The short answer
A small business can do its AML/CTF work in-house, pay an outside provider to do some of it, use software to help its own staff, or mix the three. No option is the default, and AUSTRAC does not recommend or endorse any particular product.
Responsibility for the result does not move. AUSTRAC says a business that outsources AML/CTF functions remains responsible for complying with its obligations and will generally remain legally liable for any breach. The choice is about who does the work.
Sources: AUSTRAC: Introduction; AUSTRAC: Whole fact sheet.
- In-house
Your people write and run the program, often starting from an AUSTRAC starter kit. The main cost is their time.
- Outside provider
A third party carries out functions for you, one-off or ongoing. AUSTRAC’s guidance covers due diligence, a written agreement and oversight.
- Software
A tool supports work your people still do. AUSTRAC suggests checking it was built for Australia and that its limits are explained.
- In every case
The business remains responsible for meeting its AML/CTF obligations.
Three ways to get the work done
The options can be combined. AUSTRAC does not recommend or endorse any specific RegTech business or product.
Separate evidence questions. An answer to one does not settle the others.
Doing it in-house
In-house means the owner or staff write and run the program. For small businesses in five newly regulated sectors, AUSTRAC publishes program starter kits as a starting point. Each kit lists the characteristics of the business it was designed for.
This option may suit a business that fits a kit, provides few designated services and has someone with time to learn the material. Its cost is mostly that person’s time. A kit is meant to be customised, and using one does not confirm compliance.
Sources: AUSTRAC: Index of the five program starter kits; AUSTRAC: Who the starter kit is for.
Using an outside provider
AUSTRAC calls this outsourcing: an arrangement with a third party to carry out AML/CTF functions on your behalf. It can be one-off, such as having someone develop the program, or ongoing, such as carrying out customer due diligence, monitoring or reporting.
AUSTRAC’s guidance sets out steps for managing it: identify the risks outsourcing creates, do due diligence on the provider, understand the tipping-off restrictions on sharing information, use a written agreement, monitor and review the arrangement, and document all of this in the program. It also expects businesses to avoid template or global programs that have not been amended for the business.
A provider may suit a business that lacks time or specialist knowledge. The oversight work stays with the business.
Sources: AUSTRAC: What is outsourcing and when you might use it; What’s not included in this guidance; AUSTRAC: Effective management of outsourcing; AUSTRAC: Performance targets; Avoid generic AML/CTF programs.
Using software
AUSTRAC treats software that helps you meet obligations in-house differently from outsourcing: its outsourcing guidance says it does not cover that use and points to separate RegTech guidance. Your staff still do the work. The software supports it.
AUSTRAC’s fact sheet on engaging a RegTech lists things to consider. They include whether the provider understands the AML/CTF framework and your industry, can clearly explain what the solution is designed to meet and its limitations, built the tool for Australia, and offers ongoing support. It notes that a tool built for another country will probably need changes to align with Australia’s framework.
Sources: AUSTRAC: What is outsourcing and when you might use it; What’s not included in this guidance; AUSTRAC: Whole fact sheet.
Questions that may help you choose
These are suggested questions, not an official test. Does the business fit a starter kit’s suitability list? Who has the time to learn and run the program? Which tasks recur often enough that a tool or a provider would save real effort? Who inside the business will check the work of any provider or tool?
The answers can differ by task. A business might write its own risk assessment, have an adviser review it, and use a tool for sanctions screening.
Source: AUSTRAC: Introduction.
Invented example: a mixed approach
A fictional real estate agency with eight staff fits the real estate starter kit’s list. The principal customises the kit over several weeks. She pays a consultant for a one-off review of the customised risk assessment under a short written agreement, and the agency uses a screening tool for name checks.
She might record who is responsible for each task, what the consultant was asked to deliver, and how the agency checks the tool’s results. These are suggested steps for the example. They do not show that the agency meets its obligations.
Source: AUSTRAC: What is outsourcing and when you might use it.