Introduction

Since 31 March 2026, Australian banks have operated under a reformed anti-money laundering and counter-terrorism financing (‘AML/CTF’) regime that replaced the former Part A and Part B program structure with a money laundering and terrorism financing (‘ML/TF’) risk assessment, AML/CTF policies and explicit governing body oversight. Transitional arrangements still affect customer identification, independent evaluations and international value transfer reporting.

Boards, AML/CTF compliance officers and financial crime teams must understand their responsibilities, the requirements that apply to their bank and the evidence needed to show the Australian Transaction Reports and Analysis Centre (‘AUSTRAC’) and the Australian Prudential Regulation Authority (‘APRA’) that controls operate effectively.

What Does the Reformed AML/CTF Regime Require of Australian Banks?

Which Banking Services Are Designated Services?

Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘) identifies the designated services that bring banking activities within the AML/CTF regime. Services commonly provided by a bank include:

• Opening and operating accounts
• Accepting deposits
• Providing loans and other financing
• Transferring value domestically or internationally
• Providing correspondent or nested services
• Offering foreign exchange and other financial products covered by Section 6

An authorised deposit-taking institution’s status under the Banking Act 1959 (Cth) does not determine the AML/CTF treatment of every activity. Each bank should map its designated services to its products, business units, delivery channels and customer types.

What Changed for Banks From 31 March 2026

The 2026 AML/CTF reforms took effect for existing reporting entities on 31 March 2026. The former Part A and Part B structure was replaced with an AML/CTF program comprising an ML/TF risk assessment and AML/CTF policies under Section 26B of the AML/CTF Act.

Key changes include:

• Direct governing body oversight under Section 26H of the AML/CTF Act
• Express assessment of proliferation financing risk
• Senior manager approval of the risk assessment, AML/CTF policies and updates under Section 26P
• Independent evaluations of the AML/CTF program
• Reformed transfer-of-value and information-sharing obligations
• New requirements concerning nested services relationships

Transitional Deadlines Still Running for Existing Banks

Existing banks must check which transitional arrangements apply to their enrolment history, prior reviews, customer classes and reporting systems. The key future dates are:

• 31 March 2027: The first post-reform independent evaluation may be due by this date. For an eligible bank with a qualifying prior review, the applicable deadline is the later of 31 March 2027 or four years after that review.
• 31 March 2029: The transition from applicable pre-reform customer identification procedures to initial customer due diligence must be completed before this date, subject to the required transitional conditions.
• 31 March 2029: International funds transfer instruction reporting ordinarily transitions to international value transfer service reporting.
• 30 September 2029: An eligible reporting entity may nominate a later substitute date for the international value transfer reporting transition, subject to the transitional conditions and notification requirements.

Banking Groups and Reporting Groups

The AML/CTF Act allows specified obligations to be managed through a reporting group led by a designated lead entity. Section 26U of the AML/CTF Act requires the lead entity’s business assessment to include the businesses of other reporting entities in the group. Section 236B and Part 2 of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) (‘AML/CTF Rules‘) provide further group arrangements.

A reporting group may share its risk assessment, AML/CTF policies, compliance infrastructure and assurance arrangements. Each member remains responsible under Section 26G(2) of the AML/CTF Act for complying with the lead entity’s AML/CTF policies as they apply to that member. Group documents should identify the entities covered, each entity’s designated services, locally retained responsibilities and escalation arrangements.

Who Is Accountable for AML/CTF Compliance in an Australian Bank?

The Board’s Oversight Responsibilities

Under Section 26H(1) of the AML/CTF Act, the governing body must maintain ongoing oversight of the bank’s ML/TF risk assessment, AML/CTF policies and compliance with applicable obligations. It must also take reasonable steps to ensure the bank identifies, assesses, manages and reduces its financial crime risks.

Rule 5-6 of the AML/CTF Rules requires the bank’s policies to provide the governing body with information needed for this role. Board papers and minutes should record:

• material risks;
• control failures;
• independent evaluation findings;
• management responses;
• questions asked;
• decisions made; and
• follow-up actions.

A report marked “noted” may not show that the governing body actively performed its oversight responsibilities.

The AML/CTF Compliance Officer

A bank must designate an eligible AML/CTF compliance officer under Section 26J of the AML/CTF Act. Rule 5-14 of the AML/CTF Rules requires consideration of the officer’s:

• competence;
• technical knowledge;
• diligence;
• judgement;
• honesty;
• integrity;
• relevant convictions;
• adverse findings; and
• conflicts of interest.

Under Section 26L of the AML/CTF Act, the officer oversees and coordinates day-to-day compliance, the operation of AML/CTF policies and communication with AUSTRAC. Rule 5-7 of the AML/CTF Rules requires reports to the governing body at least once every 12 months. Under Section 26M of the AML/CTF Act, AUSTRAC must be notified within 14 days after the designation.

Senior Manager Approvals

Under Section 26P(1) of the AML/CTF Act, a senior manager must approve the bank’s ML/TF risk assessment, AML/CTF policies and updates to either document. Updates to the risk assessment must also be notified in writing to the governing body as soon as practicable under Section 26P(2) of the AML/CTF Act.

Rule 5-5 of the AML/CTF Rules requires senior manager approval for specified relationships and activities, including:

• certain foreign politically exposed person relationships;
• higher-risk domestic and international organisation politically exposed persons;
• nested services relationships; and
• qualifying reliance arrangements under Section 37A(1)(a) of the AML/CTF Act.

Approval records should identify the relationship, relevant risk factors, supporting customer due diligence, decision-maker and any conditions.

How Accountability Flows Through the Three Lines

The three-lines model provides a practical way to assign AML/CTF responsibilities within a bank, although it is not a structure prescribed by the AML/CTF Act. The model operates as follows:

• The first line consists of business and operational teams applying customer due diligence, carrying out controls, identifying unusual activity and escalating exceptions.
• The second line consists of financial crime compliance and risk functions overseeing the AML/CTF program, advising on risk, testing compliance and challenging control performance. The AML/CTF compliance officer will ordinarily sit within this function.
• The third line is internal audit, which provides independent assurance over governance, risk management and controls.

Each line should retain records showing its work, while the governing body remains responsible for oversight under Section 26H of the AML/CTF Act.

What Must a Bank’s ML/TF Risk Assessment & AML/CTF Policies Cover?

Assessing ML/TF & Proliferation Financing Risk

Under Sections 26C–26E of the AML/CTF Act, a bank must identify and assess the money laundering, terrorism financing and proliferation financing risks it may reasonably face when providing designated services. The assessment must reflect the bank’s nature, size and complexity, including:

• its customer types;
• its products and services;
• its delivery channels;
• its technologies; and
• its jurisdictions.

The assessment must be reviewed and updated under Section 26D of the AML/CTF Act and applicable requirements in the AML/CTF Rules, including Rule 5-1. A bank should record the following before introducing a new product, payment channel or customer segment:

• review triggers;
• changes in risk;
• control effectiveness; and
• the treatment of residual risks.

Customer Due Diligence & Beneficial Ownership

Part 2 of the AML/CTF Act requires initial and ongoing customer due diligence. Section 28 addresses initial customer due diligence and Section 30 addresses ongoing customer due diligence, while Sections 31 and 32 deal with simplified and enhanced customer due diligence. The AML/CTF Rules also address:

• corporate and trust customers;
• beneficial ownership;
• politically exposed persons; and
• higher-risk relationships.

A bank’s policies should explain how it:

• identifies and verifies customers and beneficial owners;
• assigns customer risk ratings;
• obtains information about the purpose of a relationship; and
• applies enhanced customer due diligence.

Where required, enhanced measures may include establishing source of funds and source of wealth. Qualifying existing customers may remain subject to transitional customer identification procedures for specified classes, but transitional arrangements do not remove ongoing customer due diligence obligations or responses required when risk changes.

Transaction Monitoring & Suspicious Matter Reporting

A bank’s AML/CTF policies must describe:

• how it monitors and analyses customer transactions and behaviour;
• whether monitoring is automated or manual; and
• how unusual activity is identified, investigated and escalated.

Rule 5-12 of the AML/CTF Rules requires policies to support timely review of material relevant to potential suspicious matters and a determination, as soon as practicable, of whether reasonable grounds for suspicion exist.

Section 41 of the AML/CTF Act establishes suspicious matter reporting obligations. Once the statutory reporting obligation arises, the applicable report must usually be submitted within 24 hours for relevant terrorism financing suspicions or within three business days for other reportable suspicious matters. Rule 5-13 of the AML/CTF Rules requires safeguards addressing tipping-off risks, including:

• confidentiality controls; and
• appropriate use of sensitive information.

Correspondent Banking Transfers of Value & Sanctions

Banks providing correspondent or nested services must address the additional risks created by indirect access to accounts, payment systems and financial services. Section 96 of the AML/CTF Act requires the following for relevant correspondent banking relationships, with ongoing assessments and record retention obligations:

• due diligence;
• written records; and
• senior officer involvement.

The bank’s policies should also address transfer-of-value requirements under the AML/CTF Rules, including the responsibilities of:

• ordering institutions;
• intermediary institutions; and
• beneficiary institutions.

Rule 5-3 of the AML/CTF Rules requires policies dealing with compliance with the Autonomous Sanctions Act 2011 (Cth) and the Charter of the United Nations Act 1945 (Cth), including controls for:

• screening;
• escalation; and
• restricted dealings.

Personnel Due Diligence & Training

Rule 5-8 of the AML/CTF Rules requires AML/CTF policies to provide for personnel due diligence, including assessment of relevant skills, knowledge, expertise and integrity before and during employment or engagement. The bank should:

• identify roles requiring screening;
• set review triggers; and
• document responses to adverse findings.

Rule 5-9 of the AML/CTF Rules requires role-based AML/CTF training that reflects personnel functions, responsibilities and the bank’s financial crime risks. Training arrangements should cover:

• customer-facing staff;
• investigators;
• payment operations;
• technology teams;
• senior managers; and
• other relevant personnel.

Training arrangements should also include records of completion, retraining and checks on whether training is being applied.

Documenting the Program

Section 26N of the AML/CTF Act requires a bank to document its AML/CTF program and other prescribed matters within the periods specified by the AML/CTF Rules. Rule 5-15 requires the risk assessment and AML/CTF policies to be documented before the bank first provides a designated service to a customer.

Under Rule 5-15(2) of the AML/CTF Rules, an update to the ML/TF risk assessment or AML/CTF policies must be documented within 14 days after the update occurs. The bank should retain:

• approval records;
• written notifications to the governing body;
• operational procedures;
• control descriptions; and
• supporting records showing that the documented program matches the controls operating across the banking business.

How Can a Bank Show Its AML/CTF Program Is Working?

Ongoing Monitoring & Reporting to the Board

A bank should use compliance testing and management information to show whether its AML/CTF controls are designed appropriately, operating as intended and responding to identified risks. Sections 26F and 26H of the AML/CTF Act, together with Rules 5-6 and 5-7 of the AML/CTF Rules, support monitoring and reporting arrangements that allow the governing body to perform its oversight role.

Board reporting should address matters such as:

• customer due diligence backlogs and beneficial ownership gaps;
• transaction monitoring coverage, alert volumes and investigation delays;
• suspicious matter reporting timeliness and quality;
• sanctions screening results and unresolved matches;
• compliance testing results and overdue remediation; and
• material system, staffing or control weaknesses.

A bank should maintain an issue register recording the affected control, risk exposure, responsible owner, target date and validation outcome. Material or systemic issues should be escalated to senior management and the governing body through documented reports, questions, decisions and follow-up actions.

Independent Evaluations

Section 26F(4)(f) of the AML/CTF Act requires AML/CTF policies to address independent evaluations of the bank’s AML/CTF program. Rule 5-10 of the AML/CTF Rules requires the evaluation to:

• examine the ML/TF risk assessment;
• assess the design of AML/CTF policies;
• test compliance with those policies; and
• evaluate how the bank identifies, assesses, manages and mitigates its financial crime risks.

The evaluator must be suitably independent and have expertise appropriate to the bank’s nature, size and complexity. The written report must record the findings and be provided to the governing body and the senior managers responsible for approvals under Section 26P of the AML/CTF Act.

The bank’s policies must set the evaluation frequency, subject to the statutory maximum interval of three years. For an existing bank, the first post-reform evaluation is subject to the transitional deadline outlined above.

Acting on Findings

An evaluation finding should trigger assessment of the affected risk, control, product, customer group and reporting obligation. Section 26D of the AML/CTF Act requires review and updating of the ML/TF risk assessment in accordance with applicable requirements, including Rule 5-1 of the AML/CTF Rules. Rule 5-4 of the AML/CTF Rules requires policies to address updates following adverse evaluation findings.

Remediation records should identify:

• the root cause and risk exposure;
• the corrective action and responsible owner;
• any interim control;
• the target completion date; and
• the testing required before closure.

Any resulting updates are subject to the senior manager approval and governing body notification requirements under Section 26P of the AML/CTF Act outlined above.

Lessons From AUSTRAC’s Enforcement Action Against Banks

AUSTRAC’s enforcement action against major banks shows why a written AML/CTF program is not enough. In June 2018, the Federal Court ordered the Commonwealth Bank of Australia to pay a $700 million civil penalty following proceedings concerning threshold transaction reporting and financial crime risk controls. The matter highlights the need to include automated banking channels within monitoring and reporting systems.

In October 2020, the Federal Court ordered Westpac Banking Corporation to pay a $1.3 billion civil penalty following proceedings involving more than 19 million contraventions of the AML/CTF Act, including deficiencies in international funds transfer reporting.

These historical matters arose under the former framework, but they identify weaknesses that remain relevant to bank programs:

• products or payment channels omitted from the ML/TF risk assessment;
• incomplete transaction data or monitoring coverage;
• reporting failures that continue over extended periods; and
• insufficient escalation of material weaknesses to senior management and the governing body.

A bank should test whether its current controls cover every designated service, payment channel and relevant customer segment, and whether remediation is independently checked before an issue is closed, with advice from AML/CTF compliance lawyers for banks at AFSL House if remediation issues arise.

How Does AML/CTF Governance Fit With APRA’s Prudential Framework?

Including AML/CTF Risk in the CPS 220 Risk Management Framework

APRA’s Prudential Standard CPS 220 Risk Management (‘CPS 220’) requires relevant APRA-regulated institutions to maintain a risk management framework. This framework includes:

• risk management strategy;
• risk appetite arrangements; and
• supporting controls.

Where AML/CTF risks are material, the bank should reflect them in its enterprise risk management processes and board reporting.

The AML/CTF risk assessment under the AML/CTF Act remains separate from the CPS 220 framework. A bank should assess whether significant AML/CTF findings amount to a significant breach of, or material deviation from, its risk management framework when preparing its annual risk management declaration to APRA.

Outsourced AML/CTF Functions & CPS 230

Various providers may perform important AML/CTF functions for a bank, including:

• know-your-customer (‘KYC’) providers;
• sanctions screening tools;
• transaction monitoring systems; and
• data-management providers.

Outsourcing does not transfer the bank’s responsibilities under Section 26F of the AML/CTF Act. Where a bank relies on another reporting entity’s customer identification or verification, Section 37A of the AML/CTF Act and the associated AML/CTF Rules must be assessed separately from ordinary outsourcing.

APRA’s Prudential Standard CPS 230 Operational Risk Management (‘CPS 230‘) may also apply to material service provider arrangements, including controls for:

• data accuracy;
• system availability;
• incidents;
• continuity; and
• access to records.

Board Composition & Fit & Proper Requirements

APRA’s Prudential Standard CPS 510 Governance supports effective board oversight within APRA-regulated institutions. APRA’s Prudential Standard CPS 520 Fit and Proper (‘CPS 520’) requires relevant institutions to assess whether individuals occupying specified positions are suitable to perform their responsibilities.

The AML/CTF compliance officer has separate eligibility requirements under Section 26J of the AML/CTF Act and Rule 5-14 of the AML/CTF Rules. A compliance officer may also fall within the scope of APRA’s CPS 520 where the role meets the applicable definition of a responsible person, but appointment to the AML/CTF role does not automatically establish that classification.

Coordinating AUSTRAC & APRA Engagement

A serious AML/CTF failure may also indicate weaknesses in a bank’s operational controls, technology, governance or wider risk management framework. A transaction monitoring failure, for example, may raise concerns under the AML/CTF Act while also requiring assessment under APRA’s prudential requirements.

AUSTRAC and APRA have arrangements for regulatory cooperation and information sharing within their statutory functions. A bank should assess each regulator’s reporting requirements, thresholds and processes separately, while maintaining:

• a consistent factual record;
• clear responsibility for remediation; and
• explanations for any differences between reports.

Conclusion

Since 31 March 2026, AML/CTF compliance for Australian banks has centred on board oversight, an approved ML/TF risk assessment, effective AML/CTF policies and evidence that controls operate as intended. Transitional arrangements, independent evaluations, customer due diligence, transaction monitoring and reporting require each bank to maintain records supporting its position with AUSTRAC and, where relevant, APRA.

For banks, credit unions and mutual banks needing help, contact AFSL House for AML/CTF banking compliance support to discuss designing, reviewing or independently evaluating an AML/CTF program. AFSL House can assist with governance arrangements, risk assessments, policies and compliance frameworks, helping your banking institution address its responsibilities with clear legal support.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.