AML/CTF Compliance in Australia: Practical Answers for Reporting Entities

How ComplyIQ interprets and operationalises AML/CTF obligations for Australian reporting entities.

Disclaimer: This article provides general information only and isn’t legal advice. AML/CTF obligations can vary depending on your designated services and circumstances. AUSTRAC guidance also notes that laws are changing from 31 March 2026 (for existing reporting entities), with additional services/entities (“Tranche 2”) commencing from 1 July 2026.

AML/CTF compliance in Australia is often discussed in abstract terms. For reporting entities, it’s a practical, enforceable obligation that must be demonstrated through day-to-day operations and backed by records you can produce quickly when AUSTRAC asks.

Many organisations understand the theory (have a program document, do some training, keep a few registers) but struggle with the evidence: showing that controls are consistently applied, decisions are defensible, and reporting actions are traceable.

This guide answers common AML/CTF questions using a practical, operational lens reflecting how compliance is typically assessed in reviews and audits.

Quick self-check: would you be audit-ready tomorrow?

If AUSTRAC requested evidence this week, could you quickly produce:

– a current AML/CTF program and proof of approvals/updates

– customer identification / verification records linked to the customer relationship

– monitoring outputs and why you took (or didn’t take) action

– suspicious matter decisions, escalation notes, and supporting evidence

complete, consistent records that are secure, retrievable, and retained correctly

• If the answer is “not easily”, that’s usually an operational problem not a knowledge problem.

What does AML/CTF actually mean for my business in Australia?

Anti-money laundering (AML) is about preventing criminal proceeds from being disguised as legitimate funds.
Counter-terrorism financing (CTF) focuses on preventing money or assets from being used to support terrorist activity.

In Australia, AML/CTF obligations apply based on what services you provide, not what you call your business. Reporting entities are expected to understand how their customers, transactions, products and channels could be misused and apply controls that reduce those risks.

A common misunderstanding is treating AML/CTF as a documentation task, rather than an active control framework that produces evidence through normal operations.

Who regulates AML/CTF compliance in Australia and what do they expect from me?

AML/CTF compliance in Australia is regulated by AUSTRAC, under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and associated Rules.

In practice, AUSTRAC’s expectations are strongly evidence-based. Policies and training are baseline requirements, but reviews often focus on whether you can demonstrate that controls operate consistently in the real world and that your records are complete, secure, and retrievable.

Am I considered a reporting entity under Australian AML/CTF law?

You’re generally a reporting entity if you provide one or more designated services under the AML/CTF Act (with a relevant geographical link). Designated services cover a range of activities across sectors such as financial services, gambling, remittance, bullion and virtual asset services (and, under reforms, additional services/sectors).

If you’re unsure, treat this as a risk item: misidentifying reporting entity status can create regulatory exposure and downstream operational disruption.

What AML/CTF obligations do I actually have to comply with?

While obligations vary by designated service and risk profile, reporting entities typically need to be able to demonstrate:

• – an AML/CTF program that’s adopted, governed, and kept current
• – customer due diligence (CDD) and identity procedures appropriate to risk
• – ongoing monitoring of transactions and customer behaviour
• – escalation and decisioning pathways (including suspicious matters)
• – reporting and record-keeping obligations, with correct retention

Importantly, AUSTRAC doesn’t assess these items in isolation. It evaluates how they function together as a system from risk identification through to actions taken, records retained, and governance oversight.

What does a risk-based approach mean in practice for my organisation?

A risk-based approach means you identify where ML/TF risks are most likely to arise and apply stronger controls where risk is higher.

In practice, the most common failure point is a static risk assessment (updated infrequently, disconnected from day-to-day decisioning). A defensible approach typically shows that risk settings influence operations for example: what triggers enhanced checks, how monitoring thresholds are set, and how escalations are handled.

What records do I need to keep for AML/CTF compliance and for how long?

Record-keeping is not optional. AUSTRAC requires reporting entities to create full and accurate records and store them securely in a format that allows retrieval and audit.

At a high level, you generally need records about:

• – transactions
• – customer identification procedures
• – your AML/CTF program

Retention periods depend on record type, but AUSTRAC guidance includes clear “seven-year” requirements in multiple areas. For example:

• – transaction records: 7 years
• – customer identification procedure records: for the duration of the relationship, plus 7 years after you stop providing designated services
• – AML/CTF program records: generally 7 years after the program ends / changes cease to have effect

A practical takeaway: if your records are spread across spreadsheets, shared drives, emails, and individual staff folders, your biggest risk may be retrievability and consistency, not intent.

What happens if AUSTRAC reviews or audits my AML/CTF framework?

An AUSTRAC review or audit typically examines whether you:

1. understand your obligations
2. have appropriate controls in place
3. can demonstrate those controls operating in practice

Evidence requests are central. Organisations that rely on manual logs or post-event reconstruction often face delays and inconsistencies that increase scrutiny. Outcomes are usually strongest where evidence is captured as part of normal operations rather than assembled retrospectively.

What penalties apply if I fail to meet AML/CTF obligations in Australia?

Non-compliance can lead to enforcement actions including civil penalty orders, enforceable undertakings, infringement notices, and remedial directions.

Beyond penalties, regulatory action can disrupt operations, damage reputation, and highlight governance and oversight weaknesses which is why AML/CTF is increasingly treated as a business-wide governance capability, not an admin task.

How will the AML/CTF reforms and Tranche 2 changes affect my obligations?

AUSTRAC has confirmed AML/CTF reforms are underway:

• – From 31 March 2026: reforms commence for existing reporting entities (with updated guidance available)
• – From 1 July 2026: additional services and entities (“Tranche 2”) come under AUSTRAC regulation

For many businesses, the practical implication is the same: expectations are moving toward stronger operational maturity clearer evidence, better traceability, and more defensible decisioning.

How can I operationalise AML/CTF compliance across my business?

Understanding the rules is only the starting point. The real challenge is embedding AML/CTF into daily work in a way that is:

• – consistent across teams and shifts
• – auditable (who did what, when, and why)
• – defensible (supported by evidence)
• – efficient (not reliant on post-event reconstruction)

Where ComplyIQ fits

ComplyIQ provides a structured digital environment to help reporting entities operationalise AML/CTF activities and retain evidence as it’s created including governed workflows for records, escalations, and compliance accountability.

The outcome is simpler day-to-day execution and stronger audit readiness because your evidence is captured as part of doing the work, not assembled later.

How do I know if my current AML/CTF approach would stand up to an AUSTRAC review?

A defensible AML/CTF framework produces evidence naturally through normal operations.

Common red flags include:

• – heavy reliance on manual logs or spreadsheets for core controls
• – scattered evidence across systems with no consistent linkage to decisions
• – “end of month” or “post-incident” reconstruction of monitoring and escalations
• – unclear accountability for suspicious matters and escalation outcomes

If those patterns sound familiar, the fastest improvement usually comes from systemising how evidence is created, linked, and retained aligned to AUSTRAC record-keeping expectations.