⚡ Direct Answer: An AML review (or independent evaluation) is a requirement under the AML/CTF Act — reporting entities must periodically evaluate the effectiveness of their AML/CTF program using an independent assessor. An AML audit is a broader or more formal version of this assessment, often conducted by external specialists or as part of an AUSTRAC compliance assessment. The key distinction is that the Act mandates an independent evaluation of program effectiveness — not simply a compliance audit against a checklist.
What Does the AML/CTF Act Actually Require?
The AML/CTF Act requires reporting entities to conduct periodic independent evaluations of their AML/CTF program. The purpose of this evaluation is to assess the effectiveness of the program — not just to confirm that the program exists on paper.
AUSTRAC’s guidance specifies that:
- The evaluation must be independent — conducted by someone who was not involved in developing or implementing the program
- The evaluation must assess effectiveness — whether the program is actually working to identify and manage ML/TF risks
- The findings and recommendations must be documented
- The program must be updated to reflect the findings of the evaluation
The “independent evaluation” required by the Act is what most practitioners refer to as an “AML review” or “AML program review.” It is a mandatory compliance obligation — not an optional quality improvement exercise.
What is an AML Program Review?
An AML program review (or independent evaluation) is an assessment of whether your AML/CTF program is fit for purpose — whether it is properly designed, implemented, and effective in managing your identified ML/TF risks.
A thorough AML program review covers:
- The adequacy and currency of the ML/TF risk assessment
- Whether the AML/CTF program is appropriately tailored to the nature, size, and complexity of the business
- Whether CDD procedures are properly designed and consistently implemented
- The quality and timeliness of suspicious matter reporting
- Compliance with threshold transaction and other reporting obligations
- Record-keeping practices and whether records are retrievable
- Staff training adequacy and coverage
- Governance and senior management accountability
- Whether the program has been maintained and updated as circumstances change
The review should result in a written report identifying any deficiencies and recommending specific remediation actions. The recommendations should then be formally implemented and documented.
What is an AML Audit?
The term “AML audit” is used in several contexts in Australia:
- In common usage: An “AML audit” is often used interchangeably with an “AML review” — it refers to a formal, independent assessment of AML/CTF compliance.
- AUSTRAC compliance assessment: AUSTRAC can conduct its own compliance assessments of reporting entities. These are formal regulatory exercises with powers to compel document production and require responses. They are distinct from a voluntary independent evaluation.
- External auditor appointment: Under certain enforcement scenarios, AUSTRAC can require a reporting entity to engage an external compliance auditor to assess its AML/CTF compliance and report back to AUSTRAC. This is more onerous than a voluntary review.
In practice, engaging an independent AML specialist to conduct a voluntary “AML audit” of your program is one of the best ways to identify issues before AUSTRAC does — and demonstrates a genuine commitment to compliance culture.
Key Differences: AML Review vs AML Audit
While the terms are often used interchangeably, here is how they differ in practice:
- AML Program Review: Voluntary (but legally required as an “independent evaluation”), focuses on effectiveness of the AML/CTF program, conducted by an independent specialist or internal audit function.
- AML Compliance Audit (voluntary): A more comprehensive assessment, may include transaction testing, file reviews, and operational assessments, often conducted by external AML consultants or auditors.
- AUSTRAC Compliance Assessment: A regulatory inspection conducted by AUSTRAC officers, backed by compulsory powers, and resulting in findings that may lead to enforcement action.
- External Compliance Auditor (AUSTRAC-ordered): An independent auditor appointed pursuant to an AUSTRAC direction, required to report to AUSTRAC on findings. Used as an enforcement tool.
How Often Should You Conduct an AML Review?
The Act does not prescribe a specific frequency — it requires reviews to be conducted “periodically.” AUSTRAC’s guidance and supervisory expectations suggest:
- For most reporting entities: at minimum every 2 years
- For larger, more complex, or higher-risk businesses: annually or more frequently
- Triggered reviews: whenever there are material changes to the business — new services, new customer segments, significant growth, major system changes, or changes in the regulatory environment
- Post-incident reviews: following a significant compliance failure or close call
With the Tranche 2 reforms taking effect in 2026, all reporting entities — new and existing — should conduct a review of their AML/CTF program to ensure it reflects the updated legal requirements.
Who Can Conduct an Independent AML Review?
The evaluator must be independent of the team that developed and implemented the AML/CTF program. Options include:
- An external AML/CTF consultant or specialist firm
- An internal audit function that is independent of the compliance team
- An external law firm or accounting firm with AML/CTF expertise
- A regulatory technology provider with audit capabilities
The evaluator must have sufficient knowledge of AML/CTF laws and AUSTRAC’s expectations to provide a meaningful assessment. A generic “compliance review” by an unqualified third party will not meet the requirements of the Act.
Frequently Asked Questions
Is an AML review the same as a financial audit?
No. A financial audit assesses the accuracy of financial statements. An AML program review assesses whether the business’s AML/CTF policies, procedures, and controls are effective in managing money laundering and terrorism financing risks. They are entirely different exercises — though an external accounting firm may conduct both.
Does AUSTRAC need to be notified of my review findings?
Generally, you are not required to proactively submit your review findings to AUSTRAC. However, if AUSTRAC requests them during a compliance assessment, you must be able to produce them. AUSTRAC can also request a copy of your review report as part of its supervisory activities.
What if the review finds serious deficiencies?
Address them immediately. Document the deficiencies and prepare a remediation plan with clear timeframes and responsible owners. If deficiencies are serious — such as a systemic failure to report SMRs — consider voluntary disclosure to AUSTRAC and seek legal advice. Remediating identified issues demonstrates a genuine compliance culture, which AUSTRAC takes into account.
Can I conduct the review myself?
No — the review must be independent. If you are the AML compliance officer, you cannot review your own work. The evaluator must be someone who was not involved in designing or operating the program.
📣 Need help with AML/CTF compliance?
👉 Book an independent AML program review: contact us
👉 Read the complete AML guide: AML Compliance Australia – Complete Guide (2026)
👉 Download the AML compliance checklist: AML Compliance Checklist for Australian Businesses