Short answer: In Australia, a money transfer business must be registered with AUSTRAC before it offers remittance services. It must then run an AML/CTF program, know its customers, monitor what they do, report to AUSTRAC and keep records. Those duties sit with the registered business, not its software vendor, but a good platform should make each one easy to carry out and easy to prove.
RemitSo is white-label remittance software for licensed money transfer operators. We are a technology company, not a remitter, and nothing here is legal advice.
What changed in 2026, in brief
Australia's AML/CTF reforms are the biggest change to the regime since it began; AUSTRAC's About the reforms page sets out the detail. For remitters, the parts that matter most are changes to value transfer obligations, the AML/CTF program and customer due diligence (CDD). The reforms also bring new sectors, such as lawyers, accountants and real estate, into the regime (often called "Tranche 2").
Many changes are phased in under transitional rules, including a later move from today's international funds transfer reports to a new international value transfer report. The dates depend on your circumstances, so read them on AUSTRAC's pages with your adviser.
For a platform, the takeaway is practical: report formats, CDD steps and record fields will keep changing, and your system has to absorb that without your team rebuilding reports by hand.
Registration: the evidence starts before day one
AUSTRAC says it is against the law to provide remittance services in Australia without being registered. You register as an independent remittance dealer, a remittance network provider, or an affiliate of one. AUSTRAC's registration page explains that it considers your readiness to comply, your resourcing and your key personnel. It also expects you to keep details up to date, such as new countries or the businesses that help you provide the service.
What this means for your platform:
- Know who supports your service. Keep a current list of your technology provider, payout partners and identity provider, with contracts.
- Be clear about your corridors. The countries you send to should match your registration details, and a new corridor needs compliance sign-off before it is switched on.
- Know where your data lives. On RemitSo, each operator runs its own instance in its own AWS account, in the AWS region it chooses. AWS bills the operator directly, and nothing is shared with another operator. When AUSTRAC, an auditor or a bank partner asks where customer records are held, you can answer exactly.
Customer due diligence: show what you collected, checked and decided
AUSTRAC's customer due diligence guidance covers initial, ongoing, simplified and enhanced CDD, and its record-keeping guidance asks you to show what you collected, how it was verified, and why you applied that level of CDD.
The platform's job is to capture all three without extra effort from your team.
- Identity checks with the evidence attached. On RemitSo, e-KYC through a connected identity provider checks the ID document, a selfie and a live face, and matches the name to the profile. Alternatively, the customer uploads proof of identity, proof of address and source of funds for manual review. Evidence is kept with every result.
- A person can overrule, and the reason stays. A reviewer can overrule an identity check or a risk flag. The reason is kept with the record.
- Documents that scale with risk. You set "up to" limits per transaction and over a day, week, month, 90 days or a year, per currency and corridor. Each tier names the documents the customer must provide. Above the top tier, an officer has to raise the limit.
- Sanctions screening against Australia's list and others. Eight sanctions lists, including Australia's DFAT list, are kept up to date. Every sender, recipient and staff member is screened, and everyone is re-screened when the lists change. A possible match holds the transfer until an officer on your team rules on it.
Transaction monitoring: rules you can explain
AUSTRAC's ongoing CDD guidance asks you to monitor for unusual transactions and behaviour, respond to what you find, check that your monitoring works, and keep records of how you did it.
An examiner will ask why a rule fired, what you did about it, and how you know the rules work. So the platform should let your team:
- Write rules in your own terms. On RemitSo you build rules from 47 ready-made risk indicators, combined to match your own risk assessment. Clean transfers flow on, and the rest are held for a person.
- See the decision trail. Every held transfer, the rule that held it, the reviewer and the outcome should be in the record.
- Tune without a software release. Rules and limits should change by configuration, with each change logged.
The rule we design to is simple: the platform flags, and your compliance team decides.
Reporting to AUSTRAC: IFTI, TTR and SMR
AUSTRAC lists three core reports on its reporting page. Each one asks a different question of your platform.
International funds transfer instructions (IFTIs). AUSTRAC describes two IFTI report types: IFTI-E and IFTI-DRA. Your adviser will confirm which ones apply to your business. Either way, the hard part is completeness: proving that every reportable transfer reached the report. A platform should build the regulator file from your own transfer records and check it against every transfer in scope, rather than leave your team to assemble it by hand. Ask us which AUSTRAC report formats are available for your launch. Your team reviews and lodges every report; we never lodge one for you.
Threshold transaction reports (TTRs). AUSTRAC says TTRs relate to physical currency at or above its threshold, not electronic transfers. An online-only remitter may have few or none, but your AML/CTF program should say so. If you take or pay cash, your system needs to record how each transfer was funded and paid out.
Suspicious matter reports (SMRs). AUSTRAC's SMR guidance stresses timely review, escalation, written reasons and avoiding tipping off. A platform helps by surfacing what needs review, keeping each decision and its reason, and limiting access to sensitive records. The suspicion and the report belong to your compliance officer.
Record keeping and audit evidence
AUSTRAC's record keeping overview covers AML/CTF program records, CDD records and transaction records. Transaction records must be detailed enough to reconstruct each transaction, and AUSTRAC expects sensitive records to be stored securely, with access limited to authorised staff. Retention periods are set out on that page.
On RemitSo:
- Audit trails in plain language. Each entry shows what changed, from what and to what, and who changed it.
- User access logs, roles and two-step sign-in. Roles cover every page and action, and every user signs in with two steps.
- Exportable compliance reports, so evidence leaves the system in a usable file rather than as screenshots.
- Certified security practices. RemitSo is ISO 27001:2022 certified.
Your AML/CTF program: where the platform fits
AUSTRAC's AML/CTF program guidance covers the risk assessment, policies, personnel due diligence, training and reporting. The program, the risk assessment and your officers' judgement are yours. The platform should mirror them: the rules, limits and document tiers in the system should match your policies, and each change should be logged. RemitSo also offers an optional staff training add-on that assigns courses, sends reminders and keeps a permanent record.
What we've learned about regulator reporting
One lesson from operators on our platform, anonymised:
Flag a gap rather than fill it with a guess. Regulator reports can ask for details such as the customer's occupation, which can change over time. Record them as they stand at the time of each transfer, and where a value is missing, flag the field instead of quietly inserting today's value. An honest gap is easier to defend than a confident error.
Checklist: rule area and what the platform should evidence
| Rule area | What the platform should be able to evidence |
|---|---|
| Registration | Your corridors, partners and data location (your own AWS account and region) |
| Customer due diligence | Collected documents, verification results, reviewer decisions and reasons |
| Sanctions | Lists screened, when they were loaded, who was screened, and each ruling |
| Transaction monitoring | The rule that held each transfer, the reviewer and the outcome |
| IFTI reporting | The regulator file, built from your transfers, with a completeness check |
| TTR | How each transfer was funded and paid out, so cash is identifiable |
| SMR | Review trail, decisions with reasons, and restricted access to sensitive records |
| Record keeping | Audit trails, user access logs and exportable compliance reports |
| AML/CTF program | Configuration that matches your policies, with each change logged |
Frequently asked questions
Does RemitSo register us with AUSTRAC or lodge reports for us?
No. Registration, the AML/CTF program and lodging reports stay with your business. The platform keeps the transfer records and evidence your reports draw on, and your team prepares, reviews and lodges each report.
Which AUSTRAC report formats does RemitSo support?
Ask us which report formats are available for your launch. AUSTRAC describes two IFTI report types, so confirm with your adviser which applies to you, and tell us which reports you lodge.
Is Australia's DFAT sanctions list included?
Yes. DFAT is one of eight sanctions lists, kept up to date. Senders, recipients and staff are screened, and everyone is re-screened when the lists change.
Where is our customer data held?
In your own instance, in your own AWS account, in the AWS region you choose. AWS bills you directly, and nothing is shared with another operator.
Does the platform make compliance decisions?
No. It checks, flags and holds. A person on your team rules on every match, every held transfer and every raised limit, and the reason is kept with the record.
For more, see our AUSTRAC compliance guide for MTOs, our KYC, AML and sanctions tools and RemitSo for Australian operators. Book a demo to see a transfer screened, held and reported with your own corridors.
Rules change, and AUSTRAC's own pages are the authority. Treat this as a guide to what your platform should evidence, not as legal advice. Check with your compliance adviser.