Appointing your AML/CTF Compliance Officer

Every reporting entity must designate an individual as its AML/CTF compliance officer (AML/CTF Act 2006 (Cth) s 26J(1)).

Deadlines.

• Designate no later than 28 days after the day you start providing a designated service (s 26K(1)). If you miss the deadline, each further day is a separate contravention (s 26K(4)).
• Notify AUSTRAC within 14 days after the designation, in the approved form (s 26M). AUSTRAC's guidance says to use the enrolment form on AUSTRAC Online.
• Transitional deadline. AUSTRAC's guidance gives newly regulated businesses until the later of 29 July 2026 and 14 days after enrolling to notify their first compliance officer.

AUSTRAC's 1 July 2026 media release said businesses providing designated services "must already have" a compliance officer in place. Treat the 28 days as the legal outer limit, not a target.

Who can hold the role. The compliance officer must be:

• an individual, not a company or a committee (s 26J(1));
• employed or otherwise engaged by the agency at management level (s 26J(2)(a));
• given enough authority, independence and access to resources and information to do the job effectively (s 26J(2)(b));
• resident in Australia, if you provide services through an Australian office (s 26J(3)(a));
• a fit and proper person (s 26J(3)(b)).

AUSTRAC's guidance says that in a smaller business, management level may mean the owner, a director or a person managing broader risks or operations. A person can be at management level without direct reports. Designating someone who is not eligible is itself a civil penalty contravention (s 26J(6)–(7)).

The fit-and-proper assessment. Rule 5-14(1) lists the matters you must have regard to:

• the competence, skills, knowledge, diligence, expertise and soundness of judgement to do the job, given the nature, size and complexity of the business;
• good character, honesty and integrity;
• whether they have been convicted of a serious offence (spent-convictions laws still apply, Rule 5-14(2));
• whether they have been the subject of civil or criminal proceedings, or a regulatory or disciplinary process, in Australia or overseas, that related to managing an entity or to commercial or professional activity and involved an adverse finding about their competence, diligence, judgement, honesty or integrity;
• whether they are an undischarged bankrupt;
• whether they have entered a personal insolvency agreement under Part X of the Bankruptcy Act 1966 (Cth) or a foreign equivalent;
• whether they have a conflict of interest that creates a material risk they will not properly perform the duties.

AUSTRAC's guidance says this "isn't a pass/fail checklist". It also expects you to reassess the officer periodically.

What the role does. The Act gives the compliance officer three core functions (s 26L):

• to oversee and coordinate day-to-day compliance with the Act, the regulations and the Rules;
• to oversee and coordinate the operation of, and compliance with, your AML/CTF policies;
• to communicate with AUSTRAC on your behalf.

AUSTRAC's guidance is that the officer oversees and coordinates others rather than doing every task personally. Approving the risk assessment and policies is a senior manager's job (s 26P(1)), although in a small agency one person may hold both roles. Your policies must also provide for the compliance officer to report to the governing body at least once every 12 months (Rule 5-7). The reports cover compliance with your policies, how well the policies manage your risks, and compliance with the Act and Rules. That requirement does not apply if the agency is an individual, or if the compliance officer is the governing body (Rule 5-7(3)).

Personal exposure. The Act places these obligations on the agency, not on the compliance officer. Holding the role does not by itself make someone liable. A person who is knowingly concerned in, or aids, a contravention of a civil penalty provision can be personally liable (s 174).

The appointment record. AUSTRAC expects records showing:

• who was appointed;
• when they acted in the role;
• how they meet each eligibility requirement, including reassessments;
• what you considered in deciding that.

Programme records are kept for 7 years after they stop being relevant to your programme obligations (s 116(3)).

What to do next. If AUSTRAC has not been notified of your compliance officer, do it now: for agencies that enrolled by 29 July 2026, the transitional deadline has passed. Diarise the periodic fit-and-proper reassessment and, where it applies, the 12-monthly report to the governing body. Identify an eligible backup person so that you can designate a replacement quickly; AUSTRAC suggests this.