Independent Evaluation of Your AML/CTF Program (AUSTRAC Rules Explained)

Key Takeaways

AUSTRAC states an independent evaluation of your AML/CTF program must occur at least once every 3 years.
The Transitional Rules 2026 provide staggered first-evaluation deadlines for newly regulated entities — not a single fixed date.
The evaluator must be sufficiently independent of the AML/CTF compliance function — they cannot be your compliance officer.
There are no mandatory qualifications, but AUSTRAC expects the evaluator to have knowledge of the AML/CTF obligations that apply to your business.
The evaluator must produce a written report; adverse findings must be actioned; updates to your program made in response must be documented within 14 days of the update.
Early first evaluations (well before the deadline) may benefit your business because suitable evaluators may be more readily available.

In this guide

What is an independent evaluation? How often must it occur? Staggered first-evaluation deadlines Who can do an independent evaluation What qualifications the evaluator needs How to prepare The written report and what to do with it Handling adverse findings

What is an independent evaluation?

AUSTRAC's independent evaluation guidance states: "Your AML/CTF policies must ensure that independent evaluations are conducted of your AML/CTF program."

The evaluation is in addition to your own ongoing reviews of the program. An independent evaluation tests whether your AML/CTF program appropriately identifies, assesses, manages and mitigates your ML/TF risks — and whether it's actually being implemented in practice, not just sitting in a drawer.

How often must an independent evaluation occur?

AUSTRAC states: "At a minimum, an independent evaluation must occur at least once every 3 years."

The specific frequency you set in your AML/CTF policies must be appropriate to the nature, size and complexity of your business. A multi-entity reporting group might evaluate more frequently than a solo conveyancer. AUSTRAC expects you to document the rationale for the frequency you've chosen.

Staggered first-evaluation deadlines under the Transitional Rules 2026

Key point for newly regulated entities

AUSTRAC's guidance states: "To help manage demand after 1 July 2026, the Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 provide staggered deadlines for conducting your first independent evaluation."

Translation: newly regulated Tranche 2 entities (real estate agents, conveyancers, property developers, buyers agents, jewellers and bullion dealers) don't all face the same "by X date" deadline. Instead, the Transitional Rules spread first evaluations over time to avoid a bottleneck.

AUSTRAC's guidance also notes: "Newly enrolled reporting entities may wish to consider conducting their first independent evaluation earlier, rather than waiting for the 3-year deadline." Earlier evaluations benefit your business because evaluators with appropriate skills may be more readily available.

Who can do an independent evaluation

AUSTRAC states the evaluator must be sufficiently independent. They can be either internal (for example, an internal audit function) or external (a consultant, auditor or reviewer), provided they are independent of the AML/CTF compliance function.

AUSTRAC expects that the evaluator:

Has the authority to exercise independent judgement
Is independent of the work areas being evaluated — for example, is not your AML/CTF compliance officer or a member of the compliance team
Can provide findings without conflict of interest

For small businesses, independence almost always means engaging an external evaluator. A solo practitioner can't evaluate themselves.

What qualifications the evaluator needs

AUSTRAC's guidance: "There are no mandatory qualifications for the person carrying out the independent evaluation. However, we expect your evaluator to have knowledge of the AML/CTF obligations that apply to your business."

In practice, this means the evaluator should understand:

The AML/CTF Act 2006 and relevant Rules
AUSTRAC guidance for your sector (e.g., the relevant Program Starter Kit)
How CDD, screening, SMRs, record-keeping and training obligations actually operate
How to test whether your controls are designed well and working in practice

AUSTRAC notes that if the evaluator lacks this knowledge, the findings may not be useful — which increases the risk your program doesn't meet the Act's requirements.

How to prepare for an independent evaluation

AUSTRAC expects you to make sure the evaluator has access to documents, key personnel and systems. During the evaluation, the evaluator may request:

Your AML/CTF program (current and previous versions)
ML/TF risk assessments
CDD records and sample files
Sanctions and PEP screening records
SMRs lodged and supporting material
Training records
Previous independent evaluation reports (if any)
Engagement letters or audit plans detailing the evaluation scope

A mature record-keeping system makes preparation trivial; an ad-hoc filing system makes it painful. This is one reason AUSTRAC's 7-year audit requirement exists.

The written report and what to do with it

AUSTRAC states: "Your AML/CTF policies must require any independent evaluator to produce a written report with their findings once they've completed their evaluation."

The report must be provided to:

Your governing body (board, partners, or principal)
Relevant senior managers

AUSTRAC expects these parties to receive the report as soon as reasonably practicable once it is prepared.

Handling adverse findings

If the report contains adverse findings about your ML/TF risk assessment or AML/CTF policies, AUSTRAC expects you to:

Review the findings
Update your risk assessment or policies in response, if required
Document how you've addressed the findings — including reasons if you choose not to update
Monitor the changes to confirm they've addressed the issues

14-day documentation rule

AUSTRAC states: "If you update your ML/TF risk assessment or AML/CTF policies following the independent evaluation, you must document these updates within 14 days after making the update."

You must also keep records reasonably necessary to demonstrate compliance with your independent evaluation obligations.

Frequently asked questions

How often must my AML/CTF program be independently evaluated?

AUSTRAC states an independent evaluation must occur at least once every 3 years. The specific frequency should be appropriate to the nature, size and complexity of your business.

When is my first independent evaluation due?

Newly regulated Tranche 2 entities have staggered first-evaluation deadlines under the Transitional Rules 2026. There is no single fixed date for all newly regulated entities. AUSTRAC encourages earlier first evaluations.

Can my compliance officer do the evaluation?

No. AUSTRAC expects the evaluator to be independent of the compliance function — they cannot be your AML/CTF compliance officer or a member of the compliance team.

Does the evaluator need a specific qualification?

AUSTRAC states there are no mandatory qualifications. However, AUSTRAC expects the evaluator to have knowledge of the AML/CTF obligations that apply to your business.

Can an internal auditor do the evaluation?

Yes, provided they are sufficiently independent of the AML/CTF compliance function and have the required knowledge. For small businesses, internal independence is rarely achievable — an external evaluator is typical.

What happens after the evaluation?

The evaluator produces a written report. You review findings, update your risk assessment or policies if needed, and document the updates within 14 days of making them. You must keep records to demonstrate compliance.

Disclaimer: This article provides general information sourced from AUSTRAC's published guidance and the AML/CTF Act 2006. It does not constitute legal advice. Confirm your specific obligations with AUSTRAC or a qualified legal adviser.