AML/CTF Rules take shape with further Consultation
AUSTRAC has released its second-round consultation on Rules (Draft Rules) to accompany the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) as amended by the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) (the Amended AML/CTF Act).
This second round of consultation (Current Consultation) and updated Draft Rules include material changes to the Draft Rules released in December 2024 (First Consultation).
While this article does not attempt to include a description or analysis of all aspects of the Draft Rules, we have identified areas that are likely to require careful consideration by existing reporting entities moving ahead to 31 March 2026.
AUSTRAC's consultation is open until 27 June 2025.
Reporting groups and lead entities
A quick recap on reforms affecting reporting entities
The Amended AML/CTF Act removed the concept of "designated business groups" and replaced this with "reporting group". The concept of "reporting group" means that, if relevant control exists, a "reporting group" will be automatically formed. There is also the ability to elect to form a reporting group. However, this does not allow an automatic reporting group to be displaced.
Every reporting group, whether automatic or by election, must have a lead entity. This means that wherever there is an entity providing a designated service in a business group, there will also be a lead entity regulated under the Amended AML/CTF Act. Importantly, the lead entity does not itself need to provide designated services.
What is proposed in the Draft Rules?
Under the First Consultation, the lead entity was described as the entity that controls all other members of the group that provide a designated service. The criteria for a lead entity has changed under the updated Draft Rules. The First Consultation on the Draft Rules also left a placeholder for the situation where no person satisfied the lead entity criteria or where groups are formed by election. This has now been covered as part of the Current Consultation.
Under the Current Consultation, members of a reporting group may agree on a lead entity that is:
- not controlled by another member in the group that provides designated services;
- has capacity to determine outcome of decisions about AML/CTF policies of the other members of the group; and
- has the requisite Australian connection.
If no agreement is reached by the members, the lead entity is the Australian-based member controlling the largest number of members who provide designated services. Where two or more members meet this test equally, tie-breakers consider who most directly controls those members, or if still equal, which controlling member has the most employees. Certain positions (like insolvency practitioners) cannot become lead entities solely by virtue of their role.
If a reporting entity is formed by election, members must consist of reporting entities or persons discharging obligations under the AML/CTF framework. The lead entity must satisfy substantially the same requirements as outlined above.
For reporting groups formed by election, new members may only join with the lead entity's consent, and members or the lead entity can leave by giving written notice to prescribed persons. A reporting group cannot operate without a lead entity for more than 28 days. During any gap, members must follow the AML/CTF policies of the most recent lead entity. These provisions ensure clear control, compliance, and continuity within elected reporting groups.
Key considerations in implementing reporting groups and lead entities
Additional Rules proposed in connection with AML/CTF Policies
A quick recap on AML/CTF Policies
The Amended AML/CTF Act will implement a new approach relating to AML/CTF Programs, including making a reporting entity's money laundering, terrorism financing and proliferation financing policies, procedures, system and controls (AML/CTF Policies) a part of its AML/CTF Program.
At a high level, the Amended AML/CTF Act requires AML/CTF Policies to:
- appropriately manage and mitigate the risks of ML/TF that the reporting entity may reasonably face in providing its designated services (ML/TF Risk Management Policies); and
- ensure that the reporting entity complies with the obligations imposed by the Act, the regulations and AML/CTF Rules which apply (Compliance Management Policies).
Reporting entities will be considering their existing AML/CTF Program and how their existing framework interacts with the AML/CTF Policy reforms. This will require consideration of where the perimeter of AML/CTF Policies lies and how "policies, procedures, systems and controls" will be overseen under the Amended AML/CTF Act's governance framework.
What is proposed in the Draft Rules?
In our article on the First Consultation on the Draft Rules, available here, we summarised the matters which the Draft Rules set out as necessary content for reporting entities' AML/CTF Policies. In the following section, we focus on the amendments and new provisions introduced in the current exposure Draft Rules.
Independent evaluations
The Draft Rules released as part of the First Consultation set out the matters which must be covered as part of an independent evaluation. The current Draft Rules introduce a further requirement for the conduct of an independent evaluation whereby AML/CTF Policies must also require the testing and evaluation of whether the reporting entity is appropriately identifying, assessing, managing and mitigating the ML/TF risks. This additional requirement is intended to ensure that an independent evaluation examines not only the compliance of the reporting entity but also whether the AML/CTF Program is effectively achieving the intended outcomes with regard with ML/TF risk mitigation and management.
Sanctions
As described separately in this article, the AML/CTF Policies must ensure that the reporting entities do not breach sanctions requirements.
Record keeping by the lead entity
The Amended AML/CTF Act requires that the lead entity must have AML/CTF Policies which include matters in addition to those applying to other reporting entities (including in connection with group risk and compliance arrangements). The Draft Rules expand on this and require that the AML/CTF Policies of the lead entity also cover keeping of up-to-date records about the membership of the reporting group, including records of:
- changes to the membership of the reporting group;
- the agreement of a lead entity and formation of a reporting group by election; and
- any member of the reporting group proposing to leave.
Key considerations in implementing the Rules for AML/CTF Policies
Sanctions compliance comes into AML/CTF policies
A quick recap on sanctions under the AML/CTF regime
Australia's sanctions regime seeks to address areas of international concern by imposing measures that are intended to restrict the trade of goods and services, prohibit engagement in certain commercial activities, and prohibit dealings with designated persons and entities through targeted financial sanctions.
Although a different legislative framework, many entities subject to the AML/CTF regime often administer their sanctions compliance processes alongside AML/CTF onboarding and monitoring. However, compliance with financial sanctions do not currently form part of the AML/CTF Act.
The Amended AML/CTF Act changed this position – as part of CDD, reporting entities will be required to establish, on reasonable grounds, whether a customer is designated for targeted financial sanctions. This also applies to a customer's beneficial owners, any person on whose behalf the customer is receiving the designated service, or any person acting on behalf of the customer.
Financial sanctions are also contemplated as part of "proliferation financing" which will need to form part of the ML/TF risk assessment of reporting entities.
What is proposed in the Draft Rules?
Sanctions as part of customer due diligence
While the Amended AML/CTF Act would require confirmation of sanctions status to be confirmed before providing a designated service, the Draft Rules would allow this to be delayed provided that certain steps are satisfied in respect of risk management and business disruptions. We have discussed this delayed due diligence in our CDD section.
Sanctions as part of AML/CTF policies
The Draft Rules propose that a reporting entity's AML/CTF policies must "deal with ensuring" that, in providing designated services, the reporting entity:
(a) does not make any money, property or virtual assets available to, or available for the benefit of, a person designated for targeted financial sanctions, in contravention of the Autonomous Sanctions Act 2011 or the Charter of the United Nations Act 1945; and
(b) does not use or deal with, or allow or facilitate the use of or dealing with, any money, property or virtual assets owned or controlled (directly or indirectly) by a person designated for targeted financial sanctions, in contravention of either of those Acts.
This means that policies that would ordinarily not form part of an AML/CTF Program under the existing AML/CTF regime, will fall within the ambit of AML/CTF policies going forward.
Key considerations in implementing sanctions policy updates
To view the full article click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
