Four AML/CTF foundations affected businesses should have in place now
Australia’s expanded anti-money laundering and counter-terrorism financing obligations commenced for newly regulated businesses on 1 July 2026.
For affected businesses, the implementation period has passed an important threshold. The question is no longer what may be required in the future. It is whether the organisation has established the foundations needed to comply now.
AUSTRAC expects newly regulated businesses to be enrolled, have an AML/CTF program and compliance officer, train relevant staff and be ready to report suspicious matters. It has also recognised that organisations will continue improving their controls during the 2026–27 financial year.
That recognition should provide businesses with space to improve their approach. It should not be interpreted as permission to postpone implementation.
Four foundations should already be in place or receiving immediate attention:
enrolment with AUSTRAC
an appointed AML/CTF compliance officer
a business-specific ML/TF risk assessment
an operational AML/CTF program.
These foundations are closely connected. They should not be treated as four independent documents or administrative tasks.
1. Confirm your obligations and enrol with AUSTRAC
Newly regulated businesses providing designated services must enrol with AUSTRAC by 29 July 2026. Most businesses only need to enrol, although businesses providing remittance or regulated virtual asset services may also need to register.
Before submitting the enrolment application, an organisation should confirm which of its services are regulated.
The AML/CTF regime is activity-based. This means that a business is not necessarily regulated
because it belongs to a particular profession. It is regulated when it provides an in-scope designated service.
A professional services firm, for example, may provide a mixture of regulated and unregulated services. The business needs a clear way to distinguish between them.
Practical steps include:
mapping each service or transaction type offered by the business
identifying which services fall within the designated service definitions
documenting services that are outside the regime
identifying borderline scenarios that require further assessment
creating a simple decision process for employees opening new matters
recording the basis for important scope decisions.
The organisation should also identify who will administer its AUSTRAC Online account and ensure that access does not depend on one individual. Important confirmations, applications and account records should be retained in a controlled compliance repository.
Enrolment is necessary, but it is not the end of the implementation process. It places the business within the regulatory system. It does not demonstrate that the business can manage its financial crime risks.
2. Appoint a compliance officer who can perform the role
A newly regulated business must appoint an eligible AML/CTF compliance officer and notify AUSTRAC by the later of 29 July 2026 or 14 days after enrolling.
The compliance officer oversees and coordinates the organisation’s day-to-day compliance. The person must have sufficient authority, independence, resources and access to expertise to perform the role effectively.
For a small organisation, the compliance officer may be the owner, a director or another person operating at management level. Larger businesses will usually need clearer separation between board or governing-body oversight, senior management decision-making and day-to-day compliance responsibilities. AUSTRAC recognises that one person may perform several of these roles in a smaller business.
The organisation should document:
who has been appointed
when the appointment took effect
how the person satisfies the eligibility requirements
the responsibilities and authority attached to the role
access to senior management or the governing body
the resources available to the officer
arrangements covering leave or absence
who will support operational activities such as customer checks, training and reporting.
The role should also have a practical reporting arrangement. Although AUSTRAC requires the compliance officer to report to the governing body at least annually, a newly regulated organisation should not wait 12 months to understand whether its controls are working.
During the first year, a monthly or quarterly report may be more appropriate. It could cover:
the number of regulated matters opened
customer due diligence exceptions
higher-risk customers
staff training completion
internal suspicious matter escalations
regulatory reports submitted
control failures and remediation actions
emerging risks or changes to the business.
Appointing someone to the role without giving them the time, information or authority to perform it creates the appearance of governance without the substance.
3. Complete a business-specific ML/TF risk assessment
The ML/TF risk assessment is the foundation on which the AML/CTF program should be built.
AUSTRAC requires businesses to identify and assess the money laundering, terrorism financing and proliferation financing risks they may reasonably face. The assessment must be tailored to the nature, size and complexity of the organisation.
At a minimum, the business must consider risks arising from:
the designated services it provides
the types of customers it serves
the channels through which services are delivered
the countries and jurisdictions with which it deals.
This means the organisation should examine its actual operating model rather than starting with a generic risk statement.
Useful questions include:
Which services could be used to conceal ownership or transfer value?
Do we deal with companies, trusts or complex ownership structures?
Do we work with customers or funds connected to higher-risk countries?
Are customers onboarded remotely?
Do we accept physical currency, virtual assets or third-party payments?
Are transactions unusually large, complex or urgent?
Could an intermediary prevent us from understanding the real customer?
Which employees are most likely to encounter suspicious activity?
The risk assessment should distinguish between inherent risk and the risk remaining after controls are applied.
For each material risk, the business should record:
what could occur
which services or customers are affected
the likelihood and potential consequences
the current risk rating
the control used to manage the risk
the person responsible for that control
any further action required.
A risk assessment copied from another organisation may use the correct terminology but still fail to reflect how the business operates.
The purpose of the assessment is not to prove that the organisation is low risk. It is to show that the organisation understands where it could be exploited and has made deliberate decisions about how those risks will be managed.
4. Turn the risk assessment into an operational AML/CTF program
An AML/CTF program must include both the organisation’s risk assessment and the policies, procedures, systems and controls used to manage the risks identified.
This is where many organisations may need to move beyond policy drafting.
The program should clearly explain what employees are expected to do when providing a regulated service. It should address:
identifying when a designated service is being provided
customer identification and verification
beneficial ownership
persons acting for or on behalf of customers
customer risk ratings
politically exposed person and sanctions screening
enhanced customer due diligence
source-of-funds and source-of-wealth enquiries
ongoing customer monitoring
suspicious matter escalation and reporting
threshold transaction reporting where applicable
personnel due diligence
staff training
recordkeeping and privacy
outsourced service providers
review, testing and remediation.
AUSTRAC states that newly regulated businesses must implement AML/CTF programs, conduct customer due diligence, report suspicious matters and keep relevant records.
The program therefore needs to be reflected in normal business processes.
For example:
New matter forms should identify whether the service is regulated.
Staff should not have to search through a lengthy policy to determine what identification is required.
Higher-risk matters should have a defined escalation and approval pathway.
Suspicious matter concerns should reach the compliance officer quickly and confidentially.
Records should show what was checked, who approved the decision and why the business proceeded.
A small organisation may be able to manage these controls through carefully designed checklists, secure folders and manual approvals. A larger organisation may need workflow technology, screening platforms, automated alerts and formal management reporting.
The appropriate solution will depend on the size and complexity of the business.
The policy is not the control. The control is what people actually do, supported by evidence that they did it.
What organisations should be doing over the next 30 days
Once the four foundations have been established, the next priority should be to test whether they are working.
Organisations should review their first group of regulated matters and ask:
Were the services correctly classified?
Was customer due diligence completed at the right time?
Were beneficial owners identified?
Were customer risk ratings supported by evidence?
Were higher-risk indicators escalated?
Could employees explain how to raise a suspicious matter concern?
Were records stored securely and consistently?
Were exceptions approved and documented?
Did the compliance officer receive enough information to oversee the process?
Gaps should be recorded in a remediation plan with an owner and target date.
AUSTRAC has said it expects effort rather than perfection during the 2026–27 financial year, while also expecting businesses to have an implementation plan and make progress.
The organisations best placed to demonstrate that effort will not necessarily be those with the longest policies. They will be those that can show:
the risks they identified
the decisions they made
the controls they introduced
the people they trained
the cases they reviewed
the weaknesses they found
the improvements they completed.
Move from preparation to evidence
The immediate objective for newly regulated businesses should be to establish a defensible operating position.
That means being able to demonstrate that the organisation is enrolled, its compliance officer is capable and supported, its risk assessment reflects its business, and its AML/CTF program is being followed in practice.
Compliance will continue to mature. Processes will improve as staff gain experience and businesses better understand the risks within their sectors.
But improvement needs a working starting point.
For affected organisations, that starting point should already exist.
Branova helps newly regulated businesses assess their obligations, develop practical AML/CTF programs and turn regulatory requirements into controls that can operate within their day-to-day business.
This article provides general information and does not constitute legal advice. The obligations applying to a business will depend on the services it provides and its particular circumstances.
Comments