Personnel due diligence AML: checks, scope and ongoing review

Personnel due diligence is a core part of AML/CTF compliance, not just a recruitment check. In Australia, reporting entities must assess the skills, knowledge, expertise and integrity of people performing AML/CTF functions, with personnel due diligence for AML completed before a person is employed or engaged and maintained throughout the engagement, according to AUSTRAC.

It’s understandable that personnel due diligence AML responsibilities can feel unclear: they may involve employees, contractors or others who influence risk and controls. This guide explains who to include, which suitability checks to consider, how to review personnel over time and how to keep training records aligned with your AML/CTF processes. You’ll have a practical framework for turning an important obligation into a consistent, well-documented process.

What Are the New AML/CTF Personnel Due Diligence Requirements?

Australian reporting entities must assess the suitability of people performing AML/CTF functions. AUSTRAC guidance connects this obligation with identifying relevant roles, conducting pre-engagement checks and documenting decisions.

Roles requiring personnel assessment

Role assessment identifies people whose duties involve AML/CTF obligations or exposure to money laundering and terrorism financing risks. AUSTRAC identifies four groups: governance personnel, people with program responsibilities, people in roles exposed to ML/TF risk, and people who support AML/CTF obligations.

Consider who can change AML/CTF policies, approve payments, handle high-value transactions, alter customer risk profiles or access sensitive systems. This can reveal less obvious risks, such as a staff member’s ability to bypass a control. How does personnel due diligence differ from customer due diligence in Australia? Personnel due diligence assesses whether someone is suitable for a role; customer due diligence assesses a customer and the risks associated with a business relationship or service.

Assessing competence and integrity

Competence and integrity assessments consider whether a person can reliably perform their AML/CTF responsibilities. Assess skills, knowledge, expertise and integrity, rather than relying only on a job title or résumé.

Before employing or engaging someone, consider role-specific interview questions or knowledge assessments. For example, ask a candidate responsible for customer onboarding to explain how they would follow the relevant verification process. AUSTRAC guidance also identifies identity verification, qualifications, references and appropriate background checks as possible integrity checks.

Documenting assessment decisions

Assessment records show what the business considered and why it judged someone suitable for a particular role. AUSTRAC guidance refers to section 116 of the AML/CTF Act for personnel due diligence record keeping.

Record relevant qualifications, test and interview results, reference checks, checks conducted and any adverse findings. Include the decision and its rationale to show how the evidence informed the outcome. What are the penalties for failing to conduct personnel due diligence under Australian AML/CTF law? A failure to conduct personnel checks may contribute to wider AML/CTF compliance shortcomings. There is no single automatic penalty for every failure; enforcement depends on the circumstances.

Risk- and seniority-based assessment

A risk- and seniority-based approach adjusts the depth of checks to a person’s responsibilities and authority. AUSTRAC guidance says assessments should be proportionate to the risks associated with the role and its seniority.

A person who can approve payments or change risk profiles may warrant more scrutiny than someone with no access to those decisions. Policies should explain how the business assesses roles requiring due diligence and responds to adverse findings, as referred to in Act section 26F(4)(d). AUSTRAC guidance also refers to AML/CTF Rules sections 5-8 and 5-9 when identifying personnel roles.

Criminal history, sanctions and adverse media checks

Match checks to the person’s responsibilities, access and exposure to AML/CTF risks. AUSTRAC guidance identifies several possible integrity checks, but each result needs context: a finding should inform a suitability decision, not replace a considered assessment.

Choosing and interpreting checks

AUSTRAC lists identity verification, police and bankruptcy checks, sanctions and adverse media screening, employer references, and qualification checks as possible personnel integrity checks. A Nationally Coordinated Criminal History Check may also form part of pre-engagement screening. Choose checks relevant to the role, then record what each establishes and what it cannot establish.

For example, a qualification check can help assess relevant expertise, while a reference may provide evidence about past responsibilities. Sanctions screening and adverse media searches can identify information that needs closer review. Carefully assess a possible match before treating it as relevant. Check names and other available identifying details, then document how you assessed the result.

Police or bankruptcy findings also need to be considered in the context of the role. Their relevance depends on the duties, authority and risks attached to the position. Apply a consistent assessment under the business’s policies, rather than drawing an automatic conclusion about suitability. Record the reasoning clearly, especially if the evidence is incomplete or a result may relate to another person.

Periodic reassessment and triggers

Initial screening cannot address every later change in a person’s suitability. Australian reporting entities should set schedules and triggers for periodic reassessment. AML/CTF policies must explain how often reassessment takes place and what events trigger it, so personnel reviews follow a defined process.

Triggers can include a promotion, a change in duties, an incident or a shift in risk exposure. For instance, moving into a compliance or oversight role may increase access to sensitive information or authority over controls. Reassess when the role changes, rather than relying only on checks completed before the original engagement.

Set the review approach according to role risk and seniority. Policies should specify who initiates a review, which checks may be repeated and how the outcome is recorded. This makes ongoing due diligence and training easier to coordinate as responsibilities evolve. It also helps the CTF compliance officer identify when a personnel assessment needs attention.

Responding to adverse findings

AML/CTF policies should explain how the business responds to adverse assessment outcomes. First, assess whether the finding is reliable and relevant to the person’s current duties. Then document the evidence, decision-maker, rationale and any follow-up action. This creates a clear record of how the business addressed the result.

Responses should reflect the assessed risk and the person’s role. A concern may require clarification, further assessment or changes to responsibilities, depending on the circumstances. Apply the policy consistently and record why the chosen response addresses the identified concern. For wider AML/CTF oversight, ongoing risk monitoring and client activity tracking can sit alongside clearly documented personnel review processes.

Contractors, volunteers, interns and service-provider staff

Australian AML/CTF personnel obligations can cover people beyond employees, including contractors, consultants, volunteers and interns, whether paid or unpaid. Privacy obligations still apply: reporting entities must comply with the 13 Privacy Principles under the Privacy Act. Keep screening relevant to the role, explain its AML/CTF purpose and protect assessment records.

Start with the work each person performs, not their employment label. A consultant who helps maintain AML/CTF policies may support a regulated function, while an intern handling onboarding tasks may access customer information. Identify each person’s responsibilities, systems access and exposure to money laundering or terrorism financing risks. This role-based view helps determine which checks and training are appropriate.

Apply the same reasoning to service-provider staff. If a provider’s personnel perform or support AML/CTF functions, consider their access to customer data, transactions, risk decisions and internal controls. For example, a contractor who can amend customer risk profiles may create a different exposure from a technician with no access to those records. Document the relevant tasks and why the assessment is appropriate.

Outsourcing work does not transfer the reporting entity’s AML/CTF compliance responsibility. A contract can describe the provider’s tasks and information-sharing arrangements, but the reporting entity remains responsible for its obligations. Maintain a clear view of who performs each function, including when provider personnel change. Without that visibility, training and due diligence records may not reflect who is actually doing the work.

AUSTRAC guidance refers to section 5 of the AML/CTF Act when describing non-individuals. The personnel obligation includes people a reporting entity employs or engages, including individuals and non-individuals. Consider the relevant engagement structure, then identify which people perform AML/CTF duties or support the program. A company engaged to provide a function may require attention to the individuals carrying out that work.

For each engagement, record the function, access level, relevant checks, training needs and accountable contact. For example, note whether a consultant drafts procedures, a volunteer assists with customer onboarding, or provider staff can access screening results. These details help distinguish roles that need AML/CTF assessment from work with no material connection to the program.

Training should reflect a person’s duties, not simply their payroll status. An intern assisting with customer onboarding needs guidance relevant to that work; a contractor supporting reporting processes needs to understand applicable escalation arrangements. Keep training evidence with engagement records, and update it when responsibilities change. This connects personnel due diligence and training to the work being performed.

Apply consistent criteria to employees and other engaged personnel, while tailoring the depth of assessment to each role’s risk. A documented approach makes it easier to see who performs AML/CTF functions, which checks were considered and whether training matches responsibilities. Review provider arrangements when access, personnel or assigned functions change.

Ongoing personnel due diligence

An initial assessment is only the starting point. Australian reporting entities should conduct personnel due diligence before engagement and throughout it. The AML/CTF Act refers to ongoing personnel due diligence in section 29F(d), while the AML/CTF Rules refer to section 5-8(2). Together, these references support a continuing approach, not a one-off recruitment exercise.

Keep suitability under review as responsibilities, access and risks change. A promotion into a compliance or oversight role may trigger reassessment, according to AUSTRAC guidance. The move could give someone greater influence over governance, sensitive information or AML/CTF controls. Reconsider whether their knowledge, skills and integrity remain appropriate for the new duties.

Set both scheduled reviews and event-based triggers in your AML/CTF policies. Triggers may include a role change, an incident or a shift in risk exposure. For example, a team member who gains authority to amend customer risk profiles may need a fresh assessment. A scheduled review can also identify changed circumstances that were not reported as a trigger.

The compliance officer can coordinate this process with managers who understand each role. Managers can flag changes in duties or access, while the compliance officer assesses their AML/CTF significance. Define who starts a review, who evaluates the evidence and who records the decision. Clear responsibilities help ensure a promotion or transfer does not bypass the review process.

Choose the review’s scope according to the change. A new oversight role may call for reassessing competence against its specific obligations. A change in access might prompt an integrity review or renewed checks relevant to that exposure. Record why each check was selected, what it found and how the finding affected the suitability decision.

Policies should also explain how the business responds to adverse assessments. Set out who evaluates a finding, how its relevance is considered and what follow-up is required. For instance, a concern related to newly assigned duties may require further assessment before those duties continue. Apply the documented approach consistently and retain the reasoning behind the decision.

Connect personnel reviews with training records. If a role change creates new AML/CTF responsibilities, assess whether the person needs additional knowledge or training. Record the change, assessment outcome and related training evidence together. This gives governance personnel a clearer view of suitability over time and helps demonstrate how the business maintains its AML/CTF arrangements.

Personnel due diligence and AML/CTF training

Personnel suitability and training work best as connected parts of an AML/CTF program. Due diligence considers whether a person has the integrity, skills and knowledge for their assigned duties; training helps them perform those duties consistently. Australian reporting entities should conduct personnel due diligence before and throughout an engagement, alongside training that reflects each person’s responsibilities.

For Australian practitioners, training must cover the regime’s requirements and the practice’s internal processes. Staff need to understand how to manage money laundering and terrorism financing risks, recognise red flags and suspicious activity, and follow reporting and escalation processes. Training should begin when someone starts employment or engagement, then continue to keep their awareness current and effective.

How should AML/CTF staff training and competence be assessed and documented in Australia? Match training to each role, assess whether staff understand its requirements, and document activities in the AML/CTF policies. Keep evidence of the training delivered, its relevance to each person’s work, and any assessment results or follow-up.

Use role-specific learning rather than relying on one generic module. AUSTRAC’s professional services firm example provides all personnel with foundational training on the firm’s obligations and ML/TF risks. Client-facing staff receive instruction on customer due diligence, suspicious indicators, escalation and reporting timelines. Junior solicitors receive detailed onboarding and ID-verification training, while governing body members learn about their governance duties and the firm’s risk assessment.

Practical exercises can test whether learning carries over to daily decisions. A scenario about unusual client behaviour can ask staff to identify the warning sign, record relevant facts and escalate through the internal process. Results can reveal remaining knowledge gaps. The compliance officer oversees staff training and keeps it current and effective, including when duties or risks change.

Document the training date, audience, subject matter and evidence of completion within the AML/CTF policies. Keep assessment results and follow-up actions where they help demonstrate whether the training met its purpose. For instance, a staff member who cannot explain the escalation pathway may need targeted guidance and reassessment. Link these records to the person’s role and relevant due diligence decision.

For current reporting entities, personnel due diligence reforms commenced on 31 March 2026. Tranche 2 entities had to finalise personnel due diligence and training before the 1 July 2026 AML/CTF implementation date. AUSTRAC guidance refers to Act section 26K(2) and Rules section 5-14 for the AML/CTF compliance officer’s personnel due diligence.

Build a joined-up process: assess suitability, identify role-based learning, check understanding and retain the evidence. To structure these activities within your wider compliance program, explore AML/CTF program management.

Trancher: End-to-End AML/CTF Program Management

Trancher provides End-to-End AML/CTF Program Management for Australian businesses seeking a more coordinated approach to compliance. Its platform supports client verification and due diligence, including KYC/CDD and screening, alongside ongoing risk monitoring and client activity tracking.

When personnel checks, customer processes and reporting records need to work together, a connected program can help bring those compliance activities into a more consistent workflow. Trancher also supports regulatory and suspicious matter reporting, helping businesses manage key AML/CTF processes alongside their own personnel assessment and training arrangements.

Consider this approach when your team needs to organise AML/CTF activities across verification, monitoring and reporting. Contact Trancher to discuss how its program management platform can support your compliance processes.

Make suitability part of everyday compliance

Personnel due diligence for AML/CTF is strongest when it is part of how your organisation manages change, not a task revisited only during recruitment. Build ownership into governance, make review triggers visible to relevant managers and connect decisions to the work people actually perform. This creates a practical foundation for consistent oversight as roles and responsibilities evolve.

Next, identify where your current process needs clearer accountability or better coordination. Consider how personnel assessments, training evidence and wider compliance workflows fit together, then prioritise the gaps that matter most to your operating model. A structured approach can help your team make informed decisions and maintain clearer records without unnecessary complexity.

Trancher’s AML/CTF platform brings together program management, client verification and ongoing risk monitoring. If you’re ready to discuss how it could support your compliance processes, contact Trancher about personnel due diligence. Take the next step at a pace that works for your organisation, with a clearer path towards consistent compliance.

Frequently Asked Questions

Who Needs Due Diligence and Training?

People whose work touches AML/CTF controls may need role-appropriate assessment and training. Look beyond formal position descriptions: map who handles onboarding, supports reporting, maintains procedures or can access relevant systems. For example, a temporary worker updating customer records may need different training from someone who never accesses those workflows. A task-based map helps identify gaps between documented responsibilities and day-to-day work.

What does personnel due diligence mean under Australian AML/CTF rules?

Personnel due diligence is a role-focused assessment of whether someone is suitable to perform AML/CTF responsibilities. AML personnel due diligence connects evidence about competence and integrity to the person’s actual duties; it is not a general judgement about character. In practice, assess whether the person understands the decisions they must make, the limits of their authority and how to raise concerns within the organisation.

Which Australian businesses must conduct AML/CTF personnel due diligence?

The requirement applies to Australian reporting entities and the people they employ or engage for relevant functions. A business should first establish whether its activities make it a reporting entity, then identify personnel connected with its AML/CTF obligations. An internal record linking each relevant service or process to the roles that support it helps prevent responsibilities being missed when teams or work arrangements change.

What employee screening and background checks are required for AML/CTF compliance in Australia?

The appropriate checks depend on the role; no single checklist fits every person. If a screening result appears inconsistent with the candidate’s identity or other records, resolve the discrepancy before relying on it. Keep the purpose of each check clear, restrict access to screening information, and retain records relevant to the suitability decision and the entity’s compliance needs.

When must Australian reporting entities conduct personnel due diligence before and during employment?

Complete the initial suitability assessment before employing or engaging the person, and maintain review arrangements throughout the engagement. Build the pre-engagement decision into recruitment or contracting workflows so responsibility is clear before duties are assigned. For ongoing review, make role changes visible to the person responsible for compliance. This connects changes in authority or access with timely reassessment.

What checks are required for AML/CTF compliance officers and senior managers in Australia?

Assess suitability against the responsibilities and authority of each position, rather than applying a universal checklist. For an AML/CTF compliance officer, consider whether their experience and knowledge support their assigned functions. For senior managers, assess whether they can perform their governance responsibilities effectively. Record the reasoning behind the appointment, including any development needs identified.

How do Australian AML/CTF reforms affect personnel due diligence requirements and commencement dates?

Personnel due diligence reforms for current reporting entities commenced on 31 March 2026. Tranche 2 entities needed to finalise personnel due diligence and training before the 1 July 2026 implementation date. For implementation planning, distinguish readiness work from the continuing process of reviewing personnel suitability. An internal governance record can show which arrangements were established for commencement and who now owns their ongoing operation.

What are practical steps and records for an Australian AML/CTF personnel due diligence program?

Set up a central record that can be reviewed without searching across recruitment files, training systems and team notes. For AML personnel due diligence, include the role assessed, evidence considered, decision date, rationale and any outstanding action. Use consistent record names and access controls, then review the register when responsibilities change. This makes it easier to find an individual’s assessment history and identify incomplete records.