Who must comply with Independent review of AML/CTF program?

Reporting entities must have their whole AML/CTF program independently evaluated at least once every 3 years.

Under the reformed AML/CTF Act, the former independent review of a Part A program has been replaced by an independent evaluation of the whole AML/CTF program (ML/TF risk assessment and AML/CTF policies). It must happen at least once every 3 years, at a frequency set in your AML/CTF policies. The evaluator can be internal or external but must be independent — for example, not involved in developing the program — and there are no mandatory qualifications. The evaluation tests whether you appropriately identified, assessed, mitigated and managed your ML/TF risks and complied with your policies. For newly regulated Tranche 2 entities, the first evaluation is due between 30 June 2029 and 31 December 2030, depending on the last two digits of the AUSTRAC account number. Separately, AUSTRAC can require an external audit by written notice.

Applies when the business has an AML/CTF designated service. Where the business has aml adjacent, check whether you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).

How the regulator frames it: All AUSTRAC reporting entities.

What triggers it: Having an AML/CTF program in place.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (8 of 35: yes; 27 of 35: no).

Structure does not change the answer in the 8 industries it can reach: for every structure the answer is "yes".

Size does not change the answer in the 8 industries it can reach: at every size band the answer is "yes".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: applies. Tranche 2 industry (Real estate agents) — AML/CTF reporting entity from 1 July 2026.
• Pty Ltd company in fintech (non-bank) with 6–19 employees, turnover $1M–$3M: does not apply. Requires an AML/CTF designated service.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business holds an Australian financial services licence (AFSL): it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business issues financial products or gives financial product advice: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business holds an Australian credit licence (ACL): it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business provides credit to customers: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business deals in crypto-assets or runs a digital currency exchange: it then applies (digital currency exchange / virtual asset services — AML/CTF reporting entity).
• The business receives large physical cash payments: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).
• The business makes or receives international funds transfers: it becomes worth checking, because it applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3).

The engine shows this obligation as "check whether this applies" when a business has aml adjacent. It then applies only if you provide an AML/CTF designated service (AML/CTF Act s 6 tables 1–3). That fact is not something Rules Mate can infer from industry, structure or size.

When due

At least once every 3 years, at the frequency set in your AML/CTF policies. Newly regulated entities: first evaluation due 30 June 2029 – 31 December 2030 depending on AUSTRAC account number.

Frequency

Ongoing

Evidence to keep

Independent evaluation scope, evaluator independence record, evaluation report, governing body response, remediation tracker.

Status

Current

Priority

High

Maximum penalty: Civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention, under the general AML/CTF Act civil penalty regime.

Independent review. Authority: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ss26F(2), 26F(4)(f), 26H, 116 (compilation C62, in force 1 Jul 2026); AML/CTF Rules 2025 (F2025L01026) r5-10; AML/CTF Transitional Rules 2026 (F2026L00393) Part 7; AUSTRAC "Step 5: Conduct an independent evaluation" (last updated 31 Mar 2026).

Frequency: At least once every 3 years, at the frequency set in your AML/CTF policies (documented rationale). Transitional first-evaluation deadlines (30 Jun 2029 to 31 Dec 2030) depend on the last two digits of your AUSTRAC account number and on when you first provided the designated service.

Who can perform it: An evaluator who is independent: internal (for example internal audit) or external, but not your AML/CTF compliance officer or compliance team, and not anyone who developed the program or assessed your ML/TF risk. No mandatory qualifications. The evaluator reports in writing to your governing body and the senior manager who approves the program. Separately, AUSTRAC can require an external audit by an AUSTRAC-authorised auditor by written notice (ss161-162).

If this obligation applies to you, so do these 7: the engine uses the same rule for each.

• Enrol with AUSTRAC as a reporting entity
• Maintain a written AML/CTF program
• Customer due diligence (KYC) on every customer
• Suspicious matter, threshold, and IFTI reporting to AUSTRAC
• Designate an AML/CTF Compliance Officer
• Detect + enhance due diligence on Domestic + Foreign PEPs
• Lodge the AUSTRAC annual compliance report (AML/CTF Act s 47)

Across the 1,890 business profiles Rules Mate evaluates, these obligations apply to most of the businesses this one applies to, and are far more common among them than among businesses generally:

• Comply with Australian sanctions law + screening (DFAT): applies to 100% of the same businesses (4.4× the overall rate)

Rules Mate tracks 8 published obligations tagged "aml ctf", 6 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Australian Transaction Reports and Analysis Centre.

AUSTRAC: Anti-money laundering and counter-terrorism financing regulator and financial intelligence unit. Administers the AML/CTF Act, including Tranche 2 expansion from 1 July 2026.

• Australian Transaction Reports and Analysis Centre

AML/CTF Act: Federal AML/CTF regulation.

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006

Free tools that help with this obligation:

• AML Tranche 2 scope checker
• Beneficial owner identifier
• Compliance calendar builder