Independent evaluation
Why your programme has to be independently evaluated, how often, and what the evaluator looks at.
In short
Under the AML/CTF Rules 2025 every programme must be independently evaluated at least once every three years. The evaluator must be independent of the people who designed and operate the programme, and tests whether the programme is current, fit for the business, and actually being followed. AUSTRAC asks for the most recent evaluation report at the start of any inspection.
Every AML/CTF programme must be independently evaluated. The evaluation is the external check that the programme is not just sitting on a shelf — that it is current, fit for the business, and being followed in practice.
How often. The AML/CTF Rules 2025 require an independent evaluation at least once every three years. Larger or higher-risk agencies should evaluate more frequently. Newly enrolled agencies should aim to complete a first evaluation within roughly 18 to 24 months of adopting the programme.
Who can do it. "Independent" means independent of the people who designed and operate the programme. The evaluator can be internal (a separate team or audit function) or external (a consultant, law firm or accounting firm). For most real-estate agencies there is no separate audit team, so external evaluators are the standard.
The evaluator must be competent. Practical expectations: experience with AML/CTF evaluations, working knowledge of the AML/CTF Act 2006 and the AML/CTF Rules 2025, and ideally familiarity with the real-estate sector.
What the evaluator looks at.
- The risk assessment — currency, methodology, fit to the business
- The programme document — completeness against the Rules, governing-body approval, version control
- CDD procedures — a sample of customer files tested for completeness, beneficial ownership, ECDD and sanctions screening
- Ongoing customer due diligence — evidence that monitoring is actually happening
- Reporting — sample SMRs and TTRs filed, and decisions not to file
- Training — attendance, content, assessment evidence
- Record-keeping — retrievability of records on request
- Governance — Compliance Officer reporting lines, board oversight, escalation paths
The output. A written report identifying findings (deficiencies, gaps, observations) with recommendations and a remediation plan agreed by management. The report and the remediation evidence are themselves records that must be retained.
Why it matters. AUSTRAC asks for the most recent evaluation report at the start of any inspection. A clean report shows the agency takes compliance seriously. A report with significant findings and no remediation evidence is the fastest route to enforcement.
What to do next. Diarise your first independent evaluation for 18 to 24 months after programme adoption. Identify two or three potential evaluators now so the procurement is not rushed when the date comes around.
Frequently asked questions
- Is it called a review or an evaluation?
- Under the 2025 Rules it is an independent evaluation. The earlier 'independent review' language carried over from the old Part A regime is no longer the correct term.
- How often is it required?
- At least once every three years, and earlier if something material has changed in the business.
- Can an internal person do it?
- Yes, provided they are genuinely independent of the people who designed and operate the programme. For most agencies an internal separation is not realistic, so external evaluators are the standard.