Information for AML oversight

Give the governing body useful evidence

AML management information is information used to oversee the AML/CTF program. It connects operational results with decisions about risk and compliance.

The governing body has ongoing oversight duties. AML/CTF policies must deal with the information needed to perform those duties.

Sources: Australian Government, Federal Register of Legislation: 26H; Australian Government, Federal Register of Legislation: 5-6.

Report on compliance and risk management

These policy requirements apply when the entity provides designated services at or through an Australian permanent establishment.

Rule 5-7 requires policies for reports from the AML compliance officer to the governing body. The reports must be regular, at least every 12 months.

The reports cover compliance with AML/CTF policies, how appropriately those policies manage and mitigate risks, and compliance with the Act, regulations and Rules.

This reporting requirement does not apply to an individual reporting entity, or when the compliance officer and governing body are the same individual.

The exception does not remove the governing body’s duties under section 26H. The reporting interval also does not replace ongoing oversight.

Sources: Australian Government, Federal Register of Legislation: 5-7; Australian Government, Federal Register of Legislation: 26H and 26L.

Connect findings to decisions

A useful report can state the result, supporting evidence, unresolved failures and the decision needed. Assign actions to a named person and record due dates.

For example, a report can explain delayed reviews, the affected customers and the proposed response. A total alone may hide an important unresolved case.

These are illustrative reporting choices, not a prescribed dashboard. Internal oversight reports are separate from annual compliance reports submitted to AUSTRAC.

Source: Australian Government, Federal Register of Legislation: 5-6 and 5-7.

Example: an overdue action

In a fictional practice, an internal report says that four corrective actions remain open. One action concerns a failed customer review process.

The report explains the affected work, interim measures and reason for delay. The governing body records its decision on resources and a completion date.

The next report includes evidence of the correction or explains the remaining problem. Marking the action complete without evidence would not answer the oversight question.

Sources: Australian Government, Federal Register of Legislation: 26H; Australian Government, Federal Register of Legislation: 5-6 and 5-7.