Under Australia’s reformed AML/CTF regime, your entire AML/CTF program, meaning your risk assessment and your AML/CTF policies, must be independently evaluated at least once every three years, at a frequency your policies set. For newly regulated Tranche 2 businesses, the first independent evaluation is due between 30 June 2029 and 31 December 2030, depending on the last two digits of your AUSTRAC account number

This guide explains what an independent evaluation is, how to work out your first deadline, who can carry it out, what happens with the report and how a small firm can prepare. It is general information, not legal advice.

What an independent evaluation is

The reforms replaced the old independent review of Part A of an AML/CTF program with an independent evaluation of the whole program. AUSTRAC is clear that it sits alongside, not instead of, your own reviews. You must still review your risk assessment and your AML/CTF policies at least once every three years, and sooner in some circumstances.

Your AML/CTF policies must set out how often independent evaluations happen and how they are conducted. At a minimum, AUSTRAC says an evaluation must occur at least once every three years.

When your first evaluation is due

AUSTRAC’s guidance on the AML/CTF Transitional Rules 2026 sets staggered first deadlines for newly regulated businesses, based on your AUSTRAC account number (AAN):

AUSTRAC suggests newly enrolled businesses may wish to carry out their first evaluation earlier rather than waiting for the deadline, so that major issues are found and fixed sooner and while suitable evaluators may be easier to find. Update your AML/CTF program so that your evaluation schedule matches your deadline.

Who can carry out the evaluation

AUSTRAC says an evaluator can be internal, such as a member of an internal audit team, or external to your organisation, as long as they are sufficiently independent. It expects the evaluator to be empowered to conduct the evaluation as they see fit, and gives the example that the evaluator should not be your AML/CTF compliance officer or a member of the compliance team.

For most small firms, that points to an external evaluator. In a two-person practice where one principal designed the program and the other runs it, neither is likely to be independent of it. Whoever you choose, record why you consider them independent and suitably skilled.

GETTING READY FOR AN INDEPENDENT EVALUATION

Preparation starts long before the evaluator arrives.

Figure 1. Illustrative preparation timeline for a small firm’s first independent evaluation.

What the evaluator will need

AUSTRAC expects you to give the evaluator access to documents, key personnel and systems. For a small firm, that usually means having these ready:

• your current ML/TF risk assessment and records of your own reviews
• your AML/CTF policies and any updates, with approval records
• a sample of customer due diligence files, including screening results and decisions
• your suspicious matter and threshold transaction reporting records, held securely
• personnel due diligence and training records
• any previous independent evaluation reports

What happens with the report

AUSTRAC says your AML/CTF policies must require the evaluator to produce a written report of their findings, and that the report must be given to both your governing body and any senior manager responsible for approving your AML/CTF program, as soon as reasonably practicable.

If the report contains adverse findings about your risk assessment or policies, AUSTRAC’s guidance says you must review them as soon as practicable after the governing body receives the report, and update them where needed. Keep the report, your response and a record of what you changed.

How to prepare now

• Note your deadline today. Check your AAN and diarise the due date.
• Keep your files evaluation-ready. Clear records of screening decisions and risk ratings make sample testing faster.
• Do your own reviews on time. An evaluator will look at whether you have reviewed your program as your policies require.
• Fix known gaps early. Issues you have already identified and remedied are better than ones the evaluator finds first.
• Budget for it. An external evaluation is a cost to plan for, not a surprise.

Frequently asked questions

How often is an AML/CTF independent evaluation required?

At least once every three years, at a frequency set in your AML/CTF policies that suits the nature, size and complexity of your business.

When is my first independent evaluation due?

For newly regulated businesses, between 30 June 2029 and 31 December 2030, depending on the last two digits of your AUSTRAC account number.

Can my compliance officer do the evaluation?

No. AUSTRAC gives the example that the evaluator should not be your AML/CTF compliance officer or a member of the compliance team.

Does the report go to AUSTRAC?

AUSTRAC’s guidance requires the report to go to your governing body and the senior manager responsible for approving your program. Keep it, and your response, with your AML/CTF records.

Is an independent evaluation the same as my own program review?

No. Your own review of your risk assessment and policies is a separate obligation that also applies at least every three years.

How NameScan can help

An evaluator will often sample customer files to see how screening was done and how potential matches were resolved. NameScan lets small firms run PEP, sanctions and adverse media checks on a pay-as-you-go basis and record a decision and risk level on each result, so the screening part of every file is ready for review.

Keep every client file evaluation-ready

Screen clients and record each decision, so your evidence is in place when the evaluator asks.