AML/CTF independent evaluations: what AUSTRAC requires and how to prepare
Key points
• An independent evaluation
(i) evaluates how you undertook or reviewed your ML/TF risk assessment against the requirements in the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Act), the regulations and Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Rules),
(ii) evaluates the design of your AML/CTF policies against the Act, regulations and the Rules and
(iii) tests and evaluates whether you have appropriately identified, assessed, mitigated and managed your money laundering, terrorism financing and proliferation financing risks (collectively, your ML/TF Risks) and complied with your AML/CTF policies.
• It must happen at least once every three years, or more often if your business’s risk profile calls for it.
• The evaluator must be free of bias, influence and conflicts of interest.
• The report goes to senior management responsible for approving your AML/CTF Program and your governing body, and adverse findings must be acted on.
The March 2026 reforms to Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) regime replaced the familiar “independent review” with a broader independent evaluation. The emphasis has changed and evaluations now look more closely at whether your program works in practice, not only at what it says. Handled well, an evaluation is a valuable opportunity to test your program with fresh eyes. Here is what AUSTRAC requires and how to prepare.
What is an AML/CTF independent evaluation?
An AML/CTF independent evaluation is a periodic assessment, required under the Act and the Rules, that tests whether your ML/TF risk assessment and AML/CTF policies meet legal requirements and are working effectively.
It covers your ML/TF Risks, and sits alongside your own internal reviews rather than replacing them.
How often must an independent evaluation be done?
At least once every three years. Your AML/CTF policies must set the frequency, and it must suit the nature, size and complexity of your business, so higher-risk businesses should expect to evaluate more often.
Under the AUSTRAC Transitional Rules 2026, the timing for independent evaluations is staggered based on whether you are an existing reporting entity or newly regulated reporting entity (and in the case of the latter, the last two digits of your AUSTRAC account number). In our view, there is value in not waiting for the deadline: an early evaluation should help identify gaps before they potentially become a bigger problem.
Who can conduct an independent evaluation?
An evaluator must be both independent and suitable for your business: free from bias, influence and conflicts of interest, and with the expertise to assess your ML/TF risks. AUSTRAC expects your AML/CTF policies to set out how you will make this assessment, having regard to the nature, size and complexity of your business.
It is important that the evaluator is free from relationships and circumstances that could compromise their objectivity and professional judgement. We recommend that you make this decision and selection independent of other professional advisors’ recommendations. Examples of suitable independent evaluators include specialist law firms with expertise in AML/CTF and legislation who have the ability to exercise independent judgement and are external to your organisation.
What does an independent evaluation cover?
At a minimum the AML/CTF policies must require your independent evaluator to do all of the following:
1. evaluate how you undertook or reviewed your ML/TF risk assessment against the requirements in the Act, regulations and Rules;
2. evaluate the design of your policies against the requirements of the Act, regulations and Rules; and
3. test and evaluate whether you appropriately identified, assessed, mitigated and managed your ML/TF risk and complied with your policies.
For larger, more complex reporting entities, you may wish to conduct independent evaluations consistent with best practice assurance standards.
How should you prepare?
The evaluator needs to have access to documents, key personnel and systems to conduct the evaluation. For example, during the independent evaluation, your evaluator may request:
• documents about the development of your ML/TF risk assessment and AML/CTF policies;
• your ML/TF risk assessment;
• your AML/CTF program and policies;
• your transaction monitoring program;
• access to relevant staff members and senior managers for interviews;
• access to records, such as customer identification and transactions;
• the results of your own monitoring and reviews of your ML/TF risk assessment and AML/CTF policies;
• previous independent evaluation reports; and
• other documents relevant to the evaluation.
Failing to provide your evaluator with appropriate access is likely to impact the reliability and effectiveness of any evaluation. It may increase the risk that your AML/CTF program doesn’t meet your obligations and the risk of civil penalties.
What happens after the evaluation?
The evaluator must produce a written report. Your AML/CTF policies must require it to go to your governing body and any senior manager responsible for approving your AML/CTF program, as soon as reasonably practicable.
Adverse findings are common, and they are often manageable. If the report identifies issues with your ML/TF risk assessment, you must review it and, if required, update both the AML/CTF risk assessment and your AML/CTF policies. It is good practice to record what will change, who is responsible and by when. If issues persist, AUSTRAC expects further review until they are resolved.
Where do adverse findings usually arise?
When reviewing AML/CTF programs for wagering operators, clubs and pubs we sometimes see common themes, including the following:
• gaps in how the ML/TF risk assessment was undertaken or reviewed;
• insufficient detail on controls and risk variables;
• gaps between policy design and day-to-day practice; and
• high level or insufficient transaction monitoring.
In our view, businesses that regularly test their own processes, rather than relying on documentation alone, tend to find evaluations far more straightforward.
What should you do next?
• Check that your AML/CTF policies set out evaluation frequency, evaluator selection criteria, reporting lines and your response process.
• Confirm when your independent evaluation is due.
• Identify an evaluator who is genuinely independent and understands your sector.
• Ensure your records are in order and accessible.
Would your venue's AML/CTF program, and the advisor behind it, stand up to the kind of scrutiny these enforcement matters show?
Join Alexandra Hoskins for a free webinar: AML/CTF Compliance for Australian Gaming Venues: Conducting an Independent Evaluation and Selecting an Advisor.
With enforcement expanding across wagering, casinos and licensed venues, choosing the right advisor matters. Alex will share what to look for in an AML/CTF advisor, the questions to ask, and how to make sure your program holds up to regulatory scrutiny.
12pm AEDT Wednesday 14th October | Online
Register here.
About Senet
Senet is a multidisciplinary Australian firm specialising in gambling and gaming law, regulatory compliance, and business advisory services. We are the largest specialist team in Australia and based in Victoria. Recognised globally as experts in our field, we understand Australia’s complex gaming legal and regulatory landscape, enabling us to guide clients through their compliance requirements across each state and territory. Our clients range from start-ups to publicly listed global operators, both nationally and internationally. Our team is deeply immersed in the industry, often sharing insights at public speaking events, and our principals have held executive roles in a global ASX-listed entity and a 'Big Four' advisory firm, giving us a unique perspective on the challenges our clients face.
If you have any questions or would like to discuss the topics covered in this article, please contact the team at Senet.
