Describe who actually does each task
Map information collection, verification, risk assessment, investigation, reporting and record storage separately. Record who makes the decision, which system holds the evidence and whether work is performed under the practice's instructions or another entity's own procedures. One supplier can support more than one arrangement. A hosted application used by your staff is not automatically the same thing as outsourcing the decision to a separate service team.
Select the correct legal and operational assessment
AUSTRAC's outsourcing guidance expressly separates outsourcing from RegTech use and third-party customer-identification reliance. For an outsourced function, assess capability, relevant risks and oversight. For reliance, examine the particular legal conditions and information-access requirements. Do not infer either arrangement from receiving a completed form. Set out which steps the practice still performs, including any customer-risk, enhanced-CDD or monitoring work that the supplier's delivery does not resolve.
Write an agreement that can be tested
A useful operational schedule names the functions, expected records, response times, restrictions, escalation contacts and process for handling errors. Include what happens if records cannot be retrieved, the supplier changes subcontractors or the arrangement ends. Match access and privacy controls to the actual information shared. Test a sample evidence request before depending on the arrangement; a promise of audit readiness is less useful than proof the right record can be obtained.
Review delivery against your own risk profile
For example, a supplier may support straightforward individuals but struggle with layered trust structures used by your practice. Check the relevant cases rather than assuming a high overall completion rate covers them. Track missing information, incorrect decisions, delayed records and unresolved findings. Assign remediation and follow it through. Keep the arrangement and review conclusions in the program's governance records, with approval of changes where the applicable requirements call for it.
Official sources
Use these primary sources to confirm the current rules and apply them to your circumstances.
Sources checked .
Frequently asked questions
Does using software transfer legal responsibility?
No. Understand the service and decisions it supports, and maintain the controls and responsibilities that apply to your reporting entity.
Is a shared identity report automatically lawful reliance?
No. Assess the applicable reliance conditions, provider suitability and access to relevant KYC and verification information.
Can one supplier cover every customer type?
Only if its actual capability and your arrangements support those cases. Review limitations instead of assuming a standard report resolves every structure.
Put it into practice
Cassandra AML turns these obligations into a working system: designated-service decisions, customer due diligence, screening, monitoring and reporting records — hosted in Sydney, free to start.
This guide is general information for Australian professionals. It is not legal advice and does not replace the AML/CTF Act, the AML/CTF Rules or AUSTRAC guidance. Confirm your specific obligations with AUSTRAC or a qualified legal adviser. See our editorial and correction standards.