AML/CTF compliance officer and governance guide

Separate the three governance functions

The governing body oversees whether the business appropriately manages ML/TF/PF risk and complies with the program. A senior manager approves the risk assessment and AML/CTF policies and performs other required decisions. The AML/CTF compliance officer communicates with AUSTRAC, coordinates day-to-day compliance, supports effective operation of policies and reports to the governing body. Document these responsibilities separately so important decisions do not disappear between broad job descriptions.

In a small business, one person may perform more than one function where the legal requirements can be met. The file should still show which hat the person was wearing for each approval, review or escalation. Consider conflicts and self-review: a person who designs and operates every control needs credible challenge from another competent person where possible. Growth, absence or a complex high-risk matter may require deputies, external expertise or additional governing-body attention.

Appoint a fit, empowered compliance officer

AUSTRAC says the officer must be employed or engaged at management level, have sufficient authority, independence, resources and expertise, and be fit and proper. Where services are provided at or through an Australian permanent establishment, the residence requirements in current guidance must also be met. Assess qualifications, experience, integrity, conflicts, capacity and access to senior decision-makers. Reassess suitability periodically and when circumstances change.

The role needs direct access to customer, transaction, matter, screening, reporting and exception information. Give the officer authority to pause a designated service, require enhanced CDD, escalate an SMR decision, commission control testing and obtain resources. Budget, system access and protected time should be explicit. A nominal appointment of someone who cannot see activity or challenge revenue owners is unlikely to deliver effective compliance.

Control appointment, notification and absence

AUSTRAC's standard guidance describes appointment within 28 days of starting to provide designated services and notification to AUSTRAC within 14 days of appointment. Transitional arrangements affected newly regulated entities around 1 July 2026, including a later-of timing described by AUSTRAC. Because the relevant date can depend on enrolment and commencement facts, record the calculation, appointment instrument, acceptance, eligibility assessment and notification confirmation rather than relying on a generic calendar entry.

The business must maintain continuity of the compliance function. Nominate an appropriately capable deputy or documented cover process for leave, vacancy and conflicts. Specify who receives regulator communications, makes urgent customer or reporting decisions and informs the governing body. When the officer changes, repeat eligibility and conflict checks, transfer open issues securely, update AUSTRAC within the applicable time and retain evidence of both cessation and appointment.

Give the governing body decision-useful information

The compliance officer should report to the governing body at least once every 12 months, and material matters should be escalated sooner. A useful report covers changes in risk, customer and service exposure, CDD exceptions, overdue reviews, screening outcomes, monitoring and SMR governance, training, personnel due diligence, record keeping, independent evaluation, breaches, remediation and resource constraints. Protect sensitive reporting information and avoid unnecessary disclosure that could create tipping-off risk.

Governing-body minutes should show challenge and decisions, not merely receipt. Record questions, requested analysis, approved risk appetite, remediation deadlines, resources and follow-up. Senior-manager approvals of the risk assessment and policies should use current versions and list material changes. Dashboards need context: volumes and timeliness are useful, but they should be paired with quality sampling and themes so a high completion percentage does not conceal weak evidence.

Create an auditable governance calendar

A calendar is only a minimum. Event-driven escalation remains essential when a material risk or control issue emerges between meetings. Periodically trace a governance decision to implementation in customer files and systems. That confirms whether oversight changes behaviour rather than producing minutes alone.

• Issue role charters for the governing body, senior manager, compliance officer and deputy, including authority and escalation thresholds.
• Document appointment, fit-and-proper assessment, residence and management-level eligibility, conflicts and AUSTRAC notification evidence.
• Schedule risk and policy approvals, governing-body reporting, control attestations, training, evaluation and remediation reviews.
• Create immediate escalation paths for suspected reporting failures, sanctions concerns, serious control breakdowns and regulator contact.
• Maintain an obligations register showing owner, evidence, frequency, due date, status and governing-body visibility.
• Test absence cover and information access so the compliance function continues when a key person is unavailable.