Independent review
Why your programme must be independently reviewed, how often, and what the reviewer looks at.
Every AML/CTF programme must be independently reviewed at regular intervals. The review is the external check that your programme is not just a document on a shelf — that it is operating and being followed.
How often. The AML/CTF Rules 2025 require regular review. AUSTRAC's published expectation is every two to three years, with smaller agencies at the longer end and larger or higher-risk agencies at the shorter end. The first review for newly-enrolled agencies should occur within roughly 18–24 months of programme adoption.
Who can do it. "Independent" means independent of the people who designed and operate the programme. The reviewer can be internal (a separate team, an internal audit function) or external (a consultant, a law firm, an accounting firm). For most agencies, internal independence is impossible — there is no separate audit team — so external review is the standard.
The reviewer must be competent. Real-world expectations: experience with AML/CTF reviews, understanding of the AML/CTF Act 2006 and AML/CTF Rules 2025, and ideally familiarity with the real estate sector.
What the reviewer looks at.
- The risk assessment — currency, methodology, fit to the business
- The programme document — completeness against the AML/CTF Rules 2025, board approval, version control
- CDD procedures — sample of customer files tested for completeness, beneficial ownership, ECDD, sanctions screening
- Transaction monitoring — evidence that ongoing CDD is happening
- Reporting — sample of SMRs and TTRs filed, and decisions not to file
- Training — attendance, content, assessment evidence
- Record-keeping — retrievability of records on request
- Governance — Compliance Officer reporting lines, board oversight, escalation paths
The output. A written report identifying findings (deficiencies, gaps, observations) and recommendations, with a remediation plan agreed by management. The report and remediation evidence are themselves records that must be retained.
Why it matters. AUSTRAC will request the most recent independent review report at the start of any inspection. A clean report demonstrates that the agency takes compliance seriously. A report with significant findings and no remediation evidence is the fastest path to enforcement action.
What to do next: Diarise your first independent review for 18–24 months after programme adoption, and identify two or three potential reviewers now so the procurement is not rushed.