Introduction

Australian lenders and mortgage brokers must maintain governance, risk management and compliance frameworks suited to their credit activities and regulatory obligations, with governance, risk, and compliance support for lenders and mortgage brokers available where needed. Australian Credit Licence (ACL) holders must meet Section 47 of the National Consumer Credit Protection Act 2009 (Cth) (‘NCCP Act‘), while anti-money laundering and counter-terrorism financing (AML/CTF) duties depend on the designated services provided rather than ACL status.

Under the reformed AML/CTF framework, existing reporting entities generally became subject to the new program requirements on 31 March 2026, while newly regulated professional designated services became subject to AML/CTF obligations on 1 July 2026. Relevant businesses must address money laundering, terrorism financing (ML/TF) and proliferation financing risks through written policies, customer due diligence, transaction monitoring and suspicious matter reporting. This article explains the governance and risk management obligations of ACL holders, when AML/CTF obligations apply to lenders and mortgage brokers, what an AML/CTF program must include and how to keep compliance frameworks up to date.

What Governance and Compliance Frameworks Must ACL Holders Maintain?

Section 47 of the NCCP Act

Under Section 47(1)(a) of the NCCP Act, an ACL holder must take all necessary steps to conduct authorised credit activities efficiently, honestly and fairly. Section 47(1)(b) of the NCCP Act also requires adequate arrangements to ensure clients are not disadvantaged by conflicts of interest.

The statutory compliance arrangements must address:

• Competence and training: The licensee must maintain its own competence under Section 47(1)(f) of the NCCP Act, while ensuring representatives are trained and competent under Section 47(1)(g).
• Dispute resolution: Section 47(1)(h) of the NCCP Act requires an internal dispute resolution procedure.
• Representative supervision: Section 47(1)(e) requires reasonable steps to ensure representatives comply with credit legislation.
• Risk management: Unless regulated by the Australian Prudential Regulation Authority, Section 47(1)(l) requires adequate financial, technological and human resources, together with adequate risk management systems.

Governance Structures and Documented Compliance Policies

Section 47(1)(k) of the NCCP Act requires adequate arrangements and systems to ensure compliance with the obligations in Section 47, together with a written plan documenting those arrangements and systems. Section 47(2) of the NCCP Act requires adequacy to be assessed against the nature, scale and complexity of the licensee’s credit activities.

The Australian Securities and Investments Commission (ASIC) Regulatory Guide 205 Credit licensing: General conduct obligations (RG 205) is guidance, not a replacement for Section 47 of the NCCP Act. RG 205 describes compliance concepts, explains what ASIC considers when assessing compliance and provides questions to help licensees design and test their measures, while each licensee remains responsible for deciding how to comply.

Risk Management Systems and Internal Controls

As noted above, Section 47(1)(l) of the NCCP Act requires adequate risk management systems unless the licensee is regulated by the Australian Prudential Regulation Authority, assessed against the nature, scale and complexity of its credit activities under Section 47(2). RG 205 does not prescribe a particular risk management model, so recommended governance practices may add controls suited to the business but should not be presented as statutory requirements.

Risk assessments, compliance monitoring, conflicts management, complaints handling, internal controls and staff training can help a lender or mortgage broker manage its regulatory risks. In particular, the conflicts and training obligations in Section 47(1)(b) and (g) of the NCCP Act, discussed above, sit alongside the internal dispute resolution procedure required by Section 47(1)(h), which must cover disputes relating to the licensee’s credit activities or those of its representatives. Section 47(1)(j) of the NCCP Act also requires compensation arrangements in accordance with Section 48 of that statute, supporting consumer protection when a breach causes loss.

When Do AML/CTF Obligations Apply to Lenders and Mortgage Brokers?

The Designated Services Framework Under Section 6

AML/CTF obligations depend on the designated services a business provides under Section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act‘), rather than its ACL status. A business providing a designated service with a geographical link to Australia is a reporting entity.

The financial services designated services include making loans or providing finance, including hire-purchase. A lender’s AML/CTF framework should therefore reflect:

• the finance services it provides;
• its ML/TF risks;
• its customers; and
• its systems and operations.

Distinguishing Reporting Entities From Exempt Businesses

Lenders are generally reporting entities because of the loan and finance designated services discussed above. This applies to commercial lenders even where they do not hold an ACL. Reporting entities must enrol with Australian Transaction Reports and Analysis Centre (AUSTRAC) and meet applicable AML/CTF obligations.

Mortgage brokers arranging consumer home loans are generally not reporting entities because those activities do not usually involve providing a designated service. However, from 1 July 2026, a broker may provide a designated service when assisting with debt or equity financing for a company, trust or similar legal arrangement. The broker’s compliance framework should therefore assess:

• the services provided;
• the customer type; and
• the relevant financing activity.

What Should an AML/CTF Framework Include?

Risk Assessments and Customer Due Diligence

From 31 March 2026, an AML/CTF program must be matched to the business, its designated services and its risks. The program must include a written assessment of money laundering, terrorism financing and proliferation financing risks, together with policies that manage those risks.

The framework should also address:

• Customer due diligence (CDD): procedures for identifying and assessing customers.
• Transaction monitoring: controls for reviewing customer activity.
• Suspicious matter reporting (SMR): processes for identifying matters that may require reporting to AUSTRAC.

Governance Responsibilities and Oversight

The AML/CTF program must include a governance structure with a governing body overseeing the program, an AML/CTF compliance officer coordinating day-to-day compliance, and a senior manager approving the program. The governing body must oversee ML/TF risk, AML/CTF policies and compliance with the AML/CTF Act.

The governing body must receive reports from the AML/CTF compliance officer at least once every 12 months covering compliance and risk management.

Independent Evaluations of AML/CTF Programs

Under Section 26F(4)(f) of the AML/CTF Act, a reporting entity’s AML/CTF policies must provide for independent evaluations of its AML/CTF program at a frequency that is appropriate to the nature, size and complexity of its business and is at least once every three years.

The Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 (Cth) (‘AML/CTF Transitional Rules‘) set different deadlines for initial evaluations, depending on the entity’s enrolment status, prior review history and AUSTRAC account number.

How Should Businesses Maintain Their Compliance Frameworks?

Ongoing ACL Compliance Monitoring

An ACL holder must ensure representatives remain adequately trained and competent under Section 47(1)(g) of the NCCP Act, as discussed above. Ongoing monitoring should test whether the compliance framework continues to support the business’s credit activities, consumer protections and regulatory obligations.

Section 47(1)(k) of the NCCP Act requires the licensee to maintain adequate arrangements and systems to ensure compliance, together with a written compliance plan. Regular compliance monitoring, such as file reviews, representative audits and breach reporting reviews, is recommended practice for testing whether those arrangements remain adequate, rather than a separately prescribed statutory process.

Reviewing AML/CTF Risk Assessments and Policies

Under Section 26D of the AML/CTF Act, reporting entities must review their ML/TF risk assessments when specified changes occur and at least once every three years. Section 26F(3)(c)–(d) requires AML/CTF policies to address reviews and updates following changes to the risk assessment, other specified circumstances and periodic reviews at least once every three years. Rules 5-1 and 5-4 of the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 also require reviews or updates following relevant adverse independent evaluation findings. Under Section 26H(1), the governing body must exercise appropriate ongoing oversight of AML/CTF compliance and risk management.

Addressing Common Compliance Gaps

Common compliance gaps include:

• failing to understand the risk assessment;
• failing to review compliance officer reports; and
• failing to question the root cause of ongoing compliance breaches.

AUSTRAC guidance identifies these matters as indicators of inappropriate AML/CTF oversight.

Under Section 26H of the AML/CTF Act, the governing body must also take reasonable steps to ensure the business identifies, assesses, manages and mitigates ML/TF risks. Effective oversight includes questioning adverse findings, reviewing control effectiveness and monitoring progress on actions addressing non-compliance.

Conclusion

Australian lenders and mortgage brokers need governance, risk management and compliance frameworks matched to their credit activities, consumer protections and regulatory obligations. ACL requirements, AML/CTF duties, risk assessments, CDD, transaction monitoring, reporting and ongoing reviews help businesses manage regulatory risks and ensure compliance.

Businesses seeking support can contact AFSL House to develop and maintain frameworks suited to their activities, customers and regulatory requirements. AFSL House can assist with governance, risk and AML/CTF compliance support for lenders and mortgage brokers, helping businesses protect consumers, maintain appropriate policies and monitor compliance across the Australian financial services sector.

Frequently Asked Questions

Disclaimer: All information provided in this article is strictly general in nature and is not intended to be, nor should it be relied upon as, legal advice.