AML/CTF compliance for multi-office and franchise businesses — AUSTRAC 2026

It depends on the legal structure. If all offices operate under the same Australian Business Number as a single legal entity, one AML/CTF program can cover all offices — but it must address the specific risk profile of each location. If each office, branch, or franchisee is a separate legal entity, it is a separate reporting entity under the AML/CTF Act and must have its own program, its own AUSTRAC enrolment, and its own compliance officer.

No. Where each franchisee is a separate legal entity — which is the standard franchise structure — the franchisor's program covers the franchisor's own designated services only. Each franchisee that provides a designated service must develop and adopt its own AML/CTF program under s 81. A franchisor can provide templates, tools, and support — and an AutoAML group account can generate individual programs for every franchise location — but it cannot substitute its own program for the franchisee's.

The most effective approach combines centralised document templates (so all offices start from the same compliant baseline), entity-specific customisation for each office's actual services and risk profile, a central training platform that tracks completion across all locations, and a group compliance dashboard that surfaces which entities are current and which are overdue for review. AutoAML's multi-tenant architecture is built for exactly this pattern.

Each reporting entity must appoint a compliance officer under its own AML/CTF program. In a multi-office group, this can be a group compliance manager who holds the role for multiple entities, supported by local deputies who handle day-to-day administration at each site. What matters is that someone with actual authority is named, the appointment is documented, and the person has the time and access to administer the program.

Risk assessments must reflect each entity's actual risk profile under Chapter 3 of the AML/CTF Rules. A city office that regularly processes overseas buyers, large transaction values, and complex trust structures cannot be covered by a low-risk suburban office's risk assessment. AutoAML generates individual risk assessments for each entity from its specific onboarding questionnaire — so high-risk and low-risk offices get proportionate but separate documentation.

The most common failure is version drift — the head-office program is updated but individual-location programs are not, leaving some entities operating on an outdated or superseded policy. The second most common is training gaps: new starters at branch offices not receiving AML/CTF training before client contact. Both are structurally prevented by a centralised compliance platform that tracks program versions and training completion per entity.