AML Governance: Three Roles in a Small Firm

The AML/CTF Act names three governance roles: the governing body, the senior manager and the AML/CTF compliance officer. In a small real estate agency, law practice, accounting firm or conveyancing business, one person, often the principal, can hold all three. Each role keeps its own duties even when one person holds them all. Tranche 2 obligations commenced on 1 July 2026 and are in force, so the question for a small firm now is who holds which role, and how that is recorded.

TL;DR

• The structure has three roles: the governing body (section 5, oversight under section 26H), the senior manager (section 5, approvals under section 26P) and the compliance officer (section 26J).
• AUSTRAC says that in small businesses one person may perform several or all of the roles.
• Senior manager obligations are personal and cannot be delegated, so the person who approves the risk assessment and policies must actually understand them.
• The compliance officer reports to the governing body at least every 12 months, unless they are the same person, but every other duty of the role still applies.
• Record who holds each role and why, so you can show a supervisor how decisions were made.

Table of Contents

• The three roles the Act names
• Who is the governing body in a small firm?
• The senior manager: approval that cannot be passed on
• The compliance officer: management level, authority and independence
• When one person holds all three roles
• When to separate the roles
• Assigning AML/CTF work to staff beneath the three roles
• Recording who holds which role
• Setting up the program with AML Guard
• FAQ
• Sources

The three roles the Act names

AUSTRAC describes the governance framework as three roles that sit at the first step of building an AML/CTF program. They are separate legal concepts with separate duties, even though a small firm may assign them to the same individual.

The three roles answer different questions. The governing body asks whether the business is managing its risk. The senior manager signs off on what the business has decided to do about it. The compliance officer makes sure that it happens each day.

Who is the governing body in a small firm?

The governing body is the person or group with primary responsibility for governance and executive decisions. In a company, that is usually the board of directors. In a partnership, it is typically the partners. For a sole trader, the Act’s definition in section 5 points to the sole trader personally.

Its duties are broader than many principals expect. According to AUSTRAC’s governance factsheet, the governing body holds ultimate responsibility for executive-level decisions and overall accountability. That includes:

• leading a positive culture of compliance;
• overseeing the AML/CTF program under section 26H;
• making sure the compliance officer has adequate resources.

AUSTRAC also stresses that governance is not static: the governing body must keep policies aligned with current risk assessments and respond as new or emerging ML/TF risks appear. When the compliance officer finds that business practices or resourcing need to change, there should be a clear route for that to reach the governing body.

The detail of how oversight works in practice is a subject of its own. For this article, the point is identification: you need to be able to name who the governing body is, and to show that they have taken on these responsibilities.

The senior manager: approval that cannot be passed on

The Act defines a senior manager as someone who takes part in decisions affecting the whole or a substantial part of the business. In a small firm, that is often the principal, a partner or a director, and it may be the same person as the governing body. A practice manager or head of sales could also qualify if they genuinely take part in whole-of-business decisions, but the title alone does not decide it.

The senior manager’s work is concentrated at the point where the program is adopted:

1. Approving the business-wide ML/TF risk assessment (section 26P).
2. Approving the AML/CTF policies (section 26P).
3. Making the decisions the AML/CTF Rules 2025 assign to a senior manager under Rules 5-5.

The key feature is that these obligations cannot be handed to someone else. AUSTRAC’s guidance on the role treats them as personal and non-delegable, and expects active involvement rather than passive oversight. A signature on a document the approver has not read does not meet the standard. A senior manager should be able to explain, if asked, why the risk assessment rates certain services or customer types as it does and why the policies respond to those ratings.

This is also why the order of work matters. The risk assessment comes first, the policies respond to it, and the senior manager approves both. If you want to see what the risk assessment should contain for an agency, our guide to AML risk assessment for real estate agencies walks through it, and the companion piece on AML/CTF policies in Australia explains what the policies must cover.

The compliance officer: management level, authority and independence

The compliance officer is the person responsible for the day-to-day coordination of the program. Under section 26J, the role must be filled by someone at management level, and the business must make sure that person has authority, independence and access to the resources and information they need.

According to the AUSTRAC factsheet, the compliance officer is also the primary contact for AUSTRAC and reports to the governing body at least every 12 months. Rules 5-7 sets out that reporting requirement.

The person must also be fit and proper. AUSTRAC’s compliance officer page says this involves assessing competence, skills, knowledge, integrity and any potential conflicts of interest before appointment, and reassessing them periodically.

Three practical points follow for a small firm:

• Authority. The officer must be able to act on a problem, for example by pausing a transaction until due diligence is complete, without waiting for permission.
• Independence. The officer should not be placed where they are routinely overruled by commercial pressure. In an agency, this matters most when a sale is close to settling.
• Resources. Time counts as a resource. A compliance officer who is also the top-selling agent needs protected hours for the role.

The duties of the officer, including what the annual report should say, are covered separately. Here, the question is who should be appointed.

When one person holds all three roles

Small firms are not expected to invent a layered hierarchy. On its page for sole traders and micro businesses, AUSTRAC says that in many cases “you’ll have just one person fulfil all the governance roles”. The same page explains that a person acting in all three roles does not need to report to themselves, but they remain responsible for the other duties of those roles.

That last point is the one most often missed. Combining the roles removes the internal reporting step. It does not remove:

• the oversight duties of the governing body;
• the personal approvals of the senior manager;
• the authority, independence and resource requirements for the compliance officer.

AUSTRAC’s guidance for these businesses also asks for records that reasonably demonstrate compliance, such as key decisions and actions in developing, maintaining and following the policies. It adds that you stay accountable even where you outsource AML/CTF functions. In practice, a short record, with the date you adopted the risk assessment and policies, who approved them, and what you decided about resourcing, serves you well.

An example: a three-person agency

Consider an agency with a principal who is also the sole director, a licensed sales agent, and an office administrator. A workable arrangement might be:

• Governing body: the principal, as sole director.
• Senior manager: the principal, who approves the risk assessment and policies after reading them.
• Compliance officer: the principal, or the senior agent if the principal prefers to separate the roles and the agent has the standing and time.

If the principal takes all three, no annual report to the governing body is needed, but the principal should still note each year that they reviewed the program and resourcing. If the senior agent becomes compliance officer, the arrangement changes: the agent now reports to the principal at least every 12 months, and the principal must make sure the agent has the authority, independence and resources to do the job. That means protected time and the ability to raise a concern about a client without it counting against a sale.

Neither option is more compliant than the other. The better choice is the one the firm can sustain, and that you can explain to a supervisor.

When to separate the roles

The Act permits combining roles. It does not require it, and growth often makes separation sensible. Reasons to split the roles include:

• the principal has no time for daily compliance coordination;
• the firm has several offices or partners with different areas of responsibility;
• someone with stronger compliance skills is available as a compliance officer;
• the compliance officer role would otherwise sit with someone whose commercial targets conflict with it.

When separating roles, make the lines of communication explicit. The compliance officer needs a way to reach the governing body directly, and the senior manager needs enough information from the compliance officer to approve changes in a considered way.

Assigning AML/CTF work to staff beneath the three roles

The three governance roles are the top of the structure. Other staff also carry AML/CTF tasks, such as collecting identity documents, escalating unusual behaviour and preparing reports for the compliance officer. AUSTRAC’s real estate starter kit tells agencies to assign AML/CTF roles to staff, conduct personnel due diligence, plan training, and tailor the program to the business model, services, customers and risks.

Two requirements apply to every person with a role:

• Suitability before assignment. Agencies must assess personnel suitability and competence before they perform AML/CTF roles, and provide role-appropriate training, with refreshers as required.
• Training that fits the work. AUSTRAC’s examples describe generic or online-only training that does not cover industry-specific ML/TF risks as poor practice that may fail to meet obligations. Staff who handle high-value property transactions need to recognise suspicious activity in that setting.

Our guide to AML training for real estate covers what an agency should include.

AUSTRAC also says that the risk assessment steps, policies, internal reviews and independent evaluations must be appropriate to the nature, size and complexity of the business. That principle is what allows a small firm to run a lean structure, provided each duty is covered.

Recording who holds which role

A governance structure that exists only in someone’s head is difficult to defend. A supervisor reviewing a small firm will want to see that the roles were assigned deliberately and that the people in them did the work. A simple register should capture:

1. The name and position of the person in each of the three roles, and the date each started.
2. The basis for treating them as the governing body, senior manager or compliance officer.
3. The fit and proper assessment for the compliance officer, and the date of each reassessment.
4. The dates the senior manager approved the risk assessment and policies, and any later changes.
5. The date and content of the compliance officer’s report to the governing body, or a note that the roles are held by one person and the annual review was completed.

Program records have their own retention clock. AUSTRAC’s record keeping overview says program records must be kept until 7 years after they are no longer relevant to demonstrating compliance. That means a role assignment from the first year of the regime may still need to be available well after the person has left. Our article on AML record keeping and the seven-year clocks sets out the three retention periods side by side.

Our view: structure is only as strong as the program beneath it

We built AML Guard for Australian Tranche 2 reporting entities, and the most common governance problem we see is not a missing role. It is a role-holder approving documents that do not fit together. A senior manager signs a risk assessment, then a policy set copied from somewhere else, then a training manual that refers to neither.

Our approach is to produce the program through guided wizards. They produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so the policies start from the risks you assessed. We think that is what lets a senior manager approve with confidence, and what a downloaded template cannot give.

The platform automates lookups and record keeping, not judgement. AML Guard keeps one case record holding each identity check, screening result and officer decision, so for a small firm where one person holds all three roles there is a dated trail of decisions, which is what AUSTRAC asks sole traders and micro businesses to keep.

AML Guard

Setting up the program with AML Guard

If you are the person holding one or more of these roles, the quickest way to turn the structure into evidence is to produce the program in one pass. AML Guard is an AML/CTF compliance platform built for Australian real estate agencies, buyers agents, developers, conveyancers, law firms, accounting practices and trust and company service providers. Its guided wizards produce the program, and each customer’s identity checks, screening results and officer decisions sit in one case record.

AML Guard is not self-service; every firm starts with a demo. Book a demo, or see the pricing page for the subscription and per-check fees.

FAQ

Can one person be the governing body, senior manager and compliance officer?

Yes. AUSTRAC states that in many small businesses a single person fulfils all three roles. That person does not need to report to themselves, but they remain responsible for the duties attached to each role, including approvals, oversight and the authority and resources the compliance officer needs.

Can a senior manager delegate approval of the risk assessment and policies?

No. AUSTRAC treats these obligations as personal and non-delegable. Someone else can prepare the documents, but the senior manager must be actively involved in approving them, which means understanding what they say and why.

How often does the compliance officer report to the governing body?

At least every 12 months under Rules 5-7. If the compliance officer is also the governing body, the report is not required as a separate step, though the review itself is still good practice to record.

Does the compliance officer have to be an employee?

The Act requires the role to be held by someone at management level with authority, independence and resources, and the person must be fit and proper. AUSTRAC also says you remain accountable where you outsource AML/CTF functions, so confirm the arrangement against AUSTRAC’s compliance officer page before relying on it.

Sources

• AUSTRAC: AML/CTF governance factsheet
• AUSTRAC: Governing body
• AUSTRAC: Senior manager
• AUSTRAC: AML/CTF compliance officer
• AUSTRAC: Governance and oversight for sole traders and micro businesses
• AUSTRAC: Step 1, customise your real estate program
• AUSTRAC: Step 2, use your real estate program
• AUSTRAC: Examples of personnel due diligence and training
• AUSTRAC: Your AML/CTF program overview
• AUSTRAC: Record keeping overview

Recommended

• AML Compliance Failures in Australia: 7 Patterns
• AML governance dashboards: what a board needs
• AML risk assessment template for Tranche 2 firms