Executive summary

Over the past year, Australia saw significant changes introduced to its regulatory landscape, and the AML/CTF regime has been at the forefront of the regulatory reforms.

We will be publishing a series of bite-sized articles to help you keep up to date with the key AML/CTF reforms on the horizon.

In this article, we will explore:

1. New rules around independent evaluation of AML/CTF programs (being the new name for independent reviews), and the value of a properly conducted independent evaluation in light of recent enforcement action by AUSTRAC.
2. What ongoing governance and risk management practices to maintain an effective AML/CTF compliance framework, and how this leads to a stronger performance when the AML/CTF program is subject to independent evaluations.
3. Insights from a recent case on ‘de-banking’ (Merciful Group Inc v Norfina Ltd (t/as Suncorp Bank) [2025] NSWSC 841) which highlights the importance of a properly conducted ML/TF risk assessment and how it can help defending commercial decisions in the event of a challenge.

The aim is to provide practical and relevant guidance both for those who are seasoned and the new entrants brought under the AML/CTF regime as part of the Tranche 2 reform.

Background

In December 2024, the Anti‑Money Laundering and Counter‑Terrorism Financing Amendment Act 2024 received the Royal Assent and is set to amend the current Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Draft AML/CTF Act) with various provisions commencing at various points in time. Most (but not all) provisions are coming into effect 31 March 2026. Some provisions have already commenced, and some are set to commence as late as 1 July 2026.

AUSTRAC has published the Future Law Compilation of the Anti-Money Laundering and Counter-Terrorism Financing Act which shows the text of the Draft AML/CTF Act as it is expected to read at 1 July 2026.¹

Subsequently, in August 2025, to operationalise and supplement the revised AML/CTF Act, AUSTRAC released the ‘new’ AML/CTF Rules, now contained in two separate instruments:

• the Anti‑Money Laundering and Counter‑Terrorism Financing Rules 2025; and
• the Anti-Money Laundering and Counter-Terrorism Financing Rules Amendment (Consequential Amendments) Instrument 2025,

with almost all changes coming into effect from 31 March 2026.

AML/CTF program: An ‘independent evaluation’ is the new independent review

Historically, there has been no specific requirement on how often a reporting entity must have its AML/CTF program (at least Part A) independently examined, other than that they must have taken into account “the nature, size and complexity of a reporting entity’s business, and the type and level of ML/TF risk it might face” when determining an appropriate interval.

The Draft AML/CTF Act has spoken – confirming an independent evaluation must be undertaken at least once every three years.²  It is possible though, AUSTRAC will expect something more frequent from those in the higher risk sector. Even under the current regime, despite there being no concrete legal requirement on frequency, the regulator made it clear that it expects those in the higher risk sectors to conduct an independent review at least once every two to three years.³

Why it matters: AUSTRAC-initiated audit and enforcement

The independent evaluation requirement over the AML/CTF program is not only a mandatory compliance obligation but, if utilised well, is capable of being an excellent risk management tool. On the flipside, a poorly executed independent evaluation may lead to adverse (and often public) action taken against the business.

In August 2025, for example, AUSTRAC directed a leading, global cryptocurrency exchange to appoint an external auditor after identifying various concerns in the AML/CTF control environment of the leading cryptocurrency exchange. In particular, AUSTRAC had noted its media release:

AUSTRAC’s concerns were prompted by several issues including Binance’s latest independent review which was limited in scope relative to its size, business offerings and risks.

Businesses need to maximise the value of independent reviews and ensure appropriate testing and review across critical processes and controls. They should seek and expect a level of rigour and challenge.

Whilst the relevant notice for this particular occasion is not yet published at the date of this article, AUSTRAC notices of this type generally require the independent audit report (and the auditor’s opinion therein) be prepared in a form that ‘accords with the format and style in which the external auditor would prepare a report suitable to annex to an expert witness affidavit the external auditor would make in Federal Court of Australia proceedings’.

In our view, the message is clear. A rigorous independent evaluation and strong governance together create a virtuous cycle of minimising deficiencies, and demonstrating the AML/CTF program is fit for purpose. Where businesses overlook the significance of independent evaluations and daily AML/CTF governance, they will likely face risks in two folds – if AUSTRAC orders an external audit, its findings may not only expose weaknesses but also exposes the business to the risk of civil penalty proceedings and reputational damage.

AUSTRAC’s approach reinforces the two key pillars of compliance, the very subject of this article:

• well conducted, quality independent evaluation of AML/CTF programs; and
• strong day-to-day governance of those programs.

What makes a good independent evaluation?

A thorough independent evaluation would assess AML/CTF programs from at least two perspectives (in conjunction with the matters prescribed under the law):

• design effectiveness which should review and challenge whether the AML/CTF program is drafted (ie designed) in compliance with the law.
• operating effectiveness which should examine how well the AML/CTF program is understood and complied with in practice (ie at an operational level).

In other words, a well-documented AML/CTF program is only part of the equation. Its operational effectiveness depends on whether management’s thinking behind the risk management framework is cascaded down and applied consistently by frontline staff who are often closest to the most tangible ML/TF risks. It is crucial for the independent evaluation to sufficiently review and challenge the program in this regard.

What does strong AML/CTF governance look like?

As alluded to earlier, while independent evaluations provide periodic check-ups, sound governance of an AML/CTF program is the continuous effort that keeps the program effective which, if done right, typically improves its performance in independent evaluations or under regulatory scrutiny.

‘Governance’ in this context refers to the roles, processes, and culture within an organisation that ensure ongoing compliance with AML/CTF obligations. Strong AML/CTF governance means that an independent evaluation or any uplift initiative is not treated as a one-off project, but rather is integrated into BAU operations with management oversight, sufficient resourcing, and clear accountability.

ML/TF risk assessment

As fundamental as it is, the ML/TF risk assessment has always been, and likely continue to be, an area of focus for AUSTRAC.

Of note, the definition of ‘ML/TF risk’ under the Draft AML/CTF Act has been amended to now include ‘proliferation financing’ risk (PF risk), in summary, being the risk of financing proliferation of weapons of mass destruction.⁴

As such, whilst the statutory terminology refers to ‘ML/TF risk’, in practice this should be read as encompassing ‘ML/TF/PF risk’. Despite the slight inconsistency, this is perhaps unsurprising given AUSTRAC’s long-standing expectation that sanctions risks be managed within AML/CTF frameworks.

Given managing PF risk is now a legal requirement (than something in between an obligation and good practice as it previously was), APRA-regulated entities in particular should consider whether their risk management framework, appetite and strategy maintained pursuant to Prudential Standard CPS 220 Risk Management (CPS 220) adequately capture ML/TF, PF and other sanctions risks consistent with their business plans.

Case study: ML/TF risk assessment in action

Perhaps timely, a recent court decision provides a real world example of how robust AML/CTF governance (particularly ML/TF risk assessment) can be critical in justifying and defending difficult commercial decisions made by financial institutions, such as exiting a customer, if and when challenged in court.

In Merciful Group Inc v Norfina Ltd (t/as Suncorp Bank) [2025] NSWSC 841, the court examined the legality of a bank’s decision to close the bank accounts (‘de-bank’) of a customer pursuant to, among other things, the bank’s:

• terms and conditions;
• outcome of its ML/TF risk assessment; and
• risk appetite approved by its board pursuant to CPS 220.

One of Suncorp Bank’s primary arguments was that it was entitled to, and required to, make commercial decisions about whether continuation of the account is consistent with the risk management framework it has adopted to achieve compliance with its risk management framework it has adopted for the purposes of its regulatory obligations.

Merciful Group challenged this account closure, essentially arguing the bank had no proper basis to terminate the relationship. This case is instructive for AML/CTF governance because it hinged on whether the bank had adequately assessed and documented its ML/TF risk concerns about the customer.

The court ultimately sided with the bank, finding that the decision to exit its customer was justified by a rational assessment of the ML/TF risks posed, and subsequently making a commercial decision in good faith based on the risks so identified. Of note, Hammerschlag CJ held:

protecting against the risk of [the bank’s services] being used for money laundering/terrorism financing... is, self-evidently, a legitimate business need and prudential requirement. That risk manifestly also entails a material risk of financial detriment not only from regulators but also of reputational harm.⁵

Crucially, the evidence showed that the bank’s ML/TF risk management and monitoring measures had identified a number of ‘red flags’ in relation to the charity customer’s accounts. The court found the following eight factors were sufficient to justify the bank’s decision:⁶

• the customer was sending large amounts of money from the account to a third-party money remitter (consistent with layering – a well-known technique for money laundering) coupled in some cases with no designation and in others with the country designations referred to earlier – for onward transmission to high risk countries to which the Bank itself would not send money;
• the bank’s highly sophisticated systems assessed the account as high risk;
• the source of the customer’s wealth and credits was unable to be established through open-source searches;
• reported donations increased over a short period by 225% when the economic climate made this unusual;
• merchant facilities were being used to process high-value transactions;
• large sums of money were being spent (by a charity) on high-value luxury goods;
• despite appearing to be a substantial operation, Merciful was incurring no business expenditure;
• there was an ostensible connection with men whose names matched individuals associated with crime.

The case is meaningful in a sense that the court had recognised that preventing misuse of banking services for illicit finance is a core part of a bank’s lawful interests and regulatory obligations which, in turn, validates the emphasis regulators place on robust governance of AML/CTF programs and policies, including properly conducted ML/TF/PF risk assessments.

This outcome contrasts with an earlier de-banking case, Human Appeal International Australia v Beyond Bank [2023] NSWSC 1161, in which the court found the bank had not demonstrated sufficient reason to justify closing the account where it had a contractual obligation of good faith and reasonableness, particularly where its terms and conditions incorporate the Customer Owned Banking Code of Practice.

The juxtaposition of these cases sends a clear message – if a bank is going to de-bank or refuse a client due to concerns such as ML/TF/PF risks, it must be prepared to show a well-founded risk assessment and a decision-making process that is honest and rational. Unfounded, arbitrary suspicions will not hold up, nor will an after-the-fact rationalisation (not to suggest that any of the earlier cases falls into this category).

From a governance perspective, this means banks and other entities should have clear procedures for escalating and reviewing high-risk customer relationships, involving compliance officers, risk committees, and legal counsel as needed, and documenting the analysis at each step. That documentation (including risk reports, transaction analyses, and minutes of decision meetings) can become crucial evidence if the decision is later challenged.

Where to from here?

AUSTRAC’s regulatory expectations and priorities for 2025-26⁷  indicate ML/TF/PF risk assessment will continue to be a focus area, together with educational effort to ensure reporting entities implement changes to their AML/CTF programs and practice to align with changes in the legislative regime.

We recommend that reporting entities take proactive steps to:

1. Cultivate a strong risk culture through ongoing training and leadership messaging. In our experience, staff are key to implementing sound and healthy compliance / risk culture. Reporting entities should assist its staff members to understand why AML/CTF measures matter, and know that they play an important role in combatting ML/TF risks.
2. Treat the independent review (evaluation) as an opportunity to uncover blind spots. Ensure the AML/CTF program (at least Part A under the current regime) undergoes a comprehensive and rigorous independent evaluation at an appropriate interval. Reporting entities should implement the culture of embracing the ‘rigour and challenge’ that AUSTRAC expects, and promptly act on findings.
3. Consider conducting a ‘pulse check’. Reporting entities may wish to stay ahead of the curve by conducting a readiness review (in response to the new regime) or how best to allocate change management efforts to implement the upcoming updates on the horizon. Even a light-touch, informal review, for example, on KYC procedures, documentation and recording retention practice in accordance with the AML/CTF laws often help with spotting unnoticed room for improvement.
4. Review ML/TF (and PF) risk assessments. Revisit the ML/TF risk assessment at least annually and whenever there are significant changes (new products, markets, or regulatory developments). Reporting entities should ensure its business or strategic goals remain within an appropriate and acceptable level of risk, pursuant to the enterprise risk management framework there may be.
5. Review management oversight and governance practice. Reporting entities should be able to ‘demonstrate’ its documented policies and procedures are operating effectively in practice, including governance and management oversight. AUSTRAC has shown that high staff turnover, lack of local regulatory expertise and/or lack of oversight by management will be noticed.

Stay ahead with Dentons

Dentons is one of the only firms with specialist expertise and a dedicated Financial Services Regulatory team. If you need help navigating through the ever-evolving regulatory landscape, we are here to help.

1. See https://www.austrac.gov.au/about-us/amlctf-reform/future-law-compilation-amlctf-act
2. Draft AML/CTF Act, s 26F(4)(f)(ii).
3. See https://www.austrac.gov.au/business/core-guidance/amlctf-programs/independent-reviews
4. Explanatory Statement to the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025; Draft AML/CTF Act, s 5.
5. Merciful Group Inc v Norfina Ltd (t/as Suncorp Bank) [2025] NSWSC 841 at [78].
6. Merciful Group Inc v Norfina Ltd (t/as Suncorp Bank) [2025] NSWSC 841 at [83].
7. AUSTRAC 2025-26 Regulatory Priorities, see AUSTRAC regulatory expectations and priorities for 2025–26 | AUSTRAC