When is my first AML/CTF independent evaluation due?

If you were providing your designated service before 1 July 2026: 30 June 2029 (both last digits odd), 31 December 2029 (second-last odd, last even), 30 June 2030 (both even) or 31 December 2030 (second-last even, last odd). Otherwise, within the frequency in your policies, at least every 3 years.

Does the evaluator have to be an external auditor?

No. The evaluator can be internal or external, but must be independent of the program. It cannot be your AML/CTF compliance officer.

AML/CTF independent evaluation due date by AUSTRAC account number

Enter the last two digits of your AUSTRAC account number (AAN) to see when your first independent evaluation is due under the Transitional Rules.

Short answer: 30 June 2029 to 31 December 2030

For a Tranche 2 business that was already providing its designated service before 1 July 2026, the first independent evaluation must be done before one of four dates set by the last two digits of its AUSTRAC account number (Transitional Rules s 17). After that, the program must be evaluated at least once every 3 years.

Look up your date

Last two digits of your AUSTRAC account number

Enter two digits to see your date. The digits stay in your browser.

Applies to Tranche 2 businesses already providing their designated service before 1 July 2026. A business that started later evaluates at the frequency in its own AML/CTF policies, at least once every 3 years.

The four dates

Second-last digit of AAN	Last digit of AAN	First evaluation due
Second-last digit odd	Last digit odd	Before 30 June 2029
Second-last digit odd	Last digit even	Before 31 December 2029
Second-last digit even	Last digit even	Before 30 June 2030
Second-last digit even	Last digit odd	Before 31 December 2030

Zero counts as an even digit.

Who gets a staggered date, and who does not

Covered: a Tranche 2 business that first provided its designated service before 1 July 2026 and provided no other kind of designated service.
Not covered: a business that first provides a designated service on or after 1 July 2026. It gets no AAN date and must evaluate at the frequency in its own policies, at least once every 3 years (s 26F(4)(f)).
Previously regulated reporting entities with a prior independent review: the later of 4 years after that review or 31 March 2027.

Who can do the evaluation

The evaluator can be internal or external, and no formal qualification is mandatory. AUSTRAC's guidance says the evaluator must be able to exercise independent judgement and must not have developed the program, assessed the ML/TF risk, or be responsible for running the program. That rules out the AML/CTF compliance officer. A sole practitioner therefore needs someone else to evaluate the program.

The evaluation covers how the risk assessment was done, whether the policies are designed to meet the Act and Rules, and testing of whether the business followed them. The written report goes to the governing body and the senior manager who approves the program (Rules r 5-10). Any program updates in response must be documented within 14 days, and reasons kept for any finding not acted on.

A typical report sets out the process, scope and method, findings on the risk assessment and the design of the policies, compliance findings, and the client files sampled and tests performed. An evaluator will usually ask for the approved program and its version history, approval records, the risk assessment and its method, customer due diligence files, the escalations register, training and personnel due diligence records, and the remediation log from any earlier review.

Separate from an AUSTRAC-ordered external audit

AUSTRAC can, by written notice, require a business to appoint an external auditor it authorises (ss 161, 162 and 164). That is a different, notice-driven process; the independent evaluation is the routine requirement.

Check your AML/CTF programUpload the AML/CTF program you already have and get a gap score against the Tranche 2 requirements of the Act and Rules. Personal information is removed before analysis.Run the compliance journeyAnswer a short questionnaire about your business and get the obligations that apply to you, with the reason each one applies.

Questions

When is my first AML/CTF independent evaluation due?: If you were providing your designated service before 1 July 2026: 30 June 2029 (both last digits odd), 31 December 2029 (second-last odd, last even), 30 June 2030 (both even) or 31 December 2030 (second-last even, last odd). Otherwise, within the frequency in your policies, at least every 3 years.
Does the evaluator have to be an external auditor?: No. The evaluator can be internal or external, but must be independent of the program. It cannot be your AML/CTF compliance officer.

Sources

Computed by the Rules Mate applicability engine from the published obligation corpus; facts last checked 3 October 2026. Rules Mate is not a law firm and this is general information, not legal advice. Confirm your position with the regulator source or a qualified adviser before acting.