Independent evaluation versus your own internal review

Different questions need different checks

Internal review helps keep your risk assessment and policies current. Independent evaluation tests their design, their use and how the business manages risk. The Act treats these as separate activities. Section 26F(3) to (4) applies the evaluation requirement to services at or through Australian permanent establishments.

An evaluator can be internal or external if sufficiently independent. AUSTRAC expects independence from the work assessed, including its design, risk assessment and operation. The compliance officer cannot make their own work independent by giving it a different label. Select someone with suitable knowledge of your obligations, sector and risks.

Sources: AUSTRAC: Page 5: Review and update your AML/CTF program; Conduct an independent evaluation; Federal Register of Legislation: Sections 26D and 26F(2) to (4); Federal Register of Legislation: Section 5-10; AUSTRAC: Overview; Frequency; Selecting an independent evaluator; Selecting a suitable evaluator; Federal Register of Legislation: Sections 5-1 and 5-4: adverse findings.

Define review
Identify the work and independence needed.
Examine evidence
Use suitable tests and explain sample limits.
Report findings
Provide the written result to relevant roles.
Address issues
Assign actions and test their effect.

From evaluation to verified action

Suggested actions based on the guidance. This diagram does not set evaluation deadlines.

Follow the process from top to bottom.

Specify a useful evaluation

A suggested evaluation brief identifies the services, procedures, period and evidence to be examined. Ask how the evaluator will select files and explain their findings. Make access arrangements before work starts, including the handling of sensitive records. Avoid a brief that asks only whether a policy document exists. A policy can be present while its steps are not followed. The report is more useful when it connects the evidence tested with the conclusions reached and describes important limits in the sample.

Invented example: a process that exists only on paper

Suppose a policy requires an escalation step, but sampled files do not show whether staff used it. An internal review can investigate the immediate gap and repair instructions. An independent evaluator may consider whether the issue reveals a broader weakness in design or practice. Neither conclusion should exceed the evidence examined. This example shows why checking a document and checking its operation are different tasks. It also shows why a favourable sample does not establish that every customer file is correct.

Turn findings into decisions

Rules 5-10 requires a written report of the evaluation findings. The report must go to the governing body and any senior manager responsible for section 26P approvals. Policies must explain how the business responds to the report. Assign each material finding an owner, proposed response and completion evidence. Explain a decision not to adopt a recommendation.

Adverse findings about the risk assessment require a review. Start it as soon as practicable after the governing body receives the report. Adverse findings about policies require a review of those policies. Update them where required. Keep reasons for any decision not to change them.

If you change the risk assessment or policies, obtain the required approval. Set an evaluation frequency appropriate to the business’s nature, size and complexity. The Act requires evaluation at least once every three years. Transitional arrangements set the first deadline; the next section explains how to find it. A completed evaluation does not confirm compliance in all circumstances.

Find your first evaluation deadline

Your AML/CTF policies set the evaluation frequency, and section 26F(4)(f) of the Act requires at least one independent evaluation every three years. For the first evaluation, AUSTRAC’s transitional rules set a specific deadline that depends on how your business entered the regime.

If your business is newly regulated under the tranche 2 reforms, or previously provided only item 54 arranging services, the transitional rules stagger the first deadline by the last two digits of your AUSTRAC account number. Both digits odd: 30 June 2029. Second-last digit odd and last digit even: 31 December 2029. Both digits even: 30 June 2030. Second-last digit even and last digit odd: 31 December 2030. You receive the account number when you enrol with AUSTRAC.

If your business was enrolled on 30 March 2026 and has completed at least one independent review under the pre-reform Rules, the first evaluation is due by the later of four years after the most recent independent review and 31 March 2027. Record the deadline you identify and align your evaluation schedule with it. Consider checking current AUSTRAC guidance before relying on a date, because transitional arrangements can change.

Sources: AUSTRAC: Staggered initial independent evaluations; AUSTRAC: Frequency of independent evaluations; Federal Register of Legislation: Section 26F(4)(f).

Preserve the scope of assurance

When sharing an evaluation result, include the period, activities and evidence examined. Avoid reducing a qualified finding to a simple pass. If parts of the business were not reviewed, keep that limit visible. Future decisions can then use the report appropriately rather than assuming it covers work the evaluator never tested.