‘Now is the time to act’: AUSTRAC flags AML/CTF implementation changes

Updates have been made to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) for businesses currently regulated under the Act, which will require thorough and detailed implementation plans.

The changes will come into play from 31 March 2026 and set AUSTRAC’s expectations for current regulated businesses in progressing towards implementing these changes and meeting their obligations.

In terms of changes, the AML/CTF regulator acknowledged the changes of implementation for some existing regulated businesses and their reporting groups would have a significant impact and require substantial changes to their systems over time.

AUSTRAC noted it used financial intelligence and regulation to detect, deter and disrupt money laundering, terrorism financing and other serious crime.

Based on this, AUSTRAC said it expected all existing regulated businesses to have completed an effective risk assessment to understand how this broader consideration of money laundering and terrorism financing (ML/TF) risk was relevant in their own business.

“If your systems and controls are not effective in managing ML/TF risks, or you are ignoring your obligations, you will continue to face regulatory action,” AUSTRAC warned.

“This could include AUSTRAC commencing civil penalty proceedings or cancelling or suspending the registration of regulated businesses with unacceptably high ML/TF risks. Failing to manage your risks is a serious regulatory concern now and will be a serious concern after 31 March 2026. Now is the time to act.”

It was heavily emphasised that all regulated businesses must:

• Have and implement an AML/CTF program focused on the core principles of identifying, managing and mitigating ML/TF risks they reasonably face.
• Exercise due care and diligence to meet the core elements of their obligations, including reporting suspicious matters and transactions to us in a timely manner.

“An implementation plan provides regulated businesses with clarity about how they will continue to manage ML/TF risks, while they make necessary changes to systems, policies and processes leading up to and after 31 March 2026. It does not excuse regulated businesses who have, or are currently, failing to meet their AML/CTF obligations.”

With these changes, under section 212 of the AML/CTF Act, the AUSTRAC CEO is required to consider relevant matters, which include whether a regulated business had a reasonable implementation plan, made a sustained effort and reasonable progress against the implementation plan and exercised due care and diligence to manage their ML/TF risks while working towards meeting new or changed obligations.

Regulated businesses, unless requested, would not be required to provide AUSTRAC with a copy of their implementation plan, yet must be prepared to discuss progress made against this plan during engagements.

“This engagement will inform our regulatory activities and our understanding of the progress of implementation of the reforms across the regulated business population,” AUSTRAC said.

“This engagement will also assist us to identify where regulated businesses may be exposing themselves or the community to risk by not meeting the requirements under the plan or not adequately managing their ML/TF risk during the transition period.”

“Risk remains at the centre of Australia’s AML/CTF regime. We expect you to maintain your focus on identifying, mitigating and managing your ML/TF risks as you work towards meeting your obligations. If you fail to identify, mitigate and manage your ML/TF risks or fail to meet the above expectations, you risk regulatory action by AUSTRAC.”