FAQs – AML/CTF Reforms

General Overview and Timeline

When do the changes take effect for existing reporting entities?

For existing reporting entities, most changes take effect on 31 March 2026, so it’s important for reporting entities to start considering the action they must take now.

Some enhancements to AUSTRAC’s information and examination powers came into effect earlier, on 7 January 2025, and amendments to the ‘tipping off’ offence were effective from 31 March 2025.

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (AML/CTF Act) was passed by Parliament on 29 November 2024. The Amended AML/CTF Act introduces substantial changes to modernise, clarify, and simplify the existing AML/CTF regime in Australia.

There are a number of key changes, including in relation to governance, AML/CTF Compliance Officers, and customer due diligence (CDD). The most important change is in relation to the risk assessment – existing reporting entities must conduct a risk assessment of their business and also of each client onboarded.

Existing reporting entities must update their current AML/CTF Programs, and the frameworks and systems, and consider changes to how they manage their risks and obligations. Reporting entities must ensure they have the necessary resources, tools and organisational focus to make these changes over the coming months.

Yes, reporting entities must update their existing AML/CTF Program in order to comply with the amended Act and Rules. AUSTRAC expects reporting entities to be making a concerted effort to review and update their AML/CTF Programs, systems, policies and controls to ensure changes are implemented prior to 31 March 2026.

No, AUSTRAC has not announced a transition period for existing reporting entities.

Risk Assessments and AML/CTF Programs

Are there new requirements for risk assessments under the amended regime?

Yes, risk assessments are a critical focus for AUSTRAC. Reporting entities will need to review and enhance their ML/TF risk management framework and processes. The requirement to undertake a money-laundering, terrorism financing, and proliferation financing (ML/TF/PF) risk assessment is now a specific requirement in the Amendment Act. This overarching written risk assessment must consider relevant risks, taking into account the nature, size and complexity of your business, including:

  • your customer types;
  • jurisdictions you deal with;
  • the Designated Services you provide; and
  • delivery channels utilised.

Proliferation financing refers to providing funds for the manufacture, acquisition, or use of nuclear, chemical, or biological weapons.

No. The updated AML/CTF Act revises the structure of AML/CTF programs. 

The two main components are now:

  • your ML/TF/PF risk assessment; and
  • your AML/CTF policies (including your program).

 

Programs no longer need to be formally split into Parts A and B. Reporting entities can implement a range of policies which must be documented in writing, approved by a senior manager and reviewed and updated regularly.

Remember, non-compliance with your AML/CTF policies now constitutes a civil penalty offence.

Independent reviews are now called independent evaluations.

Reporting entities must have their AML/CTF policies independently evaluated at least every three years. Your AML/CTF policies must incorporate procedures for conducting these independent evaluations. If the independent evaluator makes adverse findings, reporting entities must conduct a review of their ML/TF risk assessment as soon as practicable.

Governance and Oversight

What are the main changes in relation to governance? Will I need to make changes to my organisation?

Under the new requirements, there are three key roles:

  • Governing Body – responsible for overseeing and ensuring compliance with your AML/CTF Policies and obligations under the legislation
  • Senior Managers – responsible for approving your AML/CTF Policies
  • AML/CTF Compliance Officer – responsible for the implementation of your AML/CTF Policies, communicating with AUSTRAC and reporting to the Governing Body.

 

You will need to formally appoint an AML/CTF Compliance Officer and determine the person is:

  1. A ‘fit and proper’ person.
  2. A Resident in Australia if you provide designated services through a permanent establishment in Australia.
  3. Employed or otherwise engaged at management level, with sufficient authority, independence, and access to resources and information.

The concept of a Designated Business Group (DBG) is replaced by a new ‘reporting group’ framework. A ‘reporting group’ may include both reporting and non-reporting entities. There are two types of reporting groups:

  1. Those formed by election; or
  2. A group where there is a control relationship between one entity and the others in the group (e.g.: a corporate group).

 

Reporting entities in the group must designate a ‘lead entity’. The lead entity’s governing body must maintain oversight across the group and will be liable for a contravention committed by a reporting entity member of the group.

The reforms shift from prescriptive rules to an outcomes-based framework. Reporting entities are required to carry out:

  • Initial customer due diligence;
  • A risk assessment for each customer; and
  • Ongoing customer due diligence.

 

The risk assessment assists reporting entities in determining the initial and enhanced KYC information required from the client.

Initial CDD must be completed before providing a designated service unless it would interrupt the ordinary course of business. As part of initial CDD, reporting entities must establish:

  • The identity of the customer and any beneficial owners;
  • The nature and purpose of the business relationship;
  • Whether the customer, beneficial owner, or associated person is a politically exposed person (PEP); and
  • Whether the customer, beneficial owner, or associated person is designated for targeted financial sanctions.

Reporting entities must continuously monitor customers to identify, assess, manage, and mitigate ML/TF/PF risks. This includes:

  • monitoring for unusual transactions or behaviours;
  • significant changes to the customer’s risk assessment; and
  • re-verifying KYC information if adequacy or veracity is doubted.

AML/CTF Reforms

Sophie Grace can provide you with an AML/CTF Program and can assist you to tailor it to your business’ needs. We have three different options available to suit your business and finance needs.

Template Documents

You can purchase template documents from our online shop. The template is an instant download and includes prompts to help you tailor the document yourself. We have template documents for:

  • Tranche 1 Reporting Entities;
  • Item 54 Providers; and
  • Tranche 2 Entities.
Compliance Portal

Sign up to the Compliance Portal and receive the template AML/CTF Program Package, and obtain access to updated documents in light of any updates we make as new guidance or amended legislation is released. Choose between:

  • document-only plans;
  • consultation-only plans;
  • video and regulatory update plans; or
  • a combination of all three.
Tailored Documents

Sophie Grace can assist you to prepare the AML/CTF Program package based on your business’ specific requirements. Contact us to discuss further. 

Find everything you need in relation to the AML/CTF Reforms

Sophie Grace Compliance Portal

Sign up today for up-to-date compliance policies and regular consultation with our staff. Watch our demonstration video now!

Recent Updates

Contact Us

We will get in touch as soon as possible

=