AML/CTF Independent Review Is Now an Evaluation

If you searched for an independent review for AML, the term has changed. Under the reformed regime, the independent review is now an independent evaluation, and it covers your entire AML/CTF program. For a newly regulated business, such as a real estate agency, conveyancer, law firm or accounting practice, the first evaluation falls due between 30 June 2029 and 31 December 2030, depending on your AUSTRAC account number. This guide explains what the evaluator tests, who qualifies, what you must keep and how to make the exercise straightforward.

TL;DR

• “Independent review” is the pre-reform term. The Act and the AML/CTF Rules 2025 now require an independent evaluation of your whole AML/CTF program.
• Your policies set how often it happens, at least once every 3 years, and you document why you chose that frequency.
• The evaluation must be independent, AUSTRAC expects the evaluator to be suitable too, and the written report goes to your governing body and senior manager.
• Your first evaluation is staggered by the last two digits of your AUSTRAC account number, from 30 June 2029 to 31 December 2030.
• An evaluator can only test what you can show. A linked risk assessment, policy set and decision record makes that testing quicker and cleaner.

Table of Contents

• From independent review to independent evaluation
• What the evaluator tests, area by area
• Who can carry out the evaluation
• Evaluation versus your own internal reviews
• How often, and when your first evaluation is due
• What happens when the report has adverse findings
• Records you must keep
• How to prepare so the evaluation is routine
• Our perspective: one record an evaluator can test
• Putting your evidence in one place
• FAQ
• Sources

From independent review to independent evaluation

Before the reforms, reporting entities arranged an independent review of Part A of their AML/CTF program. The reformed Act replaces that with an independent evaluation of the whole AML/CTF program. From here on, this article uses the new term, because it is the one your policies, your engagement letter and AUSTRAC’s guidance will use.

The change is more than a label. AUSTRAC’s step 5 guidance says an independent evaluation covers how you undertook or reviewed your ML/TF risk assessment, the design of your AML/CTF policies, and whether you appropriately identified, assessed, mitigated and managed your ML/TF risks and complied with your policies. The legal footing is section 26F(4)(f) of the Act and section 5-10 of the AML/CTF Rules 2025.

In practice, the evaluator asks three questions:

1. Was the business-wide ML/TF risk assessment done properly, and does it reflect your customers, services, delivery channels and the countries you deal with?
2. Are the policies designed to manage the risks that assessment identified?
3. Did your people actually follow the policies, and did the risk controls work in real files?

The third question is where gaps are easiest to miss. A well-written policy that staff do not follow is an adverse finding, not a defence.

What the evaluator tests, area by area

The risk assessment

The evaluator looks at the method, not only the conclusion. Did you consider the right risk factors? Is the reasoning recorded? Was the assessment updated when your business changed, for example when you started acting for overseas buyers or took on a new service line? If your risk ratings cannot be traced to stated reasoning, the evaluator has little to test.

The design of the policies

Policies should respond to the risks you rated, rather than sit beside them. If your assessment rates cash-funded or offshore-funded purchases as high risk, an evaluator should be able to find the enhanced customer due diligence (CDD) policy that follows from that rating. A mismatch between the two documents is the kind of gap an evaluator is there to find.

Whether the policies worked in practice

This is the testing phase. Expect the evaluator to sample customer files and ask for:

• identity verification records and the basis for each risk rating;
• beneficial ownership determinations for company customers;
• sanctions and PEP screening results, including re-screening;
• suspicious matter and threshold transaction reporting decisions;
• training completion records for staff;
• evidence of what your governing body and senior manager did with earlier reports.

For property work, sample files will include buyers who are companies, trusts or foreign residents. If you act for overseas purchasers, our guide to overseas buyer AML checks sets out what a defensible file looks like. To see how the conveyancing side of a purchase is handled by a law practice, this explainer on buying Australian property from Singapore is a useful reference for the transaction context your evaluator will be sampling.

Who can carry out the evaluation

The evaluation must be independent, and AUSTRAC expects your AML/CTF policies to set out how you will decide that an evaluator is both independent and suitable. Those two words do real work.

Independent means the evaluator can work free of bias, influence and conflicts of interest. AUSTRAC expects an independent evaluator not to be responsible for implementing or maintaining the program, not to be involved in developing it or assessing its ML/TF risks, and to be independent of the work areas being evaluated. If a consultant wrote your policies, that consultant is a poor choice to evaluate them. The same goes for your AML/CTF compliance officer or a member of the compliance team.

Suitable means the evaluator can judge an AML/CTF program. AUSTRAC says there are no mandatory qualifications, but it expects the evaluator to know the AML/CTF obligations that apply to your business and to have enough experience of your sector and its ML/TF risks. Experience in evaluating the effectiveness of controls and in reporting findings also helps. The evaluator can be internal, such as a member of an internal audit team, or external, provided independence is real. Document why your chosen evaluator meets both tests, including their credentials and any past involvement with your program.

Small agencies often ask whether this means hiring an expensive outside firm. It does not have to, but a small team has fewer people who are genuinely separate from the program, so an external evaluator is often the simpler way to show independence.

Evaluation versus your own internal reviews

The evaluation is in addition to, not instead of, the reviews you run yourself. Your internal reviews keep the program current: they are triggered by changes in your business or risk environment and by regular cycles. The evaluation gives an objective outside view of whether the program works.

A practical split looks like this:

Both need records. Governed workflow tooling that tracks approvals, tasks and audit controls makes it easier to show an evaluator who decided what and when; this overview of a compliance action layer for legal teams describes one approach. The same principle applies to any compliance record: evidence that was captured at the time of the decision carries more weight than evidence assembled afterwards.

How often, and when your first evaluation is due

Your AML/CTF policies set the frequency. The minimum is at least once every 3 years, and you should document why the frequency you chose suits the nature, size and complexity of your business and your risk profile. A larger agency handling many high-risk transactions may sensibly choose a shorter cycle.

For newly regulated businesses, AUSTRAC’s transitional rules page (Part 7 of the Transitional Rules 2026) staggers the first evaluation by the last two digits of your AUSTRAC account number, which you received when you enrolled:

Treat the date as the latest point by which the first evaluation must be done, and set your policy frequency so the schedule is consistent with it. Businesses that were already regulated and had an independent review under the pre-reform rules follow a different timetable, set out on the same AUSTRAC page.

What happens when the report has adverse findings

The evaluator produces a written report. Section 5-10 of the Rules requires your policies to have it delivered to your governing body and to any senior manager responsible for approvals, and to deal with how you will respond to it. Your governing body and senior manager should record what they did in response. If the report contains adverse findings about your risk assessment, Rules section 5-1 requires you to review that assessment as soon as practicable after your governing body receives the report, and section 5-4 requires your policies to deal with reviewing and updating the policies in response to adverse findings about them. AUSTRAC’s step 4 guidance lists an adverse finding about your risk assessment as a trigger for a review, and its step 5 guidance adds that you must document updates within 14 days after you make them and should keep records of how you addressed each finding, including any you decided not to act on. Your policies should state that procedure in advance: who reviews the findings, how the risk assessment and policies are revised, and how the fix is tracked to completion.

A clean report is useful too, but it is not a reason to stop reviewing: the program must keep pace with your business and the threat environment, and the evaluation is in addition to your own reviews.

Records you must keep

Keep the evaluation evidence together. Under AUSTRAC’s record keeping overview, which refers to section 116(3) of the Act, you keep records related to your AML/CTF program from the time the record is made until 7 years after it is no longer relevant to demonstrating your compliance, so the seven years does not start when the record is created. For evaluations, that means holding:

• the engagement letter and evidence of the evaluator’s independence and suitability;
• the scope and plan of the evaluation;
• the written report;
• governing body and senior manager minutes or decisions on the findings;
• the updated risk assessment and policies, if findings led to changes.

These are the documents AUSTRAC may ask for if it examines your program. Our guide on audit-ready AML files for an AUSTRAC request walks through assembling them.

How to prepare so the evaluation is routine

1. Write the frequency and reasoning into your policies. State the interval and why it fits your business.
2. Choose the evaluator early. Check independence against every person who helped draft or approve your program, and file the evidence.
3. Make sure your documents agree. The risk assessment, policies and training manual should tell one story. Our overview of AML/CTF program documents for Tranche 2 explains how they fit together.
4. Test a sample of your own files first. Pick a handful of recent transactions and check each one for identification, risk rating, screening, beneficial ownership and the approving officer’s decision.
5. Confirm training records. Evaluators look for completion records, not just a manual. See AML training for real estate.
6. Check your CDD against the customer types you actually serve. Our guide to Tranche 2 customer due diligence is a good yardstick.
7. Brief the governing body. They receive the report, so they should know their role before it arrives.

Our perspective: one record an evaluator can test

We built AML Guard for Australian Tranche 2 reporting entities, and the evaluation is the reason we insist on linked documents. Our guided wizards produce the risk assessment, the AML/CTF policies, the compliance action plan and the staff training manual from the same answers. Because they share a source, the policies match the risk assessment and the training manual matches the policies. That is the consistency a supervisor and an evaluator look for, and a set of downloaded templates cannot provide it.

The second half of the evaluation, testing whether the policies were followed, depends on records. An officer reviews each CDD outcome, risk ratings are recorded with the reasoning behind them, and AML Guard’s tamper-evident audit trail holds records for 8 years, above the Act’s seven-year minimum. We automate the lookups and the record keeping. We do not automate the judgement, and we do not think any platform should. Your officers decide, and the record shows they did.

An evaluator working from that record can follow a single file from risk assessment to policy to decision without chasing missing paperwork. That is our view of what makes an evaluation efficient, and it is why we treat evaluation readiness as a design requirement, not a feature.

Putting your evidence in one place

If you want the risk assessment, policies, training records and every CDD decision in a single record, AML Guard is built for that. It covers identity verification with biometric liveness, sanctions, PEP and adverse media screening with re-screening, beneficial ownership determination on a company’s ACN, suspicious matter and threshold transaction reporting workflows, and REX CRM integration. Plan and per-check details are on our pricing page.

FAQ

Is an independent review the same as an independent evaluation?

The independent evaluation is the reformed successor to the independent review. The old review covered only part of your program, whereas the evaluation covers your whole AML/CTF program, including how you did your risk assessment and whether risks were managed. Use the new term in your policies and engagement letters.

Can my compliance officer carry out the evaluation?

Not as a rule. AUSTRAC’s own example of an evaluator who is not independent of the work areas being evaluated is your AML/CTF compliance officer or a member of the compliance team, and an independent evaluator should not be responsible for implementing or maintaining the program or involved in developing it. Document how any evaluator you appoint meets the independence and suitability expectations.

How often do I need an independent evaluation?

Your AML/CTF policies set the frequency, and it must be at least once every 3 years. You should record why that frequency suits your business. Your first evaluation also has a staggered deadline set by your AUSTRAC account number.

Who sees the evaluation report?

The evaluator’s written report goes to your governing body and any senior manager responsible for approving your AML/CTF program. If it contains adverse findings about your risk assessment, you must review the assessment as soon as practicable after your governing body receives the report, and your policies must deal with reviewing and updating the policies in response to adverse findings about them. Keep a record of how you addressed each finding, including any you decided not to act on.

Sources

• Step 5: Conduct an independent evaluation, AUSTRAC
• Step 4: Review and update your AML/CTF program, AUSTRAC
• Record keeping overview, AUSTRAC
• AML/CTF transitional rules 2026, AUSTRAC
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006, Federal Register of Legislation
• Anti-Money Laundering and Counter-Terrorism Financing Rules 2025, Federal Register of Legislation

Recommended

• AML/CTF Program Documents for Tranche 2
• What Is an AML/CTF Program? A Plain-English Guide for Property Professionals
• Which AML/CTF program template should you use in 2026?
• AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026