Training and the fit-and-proper test

Every reporting entity's AML/CTF policies must deal with two staff obligations under the AML/CTF Act 2006 (Cth). Both apply to people "who perform, or will perform, functions relevant to the reporting entity's obligations under this Act":

• training them (s 26F(4)(e));
• doing due diligence on them (s 26F(4)(d)).

The AML/CTF Rules 2025 fill in the detail.

Who needs training. Anyone whose work is relevant to your AML/CTF obligations. In an agency that usually means sales agents, buyer's agents, the principal, administration staff who handle customer due diligence or payments, and the compliance officer. AUSTRAC's guidance is that all customer-facing staff need to know the signs of suspicious activity and your reporting procedures. People who carry out enhanced CDD or look into suspicious matters need a deeper understanding.

What the training must be. Rule 5-9(3) requires training that suits the person's function, the risks relevant to that function and their responsibilities under your policies. It must also be readily understandable by them. AUSTRAC's e-learning can be part of it, but AUSTRAC says it cannot be relied on alone, because training must be tailored. If you outsource training, you remain responsible for it fitting your business.

How often. The Act and Rules set no fixed frequency. Rule 5-9(2) requires initial training when someone starts and ongoing training during their engagement. AUSTRAC's examples, which it says are examples only:

• compliance officer and senior management: every 6–12 months;
• customer-facing staff, and staff who onboard customers or monitor transactions: every 12 months;
• updated training as soon as practicable after changes to the law, your programme or your risks, or after a compliance failure;
• training before anyone takes on new AML/CTF duties.

What it covers. AUSTRAC's role-based examples for an agency include:

• how to follow your identity verification, beneficial ownership, sanctions and PEP checks;
• the signs of suspicious activity, your escalation path and the reporting deadlines;
• what a threshold transaction is and what structuring looks like;
• what records to keep, including records of decisions.

Your policies must also include safeguards against tipping off (Rule 5-13; Act s 123), so cover that in training too.

Evidencing it. You must keep records reasonably necessary to show you met your training obligations (s 116). AUSTRAC suggests keeping records of attendance, training schedules, content, delivery methods and any assessments. It also suggests a register showing completion dates and when training is next due. The law requires training that is tailored and understood, so keep evidence of both.

Personnel due diligence. Rule 5-8(2) requires your policies to assess two things for the same staff, both before they start and during their engagement:

• their skills, knowledge and expertise for their AML/CTF responsibilities;
• their integrity.

AUSTRAC's guidance is that the depth should match the role and its risks. A staff member who only makes sure customers fill in onboarding forms needs much lighter checks than a compliance officer. Integrity checks can include identity verification, police and bankruptcy checks, sanctions and adverse media screening, and references, as appropriate to the role.

The compliance officer and the fit-and-proper test. The fit-and-proper requirement applies to the AML/CTF compliance officer (s 26J(3)(b)), not to every senior staff member. Rule 5-14(1) lists seven matters you must have regard to:

• competence, skills, knowledge, diligence, expertise and soundness of judgement;
• good character, honesty and integrity;
• convictions for a serious offence;
• adverse findings about competence, diligence, judgement, honesty or integrity in proceedings or a regulatory or disciplinary process relating to management or commercial or professional activity;
• undischarged bankruptcy;
• a personal insolvency agreement under Part X of the Bankruptcy Act 1966 (Cth);
• a conflict of interest that creates a material risk of the duties not being properly performed.

AUSTRAC gives open-source searches, credit checks, reference checks and police checks as examples of what you might consider. It expects periodic reassessment. More detail is in Appointing your AML/CTF Compliance Officer.

What to do next. List every role whose work touches your AML/CTF obligations. For each one, write down the induction and ongoing training it gets and the personnel due diligence it needs, before engagement and on a schedule. Set up a training register with completion dates and next-due dates.