AML CTF Governance Roles and Responsibilities

Who can become an MLRO in Australia? The AML/CTF compliance officer must be at management level, resident in Australia and a fit and proper person. Under the amended Australian AML/CTF Act, the responsible officer and compliance officer can be the same person or different people. The right structure depends on the business and its risks.

It’s understandable to focus first on appointing someone suitable. Effective AML/CTF governance also requires clear accountability, sufficient authority and resources, and oversight that keeps the program aligned with the business’s risks.

This guide explains AML/CTF governance roles in Australia, eligibility requirements for the compliance officer, and how governing bodies and senior managers oversee a risk-based program. It also shows how responsibilities fit together, helping your organisation approach its AML/CTF obligations with greater clarity.

AML/CTF compliance officer responsibilities

In Australia, an AML/CTF compliance officer coordinates the program’s operational implementation and acts as the primary contact with AUSTRAC. The role must be at management level, with enough authority, information and resources to support effective compliance.

Officer appointments and AUSTRAC notifications

Appointing a compliance officer assigns a suitable person to coordinate AML/CTF compliance and respond to AUSTRAC. The responsible officer and compliance officer can be the same person or different people, but the compliance officer role cannot be outsourced.

The officer must be resident in Australia and a fit and proper person, with the competence, knowledge, diligence, judgement, character and integrity needed for the role. The business must document its eligibility assessment and reassess it regularly. If the officer leaves or becomes ineligible, appoint a replacement and notify AUSTRAC. A reporting entity must notify AUSTRAC of its officer within 28 days of providing a designated service; legal practices must notify appointments or changes within 14 days.

Practices providing at least one designated service must enrol with AUSTRAC from 31 March 2026. Australian legal practices must appoint an AML/CTF Compliance Officer by 1 July 2026 and be fully compliant by that date. These milestones make appointment, enrolment and notification distinct governance steps.

Program reviews and oversight

Program review means reassessing controls when relevant events affect the entity’s risks, rather than relying only on a fixed review cycle. Changes in customers, services, delivery methods or jurisdictions can alter the risk assessment and the controls needed to address those risks.

How often must Australian reporting entities review and update their AML/CTF program? The amended requirements trigger reviews in response to relevant events, rather than relying solely on a set cycle. The responsible officer must ensure the program is effectively designed, implemented and maintained for the entity’s specific risks.

What are the two parts of an Australian AML/CTF program and who oversees each? Under current rules, the board and senior management approve Part A and oversee compliance with it. The compliance officer coordinates the program’s operational implementation, while the governing body receives reports and maintains oversight.

The compliance officer must report to the governing body at least once every 12 months. They also coordinate program changes, which require senior management approval and notification to the governing body. For example, a change in customer risk may prompt a revised assessment, updated controls and documented approval.

What are the penalties for AML/CTF governance failures in Australia? No single penalty applies to every governance failure. Consequences depend on the obligation breached and the circumstances. AUSTRAC monitors compliance, so clear records of appointments, assessments, approvals and reporting help show how responsibilities were managed.

Governing body responsibilities

The governing body sets accountability for AML/CTF compliance and oversees how the business manages money laundering and terrorism financing risks. Clear AML CTF governance roles connect executive decisions to operational responsibilities, ensuring risks receive attention and controls have accountable owners.

Board and senior management duties

The board or governing body monitors compliance, oversees risk assessment and mitigation, and ensures resources are available for reporting obligations. This oversight matters because policies need leadership support and decisions need clear ownership.

Senior managers contribute to key AML/CTF decisions and cannot delegate their obligations. They approve AML/CTF policies and updates, as well as the ML/TF risk assessment and its updates. Keep records of who approved a change and how it addresses an identified risk. For example, a revised assessment should prompt a considered decision about relevant procedures, not just a document update.

Governance roles across business types

Governance roles establish who makes executive decisions, oversees compliance and handles operational work. In an Australian small business, one person may perform multiple or all governance roles, but each responsibility still needs clear ownership.

A company secretary or director should understand how the business’s services shape its exposure and AML/CTF procedures. Obligations arise from providing designated services, not from a job title alone. Even when a sole trader or micro-business combines responsibilities, it must identify relevant risks, maintain appropriate controls and document key decisions. A practical record can show who assessed a risk, approved a response and monitors its effectiveness.

MLRO independence and responsibilities

An MLRO, commonly referred to in Australia as an AML/CTF compliance officer, coordinates program oversight and suspicious matter reporting. Independence gives concerns a clear path to senior management or the governing body.

The officer needs appropriate authority, information and resources to raise issues without operational pressure obscuring them. In a larger organisation, separating the officer from direct involvement in operations or handling funds can support independent oversight. Governance professionals also need the knowledge to understand clients, recognise red flags, keep records, and know when and how to report suspicious activity.

Responsible officer duties

The responsible officer ensures the AML/CTF program is effectively designed, implemented and maintained for the reporting entity’s specific risks. Well-defined AML CTF governance roles distinguish this accountability from day-to-day program coordination.

The responsible officer may also be the compliance officer, or the roles may be separate. Document who owns each decision and how concerns reach the governing body. Staff training helps employees follow procedures, identify unusual conduct and escalate concerns through reporting channels. Build staff training and AML/CTF guidance into the framework so governance expectations carry through to everyday practice.

Risk-based AML/CTF program governance

A risk-based AML/CTF program connects governance decisions with the money laundering, terrorism financing and proliferation financing risks a reporting entity faces. The framework described in Australian AML/CTF guidance has 3 roles: the governing body, senior management and the compliance officer. AML CTF governance roles link risk assessment, control approval and oversight, so an identified exposure has a clear decision-maker and response.

The governing body oversees the program and risk assessment. Senior managers make key decisions and approve relevant AML/CTF policies and assessments. The compliance officer coordinates operational implementation. For example, a change in customer risk can prompt revised controls, approval by the responsible manager and oversight of how those controls operate.

Assess the entity’s activities rather than relying on a generic industry profile. Australian reporting entities must consider customer types, designated services, delivery methods and jurisdictions when assessing money laundering, terrorism financing and proliferation financing risks. If a practice serves customers across jurisdictions, consider how those locations affect exposure and whether procedures address it.

• Customers: consider the types of people and entities receiving services.
• Services: assess the designated services the business provides.
• Delivery: consider the methods used to provide those services.
• Jurisdictions: include relevant locations in the risk assessment.

These factors guide proportionate policies, procedures, systems and controls. Each control needs a purpose, an owner and a connection to an identified risk. If the assessment identifies exposure linked to a service or delivery method, governance can consider whether procedures need adjustment and how to monitor their effectiveness. This connection keeps the program aligned with the entity’s specific obligations.

Independent review provides a separate assessment of program effectiveness. Under Australia’s current AML/CTF rules, reporting entities must regularly commission a review by a suitably skilled and expert independent party. The review assesses the AML/CTF Program and compliance. Its findings can help governance identify weaknesses, assign corrective actions and oversee whether changes address the issues found.

Legal practices also have defined approval points. A Senior Manager must approve reliance arrangements with other entities in writing. Written approval is also required when deciding to terminate a retainer because AML/CTF risks fall outside the practice’s risk appetite. Recording the reasons and approval links the risk assessment to the business decision.

Use AML CTF governance roles to make risk decisions traceable: connect each assessed exposure to an owner, a control and oversight. When customers, services, delivery methods or jurisdictions change, reconsider whether the controls remain appropriate. This gives decision-makers a practical basis for maintaining a program that reflects the practice’s risks.

AML/CTF governance framework

An AML/CTF governance framework connects accountable decision-makers with the controls used to manage money laundering and terrorism financing risks. For Australian reporting entities, it should clarify who sets direction, who implements procedures and how the business responds when risks change.

Governance guidance describes three lines of defence that need appropriate resources. In practice, assign operational controls to the people closest to the work, provide oversight beyond daily activities, and maintain independent assurance. For example, staff may conduct client checks, managers monitor whether procedures work, and an independent reviewer assesses program effectiveness.

External arrangements need clear approval and accountability. Australian senior managers must approve the business entering a third-party agreement for customer due diligence. Before relying on another entity, document the arrangement, each party’s responsibilities and how the reporting entity will retain oversight. Using an external party does not remove the need to understand how due diligence supports the entity’s own AML/CTF obligations.

Group structures require the same clarity across related entities. Under Australia’s amended framework, a reporting group replaces the designated business group concept and can include related non-reporting entities. The lead entity assesses money laundering and terrorism financing risks across the group, develops a group-wide program, applies it to Australian members and ensures they comply.

A non-reporting entity in a reporting group may perform AML/CTF obligations for a reporting entity. However, the reporting entity on whose behalf it acts remains responsible for failures. Record which entity performs each task, how the lead entity monitors delivery and where concerns are escalated. This makes group-wide procedures easier to follow and gaps easier to identify.

International operations also need a defined escalation path. Australia’s AML/CTF Act requires reporting entities to notify AUSTRAC when host-country laws prevent an overseas branch or subsidiary from complying with Australian high-level principles, in line with FATF Recommendation 18. Governance should identify who assesses that conflict, who approves the response and who handles the AUSTRAC notification.

For a practical governance cycle, link each risk to an accountable owner, a control and a record of oversight. A change to a third-party due diligence arrangement, for example, should prompt a review of its approval, responsibilities and monitoring. If overseas laws constrain a group member, record the issue and use the designated escalation process. These steps help governing bodies see how decisions translate into operating controls across entities.

What are the responsibilities of the board and senior management for AML/CTF compliance in Australia?

In Australia, the board or governing body remains accountable for AML/CTF oversight. Senior managers make key decisions, approve required policies and assessments, and ensure the program receives appropriate attention. These responsibilities connect executive decisions with the controls used across the reporting entity.

Under the amended AML/CTF requirements, the governing body must oversee the program and take reasonable steps to ensure the entity effectively identifies and mitigates its risks. It does not need to approve changes to the risk assessment or oversee day-to-day operational measures. Instead, it should receive clear information about significant risks, control performance and issues requiring executive attention.

Senior managers have a more direct approval role. They must approve AML/CTF policies and updates, as well as the ML/TF risk assessment and updates. Australian businesses must appoint one or more senior managers already involved in substantial business decisions to contribute to key AML/CTF decisions. Section 26F(4) of the Australian AML/CTF Act requires a Senior Manager.

Approval duties also apply to specific customer and service decisions. Senior managers must approve starting designated services for certain foreign politically exposed persons and high-risk customers who are domestic or international organisation politically exposed persons. They must also approve starting or continuing a designated service in a nested services relationship. Retain a record of each decision’s approval and rationale.

Under current AML/CTF rules, the board and senior management must approve Part A of the AML/CTF Program and oversee compliance with it. The governing body must also ensure the business follows its AML/CTF policies and the Act and Rules. Senior managers cannot delegate their AML/CTF obligations, so assigning tasks to staff does not remove their responsibility for required decisions.

Practical oversight depends on useful reporting. For example, a compliance report can identify a material change in the risk assessment, explain which controls were affected and record the senior manager’s response. Keep evidence of approvals, updates and oversight so the business can demonstrate how its leaders met their obligations.

Make the framework usable by defining who prepares decisions, who approves them and what information reaches the board. Strengthen your AML/CTF governance processes with support for program management and compliance workflows.

Trancher: End-to-End AML/CTF Program Management

Trancher supports Australian businesses that need practical systems for managing AML/CTF obligations while retaining clear internal accountability. Its End-to-End AML/CTF Program Management brings program processes together, while Client Verification & Due Diligence (KYC/CDD + Screening) supports customer checks and Ongoing Risk Monitoring & Client Activity Tracking helps monitor changing risks.

When governance responsibilities are clear but operational processes need coordination, these capabilities help connect due diligence, monitoring and reporting. Trancher also supports Regulatory & Suspicious Matter Reporting, helping firms manage these activities alongside their AML/CTF program. The appointed compliance officer and governing body retain their respective responsibilities.

To discuss how Trancher could support your AML/CTF program, contact the team or visit trancher.global.

Make governance part of everyday operations

Clear AML/CTF governance roles are most effective when they shape routine decisions, not just formal policy documents. A useful next step is to identify where compliance processes can fit naturally into client onboarding, ongoing reviews and internal reporting. This helps teams apply the framework consistently as the business and its risk profile evolve.

Trancher’s End-to-End AML/CTF Program Management helps coordinate those processes. Client Verification & Due Diligence (KYC/CDD + Screening) supports client checks, while Ongoing Risk Monitoring & Client Activity Tracking helps maintain oversight as activity changes. These capabilities support your program; your appointed officers and governing body remain responsible for their roles.

Consider where clearer workflows or better-connected compliance activity would help your team put governance into practice. Contact Trancher to discuss AML/CTF governance and explore a practical next step for your organisation.

Frequently Asked Questions

Who can become a MLRO?

In Australia, the AML/CTF compliance officer must be a fit and proper person, at management level and resident in Australia. They need the competence, knowledge, diligence, expertise and sound judgement to oversee compliance, as well as good character and integrity. A materially impairing conflict of interest is not acceptable. The role may be held by the responsible officer, but the compliance officer function cannot be outsourced.

What are the AML/CTF governance requirements for Australian reporting entities?

Australian reporting entities need a documented AML/CTF program, a designated compliance officer, staff training and processes to identify and manage risks. Obligations arise from providing designated services, not simply from a job title. For example, map the business’s services first, then determine which customer checks, monitoring and reporting procedures its risk assessment requires. Governance records should show who makes decisions and how controls are maintained.

What are the roles and responsibilities of an AML/CTF compliance officer in Australia?

The compliance officer coordinates operational implementation of the AML/CTF program and serves as the primary contact with AUSTRAC. They should ensure regulatory inquiries and information requests receive prompt responses. For example, if AUSTRAC requests records, the officer coordinates a timely response and keeps the relevant material organised. The officer also oversees program changes, ensuring senior management approves them and the governing body is notified.

Who is eligible to be an AML/CTF compliance officer under Australian law?

An eligible officer must be resident in Australia, work at management level and meet fit-and-proper requirements. The business assesses the person’s competence, skills, knowledge, diligence, expertise, judgement, character and integrity, along with any materially impairing conflicts. Keep evidence of the assessment and reassess eligibility regularly. If the officer becomes ineligible or leaves, appoint a replacement and notify AUSTRAC.

What governance and oversight arrangements must an Australian AML/CTF program include?

The program needs clear accountability for decisions, operational controls, oversight and assurance. Its risk assessment should consider customer types, designated services, delivery methods and jurisdictions. For example, adding a new service should prompt consideration of whether existing customer checks and monitoring still address the entity’s exposure. Independent review also tests whether the program is effective and whether the reporting entity complies with its AML/CTF obligations.

How do AML/CTF governance responsibilities differ for small businesses and designated business groups in Australia?

A small business may have one person perform several or all governance roles, but each responsibility still needs an owner. The former designated business group concept has been replaced by reporting groups, which can include related non-reporting entities. A non-reporting entity may perform obligations for a reporting entity, but the reporting entity remains responsible for failures. The lead entity assesses group-wide risks, develops the program and ensures Australian members comply.