BANKING & LENDING · REFORMED OBLIGATIONS
AML/CTF compliance for banks, ADIs and non-bank lenders
You have been regulated since the beginning. The reforms changed the program structure, the CDD framework and the assurance cycle — and gave you a customer base where a very large number of businesses are now reporting entities themselves.
Already regulated? The regime still changed.
The reforms did not just add new sectors. From 31 March 2026 the program structure, customer due diligence framework and governance obligations changed for every existing reporting entity, and independent reviews of Part A became independent evaluations of the whole program. A program that was compliant in February needed rebuilding, not refreshing.
- 31 March 2026Reformed obligations begin
- 30 May 2026AML/CTF compliance officer notified to AUSTRAC
- 1 July 2026Transitional CDD policies had to be documented
- 31 March 2027Earliest first independent evaluation for existing entities
- 31 March 2029IFTI reporting transitions to IVTS; ACIP transitional period ends
Are you captured?
Nothing about capture is in question here. The work is in the transition: rebuilding a mature program against a reformed framework without losing control of risk while you do it, and adapting to a customer base that changed shape overnight.
Likely captured
- Deposit-taking and account services
- Lending, including mortgage and asset finance
- Issuing and managing payment instruments
- Foreign exchange and international transfers
- Custodial and securities services
- Correspondent banking relationships
Generally outside scope
- General financial education and market commentary
- Merchant referrals with no designated service
- Services provided entirely offshore with no Australian nexus
Capture depends on the designated services you provide — not on your profession, your licence or your job title.
What you need in place
Enrol and register with AUSTRAC
Every reporting entity has to be on the register. Enrolment is the entry point for everything else, including how your evaluation timing is set.
Appoint an AML/CTF compliance officer
A named person with the authority, seniority and time to run the program — and AUSTRAC has to be notified of the appointment.
Write an ML/TF risk assessment
Covering your customers, the designated services you provide, your delivery channels and the jurisdictions you deal with, with the reasoning visible.
Document your AML/CTF policies
Policies, procedures, systems and controls that follow from the risk assessment, approved by a senior manager rather than filed unread.
Run initial customer due diligence
Identify and verify your customer before you provide the designated service, at a depth that matches the risk you have assessed.
Screen for sanctions, PEPs and adverse media
Screening at onboarding and again over the life of the relationship, with the result recorded either way.
Trace beneficial ownership
Where the customer is a company, trust or other arrangement, identify who ultimately owns or controls it — and show how you got there.
Keep ongoing customer due diligence running
Monitoring is not an onboarding task. Relationships have to be reviewed and re-screened as risk and circumstances change.
Report suspicious matters
Submit suspicious matter reports within the required timeframes, plus threshold transaction reports where they apply to you.
Keep records
Generally seven years, with the retention clock starting at different points depending on the record type.
Train your people
Risk-appropriate AML/CTF training for staff, refreshed over time and delivered to new starters as they join.
Have the program independently evaluated
An independent evaluation of the whole program on the cycle your policies set, with findings tracked to closure.
Rebuild the program against the reformed structure
The program is now a documented ML/TF risk assessment plus AML/CTF policies, with defined governing body and senior manager roles. A pre-reform Part A and Part B split does not map across cleanly.
Time your first independent evaluation correctly
If you were enrolled on 30 March 2026 and have had at least one Part A independent review, your first evaluation must be conducted before the later of four years after that review and 31 March 2027.
Reassess risk across a changed customer base
A very large number of your business customers became reporting entities in 2026. Their AML maturity is now part of your risk picture.
See the evidence, not just the promise.
How True Comply helps
White-label KYC and screening
Verification, screening and UBO tracing you can put your own brand on, quoted to your volume.
Due diligence on newly regulated business customers
Understand whether a business customer has actually met its own obligations.
Correspondent and third-party assessment
Structured evidence for the relationships that attract the most scrutiny.
Evidence built for evaluation
Every decision captured with its reasoning, so the assurance cycle is an administrative exercise.
Program support through the transition
Practical help mapping a pre-reform program onto the reformed structure.
Enterprise deployment
Tailored to volume, with the integration and support that implies.
Free to start. $1 per person per month for ongoing monitoring.
Start with your first checks at no cost, then keep your whole client book monitored for a dollar a person a month.
Questions, answered.
Related insights
- Assurance
Your first independent evaluation: what AUSTRAC actually expects
6 min read
- Industry
The missing reporting entities: who hasn't enrolled, and why
5 min read
- How to
Beneficial ownership: finding who is really behind a company
5 min read
- Getting compliant
Have you already hit 'set and forget' on your AML program?
5 min read
Compliance you can prove.
Tell us where you're at and we'll help you work out what applies to your business.
No jargon, no obligation.