General Overview and Timeline
When do the changes take effect for existing reporting entities?
For existing reporting entities, most changes take effect on 31 March 2026, so it’s important for reporting entities to start considering the action they must take now.
Some enhancements to AUSTRAC’s information and examination powers came into effect earlier, on 7 January 2025, and amendments to the ‘tipping off’ offence were effective from 31 March 2025.
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (AML/CTF Act) was passed by Parliament on 29 November 2024. The Amended AML/CTF Act introduces substantial changes to modernise, clarify, and simplify the existing AML/CTF regime in Australia.
What are the key areas of change existing reporting entities must focus on?
There are a number of key changes, including in relation to governance, AML/CTF Compliance Officers, and customer due diligence (CDD). The most important change is in relation to the risk assessment – existing reporting entities must conduct a risk assessment of their business and also of each client onboarded.
Existing reporting entities must update their current AML/CTF Programs, and the frameworks and systems, and consider changes to how they manage their risks and obligations. Reporting entities must ensure they have the necessary resources, tools and organisational focus to make these changes over the coming months.
Do reporting entities need to update their AML/CTF Program?
Yes, reporting entities must update their existing AML/CTF Program in order to comply with the amended Act and Rules. AUSTRAC expects reporting entities to be making a concerted effort to review and update their AML/CTF Programs, systems, policies and controls to ensure changes are implemented prior to 31 March 2026.
Is there a transition period?
No, AUSTRAC has not announced a transition period for existing reporting entities.
Risk Assessments and AML/CTF Programs
Are there new requirements for risk assessments under the amended regime?
Yes, risk assessments are a critical focus for AUSTRAC. Reporting entities will need to review and enhance their ML/TF risk management framework and processes. The requirement to undertake a money-laundering, terrorism financing, and proliferation financing (ML/TF/PF) risk assessment is now a specific requirement in the Amendment Act. This overarching written risk assessment must consider relevant risks, taking into account the nature, size and complexity of your business, including:
- your customer types;
- jurisdictions you deal with;
- the Designated Services you provide; and
- delivery channels utilised.
What is proliferation financing?
Proliferation financing refers to providing funds for the manufacture, acquisition, or use of nuclear, chemical, or biological weapons.
Is there still a Part A and Part B in the AML/CTF Program?
No. The updated AML/CTF Act revises the structure of AML/CTF programs.
The two main components are now:
- your ML/TF/PF risk assessment; and
- your AML/CTF policies (including your program).
Programs no longer need to be formally split into Parts A and B. Reporting entities can implement a range of policies which must be documented in writing, approved by a senior manager and reviewed and updated regularly.
Remember, non-compliance with your AML/CTF policies now constitutes a civil penalty offence.
What is the requirement for independent reviews?
Independent reviews are now called independent evaluations.
Reporting entities must have their AML/CTF policies independently evaluated at least every three years. Your AML/CTF policies must incorporate procedures for conducting these independent evaluations. If the independent evaluator makes adverse findings, reporting entities must conduct a review of their ML/TF risk assessment as soon as practicable.
Governance and Oversight
What are the main changes in relation to governance? Will I need to make changes to my organisation?
Under the new requirements, there are three key roles:
- Governing Body – responsible for overseeing and ensuring compliance with your AML/CTF Policies and obligations under the legislation
- Senior Managers – responsible for approving your AML/CTF Policies
- AML/CTF Compliance Officer – responsible for the implementation of your AML/CTF Policies, communicating with AUSTRAC and reporting to the Governing Body.
You will need to formally appoint an AML/CTF Compliance Officer and determine the person is:
- A ‘fit and proper’ person.
- A Resident in Australia if you provide designated services through a permanent establishment in Australia.
- Employed or otherwise engaged at management level, with sufficient authority, independence, and access to resources and information.
How does the ‘reporting group’ replace the ‘designated business group’ (DBG)?
The concept of a Designated Business Group (DBG) is replaced by a new ‘reporting group’ framework. A ‘reporting group’ may include both reporting and non-reporting entities. There are two types of reporting groups:
- Those formed by election; or
- A group where there is a control relationship between one entity and the others in the group (e.g.: a corporate group).
Reporting entities in the group must designate a ‘lead entity’. The lead entity’s governing body must maintain oversight across the group and will be liable for a contravention committed by a reporting entity member of the group.
What is the new approach to Customer Due Diligence (CDD)?
The reforms shift from prescriptive rules to an outcomes-based framework. Reporting entities are required to carry out:
- Initial customer due diligence;
- A risk assessment for each customer; and
- Ongoing customer due diligence.
The risk assessment assists reporting entities in determining the initial and enhanced KYC information required from the client.
What is required during initial CDD?
Initial CDD must be completed before providing a designated service unless it would interrupt the ordinary course of business. As part of initial CDD, reporting entities must establish:
- The identity of the customer and any beneficial owners;
- The nature and purpose of the business relationship;
- Whether the customer, beneficial owner, or associated person is a politically exposed person (PEP); and
- Whether the customer, beneficial owner, or associated person is designated for targeted financial sanctions.
What is required for ongoing customer due diligence?
Reporting entities must continuously monitor customers to identify, assess, manage, and mitigate ML/TF/PF risks. This includes:
- monitoring for unusual transactions or behaviours;
- significant changes to the customer’s risk assessment; and
- re-verifying KYC information if adequacy or veracity is doubted.