How a Sydney Bullion Dealer Built an AML/CTF Program in a Weekend | AML/CTF DPMS Australia 2026

When the Tranche 2 AML/CTF reforms went live on 1 July 2026, plenty of precious-metals businesses froze. "We're a five-person shop — how are we supposed to build a compliance program like a bank?"

Here's the reassuring version, told through a composite example: a small Sydney bullion dealer who went from zero to operationally compliant over a single weekend. You can follow the same four steps.

Step 1 — Enrol with AUSTRAC

The first move is registration. AUSTRAC enrolment for Tranche 2 entities opened on 31 March 2026, and newly regulated businesses must enrol within 28 days of starting to provide a designated service. The enrolment obligation sits at section 51B of the AML/CTF Act, and failing to enrol when required is a contravention in its own right. It's administrative, but it's non-negotiable.

Step 2 — Write your two core documents

Under the reformed regime your program (s 26B) is built on two documents:

• A ML/TF risk assessment (s 26C) — an honest, written look at where your business is exposed to money laundering, terrorism financing and proliferation financing risk: cash intensity, walk-in customers, high-value resaleable stock, anonymous buyers. It must be kept up to date before you provide designated services (s 26E).
• Your AML/CTF policies (s 26F) — the procedures your staff actually follow to manage those risks.

For a bullion dealer, the risk assessment practically writes itself: high cash volume, easily-liquidated product, customers who often prefer not to be named. Naming the risk is most of the work — the policies then map controls to each risk.

You'll also need to designate an AML/CTF compliance officer at management level (ss 26J–26K) — in a small business, usually the owner or a senior manager.

Step 3 — Do KYC on your cash buyers

Customer due diligence (CDD) — often called KYC — means identifying and verifying customers before you provide a designated service. For a precious-metals dealer that means collecting and verifying identity once you're in designated-service territory: cash or virtual-asset transactions at or above the $10,000 threshold (s 6(3), Table 2). The reformed Act splits this into initial CDD (before you act) and ongoing CDD (monitoring the relationship over time).

Step 4 — Monitor transactions and report

You need ongoing transaction monitoring and a way to lodge the reports the Act requires:

• Threshold Transaction Reports (TTRs) for cash dealings of $10,000 or more (s 43) — must be lodged with AUSTRAC within 10 business days.
• Suspicious Matter Reports (SMRs) when something doesn't add up (s 41) — generally due within 3 business days of forming the suspicion, or 24 hours for terrorism financing.
• Records kept for seven years under the Act's record-keeping provisions (Part 10).

Where the weekend gets shorter

Two of those four steps — onboarding and verification — are where Veriqua removes the manual grind. Veriqua's Customer Onboarding Portal lets your customers submit their ID remotely, with verification handled digitally: no paper forms at the counter, no photocopier, no manual checking, no verification backlog. Your buyer completes identity verification from their phone, the evidence lands in your audit trail automatically, and your counter conversation goes from awkward to seamless.

For transaction monitoring, Veriqua's AI Triage module automatically flags structuring and smurfing patterns for review — so your staff don't have to remember who bought what last Tuesday. That's the difference between a program that exists on paper and one your staff will actually use on a busy Saturday.

Walk through it yourself in two minutes, no login: demo.veriqua.com.au/start.