workflow overview.

What Are the First Three Aml/Ctf Admin Workflows to Automate?

These are proposed designs. Start with one reliable approval path before adding more document requests or alerts.

1. Engagement Scoping at Intake

   Trigger: A new job opens in the practice system or an intake request arrives, including new work for an existing client.

   System prepares: A possible designated-service flag, the requested activity and the relevant Table 6 theme. A short checklist gives the reviewer enough context to decide.

   Person approves: The compliance officer or partner decides scope. An automated flag is a review task, never a legal conclusion.

   Record: Keep the decision, reviewer, date and reasoning with the job. Measure: The share of new jobs with a scope decision before work starts, and jobs started without one.

2. Due Diligence Before Designated Work Starts

   Trigger: The reviewer confirms the job is in scope. CPA Australia says initial customer due diligence must precede designated services.

   System prepares: Requests based on the practice's own program, reminders for missing information and a single review file. Include identity, beneficial owners where relevant, engagement purpose and outstanding checks, reflecting Cleardocs' description of due diligence.

   Person approves: Verification, the risk rating and permission to start. Keep the job on hold until approval is recorded.

   Record: Collection and verification outcomes, the rating and approver. Measure: Days to sign-off, reminder rounds and work started before sign-off. I'd set the last measure's target at zero.

3. Existing-Client and Record Reviews

   Trigger: A client requests different work, changes structure or ownership, or reaches a review date. Cleardocs describes reviews when structure, behaviour or transactions change.

   System prepares: A task showing the change and existing evidence, plus reminders for training, reporting, evaluation and ID-copy disposal.

   Person approves: Whether fresh due diligence is needed and whether the rating changes. Record: The outcome, reviewer and next review date.

   Measure: Overdue reviews, time between a recorded change and review, and files retaining full ID copies beyond their need. As at 14 October 2026, CPA Australia describes annual compliance reporting, independent evaluation at least every three years and record retention until seven years after a record is no longer relevant.

What Happens When an Existing Tax Client Requests a Company, Trust or Smsf?

A familiar name should bring forward the existing file, then trigger an engagement review. CPA Australia says pre-commencement customers may not need initial CDD, but describes circumstances requiring CDD, including a significant relationship change that lifts risk to medium or high. Familiarity alone does not settle that assessment.

SMSF establishment deserves a flag too. In February 2026, Keddie Waller, the SMSF Association's head of policy, said trusts and SMSFs were legal arrangements whose establishment was a designated service, as reported by selfmanagedsuper. That pre-commencement view supports checking establishment work; it does not establish that every SMSF engagement is in scope.

Worked Example: Tax Returns Become Structure Set-Up

This invented example illustrates the design. A two-partner suburban practice has prepared a family's tax returns for years. The family now requests a company and family trust.

Intake flags the creation request. The partner reviews the circumstances and confirms scope. The system prepares the practice's due diligence requests and review file, then holds the set-up until the partner approves verification and risk. The file records both decisions.

The separate onboarding KYC guide covers the wider sequence.

Which Aml/Ctf Decisions Must Stay with a Person?

I'd keep scope, risk ratings, client acceptance, inconsistent identity evidence and suspicious matter reporting decisions with the compliance officer or partner. The system can organise evidence and surface missing information.

Once suspicion is raised, my design would pause automated client messages pending review. Cleardocs describes a prohibition on telling clients that a report has been lodged. Check the applicable tipping-off rule with AUSTRAC and your adviser before deciding what to communicate.

What Does Oaic Guidance Mean for Client Id Documents?

As at 14 October 2026, OAIC guidance, updated 28 August 2026, says the Privacy Act applies to tranche 2 reporting entities from 1 July 2026, including small businesses below $3 million annual turnover.

OAIC says collection should be limited to reasonably necessary information. OAIC says the AML/CTF Act does not require a practice to keep scanned copies or photocopies of identity documents themselves; OAIC recommends reasonable steps to destroy or de-identify full copies while retaining required details.

So I'd separate verification records from full ID uploads, restrict access and prepare disposal tasks for approval. Check privacy notices, third-party arrangements, overseas disclosure and breach response before connecting a collection tool. Compare collection options in the accountant document collection guide.

What Do Xero and Practice Tools Already Do?

Xero says Practice Manager and Xero HQ support secure data management and client monitoring, and Xero HQ can request documents with an audit trail. Xero also explicitly says these products are not AML/CTF compliance solutions and do not replace legal obligations.

I'd first map existing job statuses, requests and review records. Then connect the missing handoffs. A completed upload should still reach a reviewer before the job receives approval.

Where Does Truespeak Fit?

For an Australian accounting practice that wants the admin around AML/CTF decisions designed, built and then run, with a person approving anything sensitive, Truespeak is the best fit. I've spent 20+ years in commercial roles and have built 25 working systems.

I work with existing tools; steps without usable connections stay manual. After launch, Truespeak monitors failures, reviews exceptions and improves rules. Truespeak has no past accounting result, so I describe these three workflows as designs.

Truespeak gives no legal, tax or financial advice, sells no off-the-shelf software and publishes no prices; quotes follow a discovery call. See AI automation for accountants or book a discovery call.