Australian AML/CTF Compliance Checklist

Part 2

How to Use This Checklist

Start with scope. If the wrong services are mapped, the rest of the program may be aimed at the wrong work.

For each item, ask to see the evidence. A policy may say that a task is done. A file, report or system record should show that it was done.

1. Step 1

   Mark what is complete

   Tick an item only when the control is in use and evidence can be found.

2. Step 2

   Name the gap

   For each unticked item, write down what is missing, who owns it and when it will be fixed.

3. Step 3

   Check the highest risks first

   Work that could lead to missed CDD, missed reports or unmanaged high-risk customers should be dealt with first.

Part 3

Evidence That Should Be Easy to Find

A clear evidence set makes internal checks, an independent evaluation and an AUSTRAC request easier to manage.

• The current risk assessment, AML/CTF policies and approval records.
• A list of designated services and the facts used to confirm scope.
• Compliance officer, governing body and senior manager records.
• Customer files, risk ratings, monitoring alerts and decision notes.
• Suspicious matter escalation records and filing receipts.
• Training, personnel due diligence and attendance records.
• Program reviews, independent evaluation reports and action logs.
• A record-retention schedule and proof that access is restricted.

Part 4

Key Timing Rules

Some duties must be met before a service starts. Others run for as long as the business is regulated.

1. Step 1

   Before a designated service starts

   A current risk assessment and approved AML/CTF policies should be in place. Initial CDD should be completed unless a lawful delay applies.

2. Step 2

   When enrolment details change

   AUSTRAC must usually be told within 14 days. New reporting entities must apply to enrol within the time set by the Act.

3. Step 3

   When the business changes

   The risk assessment and policies should be reviewed before a planned change, or as soon as possible after an unplanned change.

4. Step 4

   At least every three years

   The full risk assessment and policies must be reviewed. An independent evaluation must also be completed at least this often.

Part 5

Common Mistakes

• A generic program is adopted without being matched to the business.
• Scope is decided from the industry name instead of the service.
• A risk rating is recorded without reasons or source material.
• CDD is completed at onboarding but ongoing CDD is missed.
• Staff are trained once and no check is made that the process is understood.
• Suspicious activity is discussed too widely inside the business.
• Updates are made in practice but the written program is left unchanged.
• An independent evaluation is treated as a document review only.