How to assess AML program independent review requirements

An independent review is useful only if it tests how an AML/CTF program works in practice, not just what the documents say. In Australia, reporting entities must conduct an independent evaluation at least once every three years. AML program independent review requirements also call for a review schedule suited to the business’s nature, size, complexity and ML/TF risks.

It’s understandable to want a clear checklist, particularly when the review must be independent and its findings need to prompt action. Focus on whether the risk assessment is sound, the policies are appropriately designed, staff follow procedures and controls work as intended. The evaluation should result in a written report of findings for the governing body and relevant senior managers.

This guide explains how to set a proportionate review schedule, define the scope, test implementation and document findings. It also explains what independence means when selecting an evaluator, so you can use the review to strengthen your compliance systems.

What does an independent review involve?

1. Under Australia’s AML/CTF Act and Rules, reporting entities must provide for independent evaluations of their AML/CTF programs. Section 26F(4)(f) requires those provisions in AML/CTF policies. The schedule must suit the business’s nature, size, complexity and ML/TF risks.
2. Australian reporting entities with a standard AML/CTF Program must have Part A independently reviewed under Part 8.6 of the AML/CTF Rules. Some financial advice providers that are purely an Item 54 Provider only need a Special AML/CTF Program and do not strictly require an independent review.
3. Conduct an independent evaluation at least once every three years. The AML/CTF Rules do not prescribe a particular frequency, so set a risk-based schedule that meets this minimum and reflects your organisation’s circumstances. AUSTRAC guidance indicates that higher-risk entities should have reviews at least every two to three years.
4. Account for the 2024 AML/CTF reforms when planning your review. From 31 March 2026, reporting entities must conduct an independent evaluation under section 26F of the AML/CTF Act and the AML/CTF Rules 2025. Section 26F(4)(f)(i) requires evaluation schedules to suit each business’s nature, size and complexity.
5. Document why the review interval suits your risk assessment. Consider your designated services, customer types, delivery channels and exposure to money laundering and terrorism financing. A business with higher or changing risks may need a shorter interval. Record the reasoning in your policies and procedures.
6. Revisit the schedule when your risk profile changes, rather than waiting for the next planned date. A new service, a shift in customer mix or a change to delivery channels can affect ML/TF exposure. Compare these changes with monitoring results and the latest risk assessment, then decide whether an earlier evaluation is appropriate.
7. Create a practical review calendar that assigns responsibility for scheduling, gathering evidence and following up. Include the next due date, program areas in scope and the senior manager coordinating access to records. This makes AML program independent review requirements easier to manage as an ongoing process.

Evaluation scope across risk assessment, policy compliance and effectiveness

Use the evaluation to test both documented controls and how they operate in practice. The AML/CTF Rules specify assessment areas, while risk-based timing and third-party oversight provide important context.

1. Assess how the organisation conducts or reviews its ML/TF risk assessment. Rule 5-10(2)(a) requires the independent evaluation to assess the steps taken. Check whether the assessment reflects the organisation’s services, customers and exposure to money laundering and terrorism financing, and whether its conclusions inform practical controls.
2. Test policy design against the organisation’s identified risks. Under Rule 5-10(2)(b), the evaluation assesses whether AML/CTF policies are designed to meet the Act and Rules. Compare the written policies with procedures staff use, including customer due diligence, escalation pathways and transaction monitoring.
3. Check whether staff and managers follow those policies. Rule 5-10(2)(c) requires testing compliance with policies and procedures. Use practical samples, such as customer files or transaction alerts, to trace decisions from initial identification through escalation. Record exceptions and identify whether they point to a training, process or control gap.
4. Evaluate whether controls work against real ML/TF exposure. Rule 5-10(2)(d) requires assessment of whether the organisation effectively identifies, assesses, manages and mitigates risks in practice. Compare monitoring outputs with risk ratings and follow a sample of alerts to see whether decisions and actions align with the documented process.
5. AUSTRAC indicates that higher-risk entities should plan independent reviews at least every two to three years. Lower-risk entities may use a different schedule if monitoring and internal reviews provide evidence of ongoing oversight. One proposed approach is annual internal reviews of risk assessment and general compliance, with internal quality assurance every three years.
6. A lower-risk entity might consider extending its independent review to every five to six years only if sufficient monitoring and review take place in between. Treat this as a proposed approach, not a substitute for assessing your own risk profile. Revisit the timing if services, customers or controls change, and document why the schedule remains suitable.
7. Include third parties that perform AML/CTF program activities in the evaluation. Check for written contracts, a risk assessment, due diligence and ongoing monitoring. For example, trace a delegated customer-checking activity from the contract through the supplier’s work and your organisation’s oversight. Connected compliance workflows can help make those responsibilities easier to manage; explore integrated AML/CTF workflows.

Written evaluation reports

Australian AML/CTF Rules require a written report containing the evaluation’s findings; keep an accessible copy with program records. Rule 5-10(2)(f) requires delivery to the governing body and any senior manager who approves the program.

When deficiencies emerge, assign actions such as updating policies, providing training or implementing controls, then track completion and outcomes.

1. Document the evaluation findings

   Prepare a report that clearly records findings, supporting evidence and recommendations. Rule 5-10(2)(e) of Australia’s AML/CTF Rules requires the independent evaluation to produce a written report containing its findings. Link each conclusion to the process tested, such as a sampled transaction, customer file or reporting control. Separate observed evidence from recommendations, so decision-makers can see what needs correction.

   Keep the final report accessible with the entity’s AML/CTF program records. Organise supporting material so the evaluator’s samples, test results and conclusions can be followed later. For example, identify the transaction-monitoring control tested and the evidence supporting any identified gap.

2. Report results to senior leaders

   Deliver the final report to the governing body and any senior manager who approves the AML/CTF program. Rule 5-10(2)(f) of Australia’s AML/CTF Rules sets out this distribution requirement. Present the most material findings first, then explain their implications for the reporting entity’s ML/TF risks and AML/CTF obligations.

   Make the discussion actionable. For each finding, identify the affected process, recommended response and person responsible for follow-up. The governing body needs enough detail to understand whether a weakness affects customer checks, transaction monitoring or reporting controls. Record decisions and assigned actions alongside the report.

3. Address identified deficiencies

   Translate each deficiency into a documented corrective action, an accountable role and a way to assess completion. Rule 5-10(3) of Australia’s AML/CTF Rules requires AML/CTF policies to specify how the organisation will respond to independent evaluation report findings. Possible responses include updating policies and procedures, adding staff training or implementing new controls.

   For adverse findings about the risk assessment, the entity must review it as soon as practicable after the governing body receives the report, then update it as soon as practicable after completing that review. If a finding concerns policy design, address the relevant policy and document the change. Track each action to completion, retaining evidence of the response and whether it resolved the weakness.

Should you use an external person to conduct your AML/CTF review / evaluation?

An external evaluator can bring separation from day-to-day compliance work, but independence is the key test. Define the scope first, then select someone able to exercise independent judgement.

1. Define the review scope and purpose

   Set out which program parts the evaluation will cover and what it must assess. An AML/CTF independent review may cover Part A alone or both Part A and Part B, which focuses on customer identification and verification. For a standard program, address the purpose in rule 8.6.5 and test whether the program meets the entity’s obligations in practice.

   The evaluator must be separate from assessing the entity’s money laundering and terrorism financing risks. Their role is to evaluate the entity’s processes and controls, not to own or conduct its risk assessment. Arrange access to relevant policies, procedures, records and staff so the review can test implementation and support evidence-based findings.

2. Consider penalties for review failures

   Treat a missed evaluation or unaddressed finding as a compliance issue that needs prompt attention. The applicable consequence depends on the circumstances and the nature of the failure, so a single fixed penalty does not apply to every reporting entity. Focus on meeting your obligations: schedule the evaluation, document findings and follow through on corrective action.

   For adverse findings about the risk assessment, the entity must review it as soon as practicable after the governing body receives the report, then update it as soon as practicable after completing that review. If findings concern policies, address the relevant policy and record the action taken. Assigning an owner and keeping follow-up records helps demonstrate the entity’s response.

3. Choose for independence and judgement. Australian law does not require the evaluator to hold specific qualifications. An internal employee, such as an internal audit team member, may conduct the evaluation if they meet the independence requirements. Consider their sector knowledge, ability to assess evidence objectively and authority to conduct the work as they see fit.
4. Check for conflicts before appointment. The evaluator should not be involved in assessing the entity’s ML/TF risks. Review their responsibilities, reporting lines and involvement in designing or operating the controls under review. If the proposed evaluator helped develop a procedure, assign that part of the evaluation to someone suitably independent.
5. Preserve the evaluator’s independence during fieldwork. Provide access to relevant records and staff without directing conclusions or narrowing testing to avoid uncomfortable findings. If transaction-monitoring controls are in scope, for example, the evaluator should be able to select samples and report results independently. This supports a credible assessment of CTF compliance.

Independent review of AML/CTF programs

Prepare for the review as a structured test of the program, not simply a document check. Keep the evaluator’s independent assessment separate from ongoing compliance work, then agree what evidence will show how controls operate.

1. Map the program parts and purpose. Identify whether the review covers Part A alone or both Part A and Part B. Part B focuses on customer identification and verification, including due diligence processes. For a standard AML/CTF Program, address the purpose stated in rule 8.6.5. List the policies, procedures and activities in scope, then connect each to the relevant money laundering and terrorism financing risks.
2. Keep evaluation distinct from risk ownership. The evaluator should assess how the reporting entity conducts or reviews its risk assessment, not take part in assessing the entity’s ML/TF risks. This distinction matters when an internal audit employee conducts the review. For example, someone who owns customer risk decisions should not evaluate those same decisions without clear separation of responsibilities.
3. Choose an evaluator who can work independently. Australian law does not require a person conducting an AML/CTF program review to hold particular qualifications. An internal employee may conduct it if they meet the independence requirements. Consider sector knowledge, access to evidence and authority to exercise independent judgement. AUSTRAC’s guidance on evaluator suitability refers to section 26F of the Act.
4. Prepare evidence that shows controls in operation. Gather current policies, procedures, risk assessment records, due diligence files, monitoring outputs and reporting records. Agree how the evaluator will test implementation, including how transaction or customer samples will be selected. A file sample, for example, can show whether a customer’s risk rating, verification evidence and follow-up actions align with documented procedures.
5. Set boundaries without restricting findings. Confirm access to relevant staff, systems and records, and identify the right contact for each process. The evaluator must be able to conduct the evaluation as they see fit and exercise independent judgement. Don’t limit testing to a particular control or ask the reviewer to avoid adverse conclusions. This protects the integrity of the final assessment.

Prepare your evidence and review scope with a structured AML/CTF review preparation approach.

Reviews are recommended every 2-3 years; Australian Anti-Money Laundering Rules require regular Part A review, described as every one to three years depending on business risk profile. The independent review period is normally 12 months.

Trancher: End-to-End AML/CTF Program Management

Trancher provides an end-to-end AML/CTF compliance solution for small and medium-size accounting firms, bringing program management, workflows, guidance, training and expert support together. Use it to connect client checks, risk monitoring, reporting and supporting records within your compliance processes.

The platform supports client verification and due diligence, including KYC screening, as well as ongoing risk monitoring and client activity tracking. Its reporting workflows support regulatory and suspicious matter reporting. These features help organise compliance activity, while the reporting entity remains responsible for its program and independent evaluation.

To discuss how Trancher can support your AML/CTF program, contact the team or visit trancher.global.

Make review readiness part of everyday compliance

Treat review readiness as an ongoing habit, not a task that begins when you appoint an evaluator. Assign responsibility for organising evidence, recording control changes and tracking corrective actions to completion. This helps AML program independent review requirements inform day-to-day decisions instead of sitting apart from how your organisation manages compliance.

In your next planning cycle, identify where responsibilities or records need clearer ownership. A consistent approach can help your team respond to findings and make improvements visible across the organisation. It also gives senior leaders a clearer view of how compliance processes work over time.

If you’re ready to discuss how your program can support review preparation, contact Trancher to discuss your review. Take the next step with a clear plan and steady support.

Frequently Asked Questions

How Often Should You Do an Independent Audit?

Plan for an independent evaluation at least once every three years, and prepare evidence ahead of the due date. Set an internal milestone for assembling records and resolving access issues. If your organisation changes its services or customer processes, document whether the planned review date still makes sense and link that decision to your risk assessment.

Is a review of Part B of your program required?

Part B is not automatically included in every evaluation. Check which parts of the program your organisation uses and what the review is intended to examine to decide whether it falls within scope. If staff rely on Part B procedures for customer identification, for example, include evidence of how those procedures are applied. Set out the scope in the evaluator’s brief so everyone understands what the review covers.

The Review Process: What Will Be Reviewed?

The evaluator assesses your AML/CTF program against its requirements and tests how it operates. Make the evidence easy to follow by grouping records around each control, such as approved procedure versions, staff guidance and examples of completed checks. Include exceptions as well as routine cases. This helps show whether the program works consistently and unusual cases receive appropriate attention.

Who is qualified to conduct an independent AML/CTF review, and can it be done in-house?

An internal employee may conduct the evaluation if they meet the independence requirements. Before appointing them, compare their duties with the controls being tested. If they designed or operate a process under review, arrange for another suitable person to assess that area. Briefly document the selection rationale, including relevant sector knowledge and how conflicts were managed.

What must an Australian AML/CTF independent review assess and include in its report?

The evaluation must address the entity’s risk assessment steps, policy design, adherence to procedures and practical risk management. The written report must set out findings and go to the required senior decision-makers. To make it useful, organise it by finding, evidence and operational impact, and distinguish observations from suggested improvements. This structure helps readers understand what the evaluator tested and where management attention is needed.

Are there different independent review requirements for small or low-risk Australian reporting entities?

A small or low-risk profile does not remove the independent evaluation obligation. Keep evidence gathering proportionate by focusing on the services, customer processes and controls your organisation actually uses. A smaller entity, for example, can prepare a concise evidence set that follows its customer journey rather than collecting unrelated records. Document why the scope reflects the business’s operations and risk profile.