Eight compliance officers, on call

Works through AUSTRAC enrolment and reporting, designated services, Tranche 2 scope, customer due diligence, the AML/CTF program and its independent evaluation, and SMR, TTR and IFTI obligations.

• AML/CTF program scaffolds: ML/TF risk assessment and AML/CTF policies
• Customer due diligence and enhanced CDD procedures
• SMR, TTR and IFTI reporting walkthroughs
• Independent evaluation scopes

Covers the Australian Privacy Principles, the notifiable data breach scheme and its assessment clock, privacy policies and collection notices, overseas disclosure, automated decision-making transparency and the staged Privacy Act reforms.

• Privacy policies and collection notices
• Data breach response plans and assessment logs
• Privacy impact assessments
• Overseas disclosure and APP 8 accountability checks

Handles the primary duty of care, notifiable incident reporting to each state regulator, psychosocial hazard management, consultation duties, contractor and labour hire arrangements, and s 27 officer due diligence.

• Notifiable incident decisions and notification drafts
• Officer due diligence evidence packs
• Consultation and HSR arrangements
• Psychosocial risk assessments

Covers ASIC lodgements and annual review obligations, statutory registers, director identification and duties, board and members' meeting process, whistleblower policy obligations and continuous disclosure.

• Annual review and solvency resolution process
• Statutory registers and registered office duties
• Board and members' meeting papers
• Director duty and disclosure briefings

Covers GST registration and BAS, PAYG withholding, Single Touch Payroll, superannuation guarantee and Payday Super, FBT, taxable payments reporting, payroll tax across states and record-keeping duties.

• Lodgement calendars by obligation and entity
• Superannuation guarantee and Payday Super readiness
• TPAR, BAS and STP reporting scope
• Payroll tax grouping and contractor exposure

Covers the Security of Critical Infrastructure Act (asset register, risk management program, cyber incident reporting), ransomware payment reporting under the Cyber Security Act 2024, the security and breach limbs of the Privacy Act, APRA CPS 234 and the Essential Eight.

• Cyber incident notification matrices across every regulator clock
• SOCI risk management program structures and board attestation papers
• Ransomware payment report preparation checklists
• CPS 234 and Essential Eight self-assessment templates

Covers the Australian Consumer Law: misleading claims and greenwashing, consumer guarantees, unfair contract terms, product safety standards, injury reporting and recalls, and marketing consent under the Spam Act and the Do Not Call Register.

• Claims substantiation registers and greenwashing reviews
• Unfair contract terms review reports with suggested redrafts
• Consumer guarantee response scripts and refund policies
• Product safety, injury reporting and recall procedures

Covers AFS and credit licensee general obligations, reportable situations, design and distribution obligations and target market determinations, internal dispute resolution and AFCA, and APRA CPS 230 operational risk management.

• Breach registers and reportable situation assessments
• Target market determination frameworks and distribution matrices
• IDR policies and complaint response templates
• CPS 230 critical operations and service provider registers