Top 20 Questions on Australia’s AML/CTF Reforms (2026 Guide)

1. What is the reason for increased AML/CTF compliance obligations?

These AML/CTF changes have been designed to be more focused on outcomes than processes, requiring ongoing monitoring that can recognise changes in behaviour. While these changes and complying with them may feel overwhelming, it’s important to stay focused on the ‘why’ behind the new requirements. These changes aim to dismantle financial crime networks and help prevent future harm in customer relationships.

2. What does it mean that AUSTRAC will be focusing on outcomes, not processes?

Neil Jeans, Partner, Risk Consulting, Grant Thornton, said, “If you look at all the regulatory action that AUSTRAC has taken, it’s not about who the customer claims to be, it’s what they do and that is where the risk lies. I would suggest there’s an increased focus in the new regime on that activity and I think there’s an increased expectation that AUSTRAC will be expecting you to focus on that.” This means there is a need to shift to monitoring customer behaviour, not just verifying identities.

3. What is the AML Amendment Act 2026 and what are the main changes?

The AML Amendment Bill 2026 is a legislative update to anti-money laundering and counter-terrorism financing (AML/CTF) rules to close gaps, expand scope and strengthen supervision by AUSTRAC. A major change under Tranche 2 reforms is a shift to risk-based controls, with stronger enforcement and broader sector coverage. The new laws expand regulation into new industries, including accounting, legal, real estate, and trust and company services businesses.

4. What are the main changes to AML/CTF requirements?

Some of the other key changes include clarified customer due diligence (CDD) and ongoing monitoring, enhanced politically exposed persons (PEP)/sanctions/adverse media screening, and more explicit beneficial ownership verification. There are also expanded requirements for reporting and record keeping, as well as event-driven and periodic reviews.

5. How can organisations balance AML compliance with privacy requirements?

For some organisations, especially non-reporting entities, there can be conflicting challenges between the requirements to hold personal information for AML compliance, alongside either industry specific codes or Privacy Act obligations around how much information is appropriate. Again, the overall theme of the new AML/CTF regulations being more about outcomes than process came through in the discussions of how panellists are addressing these at times contradictory objectives. As a non-reporting entity, James Wu, Head of Fraud & Identity, Telstra Consumer is familiar with the juggling act this can sometimes present, saying, “It’s really around the convergence of the two and how do we balance the need to meet both. They’re very different regulatory philosophies, with one about having data availability, the other one having sort of data minimisation overall. For us, it’s about working and trying to delineate the intent behind the two.”

6. The new AML/CTF regulations are more focused on outcomes and not ticking a box. How are organisations changing their operations to reflect this shift?

The panellists for the KYC session recognised the need to bring boards and executives up to speed on the AML journey, with the need for more hands-on collaboration across the business. Axl Gad, Head of Compliance at NOW Finance says this starts with a strong understanding of your products, your target market and the risks associated with that. “There’s a need to build controls and put in barriers to understand where things are going to be triggered, but at the same time, you don’t want to adversely affect your customers that are legitimate,” he said. This means also having thorough training for staff on the types of behaviours to watch out for, with comprehensive reporting so you can continually learn and develop your processes over time.

7. How do you drive cross-industry collaboration on AML/CTF when you’re regulated by different rules?

A key challenge discussed was the potential downstream impacts of identity fraud. For example, someone sets up a mobile phone account and uses that to create an identity, and then goes on to establish fraudulent loans with a financial institution. James Wu from Telstra used the example of cross-industry collaboration on scam prevention as an effective approach for responding as a multi-party ecosystem. “We recognise that identity documents are a problem across the industry, so we’re looking at things like biometrics or face matching, but also getting close to our partners in the banking sector and starting to really rely on digital identity verification for onboarding of customers,” said James. In return, organisations like telcos can provide validation of customer behaviour, like this individual has been a customer for a certain number of years, and doesn’t appear to be engaged in suspicious activity, which all helps support the shift to an outcome-based focus.

8. KYC is not just about verifying who customers are, it’s also about asking what they do. How do you win the trust and confidence of consumers to provide you the information required for AML/CTF compliance?

Neil Jeans, Partner, Risk Consulting, Grant Thornton, says this is about communicating the benefits to customers, like faster access to services, greater security and fraud risk management. “Part of the conversation we need to start having with consumers is that we can use this data to help protect you. We can identify the risks and we can pick up the phone to a client and say ‘We’ve identified an unusual pattern, are you sure it’s you?’” Few people would complain about that “and it’s about selling the message that this integrated environment can protect you and your hard-earned money.”

9. What does KYC monitoring look like in real life with the new AML/CTF regulations? How should organisations be using technologies like AI?

With increased compliance comes the need to embrace technology, with an audience member commenting that past approaches of checklists and people-intensive processes are no longer sustainable in today’s world. The panel discussed AI being both a threat and a tool, with Axl Gad saying “With AI, there’s the risk of people maliciously using it to amend payslips and ID, but at the same time, it is a really good tool for organisations to analyse data, like who’s applying with you, what channels, loan payout rates and transaction monitoring. There’s only so much you can do as a person, but using AI to bring it all together helps a lot.” 

10. How can you identify gaps in your frontline processes that can lead to future AML/CTF compliance problems? 

A common challenge is balancing the desire for fast customer onboarding against robust processes that can ensure resilience against financial crime threats. The risk can come from treating things in isolation and not effectively connecting the dots. Organisations may benefit from asking: how has a customer’s risk profile evolved since onboarding, and did we miss early warning signs that turned a low-risk customer into a high-risk one?

11. Why is it important to shift the KYB focus from simplified ownership verification to control centric verification? 

A major change of the new AML/CTF requirements is enhanced due diligence on the operational control of businesses. Using third-party data can help uncover who actually makes key decisions, rather than relying solely on official company disclosures.

12. What can entities do to strengthen their KYB processes?

By combining multiple data sources, entities can improve their capacity to spot inconsistencies and help identify shadow directors, foreign politically exposed persons (PEP) or other bad actors. It is about connecting all documents to spot missing details that might otherwise go unnoticed.

13. How can entities balance speed, safety and risk when onboarding?

AML/CTF compliance is a constant juggling act between reducing friction for the vast majority of good customers with as much automated real-time decisioning as possible, while also identifying the risks of fraud and financial crime. The solution can lie in using trusted third-party data. While this data must be verified, unverified sources can also be useful to introduce friction early on and flag potential risks.

14. How can AML/CTF compliance keep pace with rapidly changing criminal threats?

A major challenge is that financial crime is constantly evolving, meaning AML/CTF approaches must continuously adapt to address emerging threats. This means shifting from static, isolated systems to a dynamic model. By taking an integrated approach to financial crime, improving collaboration, and sharing information, organisations can better support efforts to disrupt criminal activity within our communities.

15. What are the changes around employee due diligence?

One of the major changes under the new AML/CTF requirements is a widening of the umbrella of what is considered an employee. The new terminology is now Know Your Personnel (KYP) and has widened the scope of the people within your organisation who need to be screened. Entities need to evaluate risk broadly across their organisation, identifying key risk points, decision-makers, and control measures while balancing thorough due diligence with practical risk management to counter internal threats.

16. With increased personnel screening, how should organisations respond if a ‘good apple’ gets flagged?

Again, under the reforms, this comes back to evaluating risk and remaining focused on outcomes rather than process. Claire Brown, Principal, KHQ Lawyers, said “There’s two questions. First is, how do you handle that from an AML/CTF perspective? And there’s a question of how do you handle that from an employment law perspective? To answer the first one, it comes back to ‘what is the risk here?’ If they’ve been declared bankrupt, what is their role? What is the trigger? What are we doing in relation to that and their integrity and their capability to perform that role? We can put other controls and mechanisms around it, or we can reduce their responsibilities, or we can change checking mechanisms that may mean they stay in their role. Or it may mean they leave their role or the organisation, and that’s when you have questions about is that a lawful dismissal?” Ultimately, it means assessing the risk and determining the consequences of that risk, which can also come down to the context of the individual, their situation and their honesty.

17. How should organisations manage KYP issues where team members are not cooperative?

If someone gets flagged under KYP checks and is not cooperative, how should an entity respond? Employees may claim that they have the right to silence or to not answer, but according to Claire Brown, Principal, KHQ Lawyers, “Arguably in the employment relationship, they don’t. There’s an underlying duty that all employees have to be honest and faithful and act in the best interest of their employer, even if those interests are maybe adverse to their own.”

18. There is an obligation for ongoing training under the new AML/CTF requirements. How can organisations make training more effective?

Our panelists agreed that short, bite-sized learning is a key strategy, with training both in official onboarding and then embedded into training programs over the year, similar to approaches used in workplace safety training. “One of the things I’ve seen a lot in blue collar sectors that I work with in the safety space is that day-to-day embedding. At the start of meetings, we have a discussion about workplace safety, and if that is just constantly reinforced, it sort of lifts it off the page and that helps,” said Claire Brown, Principal, KHQ Lawyers.

19. How can organisations, particularly smaller businesses, manage ongoing monitoring and alerting?

For some of the key sectors impacted by Tranche 2 changes, like small real estate, legal and accounting firms, the requirement for ongoing employee screening and due diligence can feel like a significant burden. Our panellists were in agreement that for small businesses, the steps have to be reasonable and pragmatic, but it’s important to remember the ‘why’ behind these changes, and that smaller businesses can be more exposed. For smaller businesses, it can be about making sure you understand the training requirements and ensuring that KYP is prioritized as much as KYC and KYB, forming an essential part of the process.

20. I’m a small business and I know all of my team, do I really need to do these ongoing KYP checks?

Claire Brown, Principal, KHQ Lawyers says it’s important to remember the reasons behind these changes. “Fundamentally, we’re trying to stop people engaging in drug trafficking and all sorts of other horrendous crimes. So although yes, it may be difficult to comply, it’s arguably where there’s a greater need because there will be that knowledge that people aren’t really doing what you need to be doing, so you’re the ones I might target to help me through this transaction.” She highlighted examples of  young people being recruited intentionally via platforms like WhatsApp to target small businesses. “I don’t think a lot of people understand that it’s not training my employee who might inadvertently make a mistake, but there might actually be people who are being put in jobs with that very intent.”

Get the support you need for addressing the entire AML/CTF landscape

Equifax can help support your organisation in bringing together relevant data for initial AML/CTF compliance and ongoing monitoring across KYC, KYB and KYP.

If you have any other questions or need help determining the right solution for your needs, reach out to our team for help.

===============================