Independent evaluation — when yours is actually due

Every AML/CTF programme must be independently evaluated. The evaluation is the external check that the programme is not sitting on a shelf — that it is current, fit for the business, and actually being followed.

Almost everything written about this obligation gets the timing wrong. Start there, because it changes what you should do this year.

When your first one is actually due

Not for years. This is the single most misunderstood point in the whole obligation.

Part 7 of the AML/CTF Transitional Rules 2026 staggers the first independent evaluation for newly regulated entities by the last two digits of your AUSTRAC account number — the AAN you received when you enrolled.

Agencies already regulated before 30 March 2026 that had at least one independent review under the pre-reform Rules work to a different clock: the later of four years after that review, or 31 March 2027.

The stagger exists to stop the entire newly regulated population hitting the market for evaluators in the same quarter. Going earlier is a judgement call, not an obligation — AUSTRAC's own reasons for considering it are that you find major problems while they are still cheap to fix, and that evaluators with real skills will be scarcer as the 2029–2030 wave arrives. Both are true. Neither makes an earlier date binding.

How often, after the first one

Your policies set the frequency. Section 26F(4)(f) constrains that choice two ways: it must be appropriate to the nature, size and complexity of your business, and it must be at least once every 3 years. If your policies say two years, two years is your obligation — you are bound by what you wrote.

AUSTRAC expects the rationale for the frequency to be documented, including the factors about your business that led to it. "Three years because that is the minimum" is not a rationale.

There is no material-change trigger for an evaluation. That trigger belongs to reviewing your risk assessment and your policies — separate obligations, with their own three-year floors, which you must meet in addition to the independent evaluation. Conflating your own internal review with the independent evaluation is the most common structural error in this area.

Who is allowed to do it

Independence means freedom from bias, influence and conflicts of interest, and AUSTRAC's test is specific. The evaluator must have authority to exercise independent judgement and be free to conduct the evaluation as they see fit. They must not be responsible for implementing or maintaining the programme, must not have been involved in developing the programme, systems or controls, must not have been involved in assessing your ML/TF risks, and must be independent of the areas being evaluated — expressly not your AML/CTF compliance officer or anyone on the compliance team.

An internal evaluator is permitted if all of that genuinely holds. In a typical agency the person who built the programme is the licensee or the compliance officer, so it is the criteria rather than the headcount that push you to an external evaluator.

There are no mandatory qualifications. AUSTRAC expects the evaluator to know the obligations that apply to your business, and to have sufficient experience and knowledge of your sector and of the ML/TF risks businesses in it reasonably face. It also suggests weighing their experience with businesses of similar size, their experience evaluating the effectiveness of systems and controls, any AML/CTF qualifications, and whether they belong to a professional body with standards behind it. An evaluator who does not know real estate will produce findings you cannot use.

Your policies must set out how you will determine that an evaluator is both independent and suitable.

What the evaluation must cover

Three limbs, fixed by Rules s 5-10:

1. How you undertook or reviewed your ML/TF risk assessment, measured against the Act, the regulations and the Rules.
2. The design of your policies, against the same.
3. A test of whether you actually identified, assessed, mitigated and managed your ML/TF risks and complied with your own policies.

The first two are document work. The third is where files get pulled. In a real estate agency that third limb usually reaches:

• The risk assessment — currency, methodology, fit to the business
• CDD procedures — a sample of customer files tested for completeness, beneficial ownership, enhanced due diligence and sanctions screening
• Ongoing customer due diligence — evidence that monitoring is actually happening
• Reporting — sample SMRs and TTRs filed, and decisions not to file
• Training — attendance, content, assessment evidence
• Record-keeping — retrievability of records on request
• Governance — compliance-officer reporting lines, oversight, escalation paths

The report, and what you must do with it

The output is a written report identifying findings and recommendations. It is not a private document. Rules s 5-10 requires it to go to your governing body and to any senior manager responsible for approving your programme, as soon as reasonably practicable after it is prepared.

Once the governing body has it, adverse findings become a governance question, not only a compliance one. AUSTRAC treats a governing body that reviews evaluation reports and questions how findings will be addressed as evidence of appropriate oversight under s 26H, and one that does not consider them as evidence of the opposite.

The statutory response is not "agree a remediation plan". Where the report contains adverse findings on the risk assessment, you must review it, update it if required, and update your policies to reflect the change. Where the findings concern the policies, you must review and if required update those. Updates must be documented within 14 days.

You do not have to agree with every finding. But under s 116 you must keep records of how you addressed each one — expressly including your reasons for not addressing any you rejected. A report with significant findings and no trail behind it is worse than no report, because it proves you knew.

What to do next. Find your AAN, read the last two digits, and put the resulting date from the table above into your programme and your calendar. Then set your standing frequency in the policies themselves and write down why that frequency suits your agency. Identify two or three candidate evaluators well before you need them: the entire newly regulated cohort hits its first deadline inside an 18-month window in 2029–2030, and the supply of evaluators who understand real estate will not expand to meet it.