AUSTRAC's free starter kit vs paid AML software: what the free kit doesn't cover

What the AUSTRAC starter kit actually is

As part of the Tranche 2 rollout, AUSTRAC published program starter kits for small, low-complexity businesses in the newly regulated sectors — real estate is the best-known, with kits and sector guidance for the other professions alongside. Each kit is a guided set of templates that walks you through the two foundational documents every reporting entity must have: a money laundering and terrorism financing risk assessment, and a written AML/CTF program.

Two things make the kit worth taking seriously. First, it's free and official — there is no more authoritative source on what AUSTRAC expects than AUSTRAC. Second, the software industry itself treats it as the reference point: several Australian platforms advertise that their workflows are 'mapped to' or 'aligned with' the AUSTRAC starter kit. When the paid products benchmark themselves against the free one, that tells you the free one isn't a toy.

The kit is aimed at businesses that fit a low-complexity profile — broadly, straightforward services, mostly individual customers, and no exotic risk factors. If that's not you, the kit itself says to go beyond it, and you should believe it.

What the starter kit covers well

Worked through properly, the kit gets you a defensible first version of the paperwork layer of compliance:

• Risk assessment structure. It steps you through the four risk lenses AUSTRAC cares about — customer risk, product and service risk, delivery channel risk, and country risk — with sector-specific prompts so you're not staring at a blank page.
• The written program. Policies, procedures and controls proportionate to your risks, including governance roles: who your governing body is, who your senior manager is, and who holds the AML/CTF compliance officer role.
• Sector language. The risk indicators are written for your industry — auction dynamics for agents, trust structures for lawyers and accountants — rather than generic bank-speak.
• Regulator alignment by definition. Nobody can tell you the regulator's own template misreads the regulator's expectations.

For the two obligations it targets — risk assessment and program — the kit is genuinely competitive with what most paid platforms generate. Several platforms' program builders are, functionally, the starter kit with a nicer interface.

The gaps: obligations the free kit doesn't operationalise

Tranche 2 compliance is roughly eleven distinct obligations. The kit addresses two of them well and touches a third. Everything else is operational — it has to happen, repeatedly, to real customers, with evidence — and a template can't do operations.

Specifically, the starter kit will not:

• Verify anyone. Customer due diligence — identity verification, entity verification, beneficial ownership for companies and trusts — still has to be performed on every customer, by you or by a tool.
• Screen anyone. Checking customers against DFAT sanctions lists and politically exposed person databases is a live data problem. A PDF can't query a watchlist.
• Monitor anything. Ongoing customer due diligence means re-checking risk as relationships continue. That's a recurring process, not a document.
• Lodge your reports. Suspicious matter reports go through AUSTRAC Online, but the workflow — spotting the trigger, making the call, keeping the decision trail — is yours to build.
• Deliver or track training. Staff must be trained and you must be able to show it. The kit describes the obligation; it doesn't run a course or keep attendance.
• Keep your records. Seven years of retrievable evidence, per customer, per decision. A folder structure is a plan, not a system.

None of this makes the kit bad. It makes it exactly what it says it is: a program starter. The trap is mistaking finished paperwork for finished compliance — AUSTRAC assesses how your program operates in practice, not how it reads on the shelf.

When the starter kit alone is genuinely enough

There is a real cohort of newly regulated businesses — plausibly a large one, given around 90,000 entities came into scope — for whom the free kit plus manual process is a legitimate starting position. You're probably in it if most of the following hold:

• You take on a handful of new clients a month, not dozens.
• Your customers are overwhelmingly individuals, not companies or trusts.
• You have no offshore clients, no auction-day time pressure, and no unusual payment patterns.
• You (or one trusted person) can own the process end to end — verification, a screening check, and filing the evidence.
• You're disciplined about records without software forcing you to be.

Nothing in the AML/CTF Act mandates software. Manual customer due diligence — sighting and certifying documents, running a per-check verification through a pay-as-you-go tool, saving the evidence — is lawful and, at low volume, often cheaper and no slower. Pay-as-you-go verification in the Australian market currently runs from roughly $8 to $40 per check depending on the provider and what's bundled, which at five checks a month is coffee money next to a subscription.

The honest test: if reading the list above felt like a description of your business, start free. If it felt like a description of a business simpler than yours, keep reading.

When you need software — and what it must cover

The trigger points that move a business from 'kit plus manual' to 'platform' are consistent across the firms we've looked at:

• Volume. Somewhere north of 10–15 verifications a month, manual process stops scaling and per-check economics start favouring bundled plans.
• Entity complexity. The first trust or layered company structure turns beneficial ownership from a form field into an investigation. This is where software earns its keep fastest.
• Timing pressure. Auction-day and exchange scenarios have specific delayed-CDD rules; platforms built for property handle the clock for you.
• Staff. The moment employees touch customers, you need training delivered, assessed and evidenced — and a shared system so compliance doesn't live in one person's head.
• Audit anxiety. If AUSTRAC asked tomorrow, could you produce every verification, screening result and decision for the last year in an afternoon? If not, you're buying record-keeping as much as verification.

If you do buy, buy against the gaps, not the brochure. A platform that only does screening leaves you hand-building CDD and records. A platform that only generates program documents duplicates what the free kit already gave you. Verified entry pricing for full Australian Tranche 2 platforms currently spans roughly $59 to $350 a month, with per-check fees on top for most — the spread is wide enough that the wrong-shaped choice costs real money. Our vendor reviews score every product against all eleven obligations for exactly this reason; where a vendor hasn't published or confirmed a capability, we mark it Unverified rather than guessing (here's how that works).

When a consultant beats both

Software assumes you can drive it. Some situations warrant a human instead — or as well:

• Genuinely complex risk. Trust-heavy client books, offshore money, high-value cash-adjacent work. A templated risk assessment — free or paid — will underweight what makes you unusual.
• No internal capacity. If nobody in the business will actually own compliance, a platform becomes an expensive unread dashboard. An outsourced arrangement at least guarantees the work happens.
• You want it pressure-tested. Independent evaluation of your program is itself one of the obligations on the horizon; a consultant engagement can double as an early version of that discipline.

The pairing that works for a lot of small firms: consultant-built (or kit-built, consultant-reviewed) program, plus a cheap per-check verification tool, plus your own records discipline. That covers the thinking, the doing, and the proving without a platform subscription.

Consultant pricing is quote-driven and varies enormously — treat any figure quoted without a written scope with scepticism, and get more than one quote.

True cost comparison: free kit vs software vs consultant

The government's own Regulation Impact Statement put the average ongoing cost of Tranche 2 compliance at $23,250 per business per year — a number that includes time, training, tools and advice, and one worth keeping in view when a $99/month subscription is pitched as the whole answer or the whole problem.

How the three paths actually stack for a small firm doing around five new clients a month:

• Starter kit + manual + pay-per-check: $0 in software, roughly $40–$200 a month in checks depending on provider, plus your hours. Cheapest in cash, most expensive in attention. Fragile past one owner-operator.
• Platform subscription: $59–$350+ a month verified entry pricing, plus per-check fees on most plans. Buys you workflow, records and (on some) training. The spread between the cheapest adequate option and an over-specced one is thousands a year, which is why comparing before buying matters.
• Consultant-led: the largest and least predictable upfront spend, lowest ongoing internal effort. Best value precisely when your risk profile is the thing that's complicated.

Notice what's not true: 'free' isn't free (your time is the fee), and 'paid' isn't automatically safer (an unused platform protects nobody). The differentiator between these paths is rarely the cash — it's whether the operational work reliably happens, and can be proven.

Verdict

Start with the question the vendors won't ask: is your business actually low-complexity? If yes — few clients, simple customers, one disciplined owner — take the free kit, wire up a pay-as-you-go verification tool, and spend nothing else until a trigger event: your first trust client, your first auction campaign, your first hire who touches customers. Upgrading later is a re-keying exercise, not a rebuild.

If you're past any of those triggers already, buy software — but buy it against the eleven obligations, with the free kit as your baseline for what $0 already covers. Anything a platform charges you for that the regulator gives away should be buying convenience, not existence.

And whichever path you take this week, note that the deadline pressure around the 29 July enrolment date is doing a lot of selling right now. Enrolment is urgent. Software is a decision. Don't let the first panic you into rushing the second.