Outsourcing AML/CTF compliance: what you can hand off
What a Tranche 2 business can hand to a provider under the AML/CTF Act, what the law keeps with the firm, and how outsourcing differs from reliance.
Most of the work of anti-money laundering and counter-terrorism financing (AML/CTF) compliance can be done by someone outside your firm. An adviser can write your program, a provider can run your client checks, and your compliance officer can be engaged rather than employed. What can't leave the firm is the obligation. AUSTRAC's outsourcing guidance says that if you outsource AML/CTF functions, you remain responsible for complying with the AML/CTF Act and Rules. Your business generally remains legally liable for any breach, and you incur any penalty that follows.
This page is for accountants and the other Tranche 2 businesses regulated by AUSTRAC since 1 July 2026. It sets out the three legal routes for getting outside help, which functions a provider can take on and what stays with you, and what AUSTRAC expects before and during an outsourcing arrangement. What each way of complying costs is in four ways to comply, compared on cost.
Outsourcing, agency and reliance are different things
Outsourcing, agency and reliance compared
| Route | Who can do the work | What it covers | What you need | Who carries the risk |
|---|---|---|---|---|
| Outsourcing | Any third party. It doesn’t need to be a reporting entity | AML/CTF functions, once (such as writing your program) or ongoing (customer due diligence, monitoring, reporting) | Due diligence on the provider before you start. AUSTRAC expects a written agreement with performance targets, and ongoing oversight | Your business, generally, for any breach and any penalty |
| Agency (Act s 37) | Any person you authorise as your agent | Collecting and verifying KYC information about a customer | Your authorisation, under the principles of agency | Your business, not the agent, for civil penalties |
| Reliance (Act ss 37A, 38) | Another reporting entity, or a business regulated under foreign laws that give effect to the FATF Recommendations | KYC information that business has already collected and verified | A written arrangement approved by a senior manager and assessed at least every 2 years, or documented reasons in each case | The Act treats the checks as yours while every condition in the Rules is met |
Sources: AUSTRAC, Using outsourcing to help meet your obligations; AUSTRAC, Overview of reliance on customer identification by a third party; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 37, 37A, 37B, 38); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 5-5, 6-29 to 6-31) Reviewed
The Act and AUSTRAC's guidance treat three kinds of outside help differently, and each comes with its own conditions.
Outsourcing means an arrangement with a third party to carry out AML/CTF functions on your behalf. AUSTRAC describes two kinds: one-time, such as having someone develop your AML/CTF program, and ongoing, such as customer due diligence, monitoring your customers or reporting. The provider doesn't need to be a reporting entity. AUSTRAC's reliance overview adds that in an outsourcing arrangement you remain liable for any breaches of your customer due diligence and record keeping obligations.
Agency is in section 37 of the Act. You can authorise another person to be your agent for collecting and verifying KYC information about a customer, the steps in section 28(3)(c) and (d). The note to section 37 is plain: the reporting entity, and not its agent, is liable to civil penalties if those steps aren't done.
Reliance is in sections 37A and 38. You rely on KYC information that another business has already collected and verified. One of AUSTRAC's examples is a lawyer and an accountant both acting when a company is set up. The other business must be a reporting entity, or a business regulated under foreign laws that give effect to the FATF Recommendations on customer due diligence and record keeping (Rules ss 6-29 and 6-31). An ongoing reliance arrangement must be in writing and approved by a senior manager (Rules s 5-5(1)(f)). You assess it at least every 2 years, and prepare a written record of each assessment within 10 business days (Act s 37B, Rules s 6-30). Case-by-case reliance under section 38 needs no agreement, but you must document why you believe it is appropriate. While the conditions are met, the Act treats you as having collected and verified the information yourself. It doesn't extend that to the record keeping part of the Act, and a written arrangement must set out who keeps which records.
AUSTRAC says reliance doesn't include a KYC or outsourced service provider, because those businesses aren't subject to oversight and supervision under Australia's AML/CTF laws. Its outsourcing guidance also leaves out four things: services from another member of your reporting group, an independent evaluation of your program, software you use to meet your obligations in-house, and government databases such as the DFAT Consolidated List.
What you can hand off, and what stays with you
The table covers the main functions. "A provider can" is what the Act or AUSTRAC's guidance allows someone outside the firm to do. The last column is what the law keeps with your business, or with a named role in it.
| Function | A provider can | What stays with your business |
|---|---|---|
| Writing your money laundering and terrorism financing (ML/TF) risk assessment and AML/CTF policies | Draft them for you, as a one-off service | A senior manager approves both, and every update (Act s 26P). AUSTRAC expects you not to adopt a template or global program without amending it |
| Customer due diligence | Collect and verify KYC information, as your agent (s 37) or an outsourced provider | Identifying each customer's ML/TF risk (s 28(3)(b)) isn't covered by agency or reliance, and you must not start the service until each matter is established (s 28(1)). A senior manager approves foreign politically exposed persons (PEPs) and high-risk domestic or international organisation PEPs (Rules s 5-5) |
| Monitoring your customers | Run it on an ongoing basis | AUSTRAC calls it critical that this rests on your own ML/TF risk assessment and the suspicious activity indicators relevant to your business |
| Reporting to AUSTRAC | Carry out reporting on an ongoing basis, which AUSTRAC lists as a function you can outsource | A suspicious matter reporting obligation arises for your business (s 41). Your policies must make what you report complete and accurate (Rules s 5-11), and must guard against tipping off (Rules s 5-13) |
| AML/CTF compliance officer | Be engaged from outside the firm | You check the person is at management level, fit and proper, and resident in Australia where that applies (s 26J), and you keep records of how they meet those requirements |
| Senior manager approvals | Nothing. AUSTRAC says a senior manager must fulfil these obligations personally and can't delegate them | Approving the risk assessment, the policies, high-risk PEPs and any written reliance arrangement |
| Governing body oversight | Not the role itself, which belongs to whoever has primary responsibility for your governance and executive decisions (s 5) | Ongoing oversight of your risk assessment and compliance, and reasonable steps to make sure the business complies (s 26H) |
| Independent evaluation | Carry it out, as an external evaluator | Choosing an evaluator who is independent and suitable. AUSTRAC expects that person not to have developed or to maintain your program |
Key point
Under Australia's AML/CTF Act, a business that outsources AML/CTF functions remains responsible for its obligations, and generally remains liable for any breach and any penalty.
The three governance roles
- Who stays liable
- Your businessGenerally, for any breach under an outsourcing arrangement, and any penalty. For an agent’s customer checks, the reporting entity and not the agent (s 37)
- Compliance officer
- Can be engaged, not employedAt management level, fit and proper, and resident in Australia if you provide designated services through an Australian establishment (s 26J)
- Designate and notify
- Within 28 days, then tell AUSTRAC within 1428 days from first providing a designated service (s 26K), 14 days from the designation (s 26M)
- Senior manager approvals
- Personal, not delegatedThe risk assessment, policies and updates (s 26P), high-risk PEPs and written reliance arrangements (Rules s 5-5)
- Compliance officer reports
- At least once every 12 monthsTo the governing body (Rules s 5-7)
- Reliance arrangements
- Assessed at least every 2 yearsWith a written record within 10 business days of each assessment (s 37B, Rules s 6-30)
- Independent evaluation
- At least once every 3 yearsAUSTRAC expects the evaluator not to have developed or to maintain your program (s 26F(4)(f))
Sources: AUSTRAC, Using outsourcing to help meet your obligations; AUSTRAC, AML/CTF compliance officer; AUSTRAC, Senior manager; AUSTRAC, Step 5: Conduct an independent evaluation; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26F, 26J, 26K, 26M, 26P, 37, 37B); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (ss 5-5, 5-7, 6-30) Reviewed
The Act sets three governance roles: the governing body, a senior manager and the AML/CTF compliance officer. AUSTRAC's guidance for sole traders and micro businesses says one person often holds all three. It also says you can outsource governance roles, though you don't have to, and that if you do, you are still responsible for making sure the provider meets the requirements of the role.
The compliance officer can come from outside
Section 26J requires the compliance officer to be employed or otherwise engaged by your business at management level, with enough authority, independence and access to resources and information to do the job. They must be resident in Australia if you provide designated services through a permanent establishment here, and they must be fit and proper. AUSTRAC's compliance officer guidance says the officer doesn't need to be an employee, but an external one must have the authority, resources and expertise to perform the role. You designate one within 28 days of first providing a designated service (s 26K) and notify AUSTRAC within 14 days of the designation (s 26M).
Two points matter when the officer comes from a provider. The role is to oversee and coordinate others who carry out the obligations, so the work itself still needs people inside the firm. And among its examples of a conflict of interest to weigh in the fit and proper test, AUSTRAC names an officer who acts as the compliance officer of multiple other businesses, and one with interests in an AML/CTF software company. The officer reports to your governing body at least once every 12 months (Rules s 5-7), and AUSTRAC expects them to keep control over what those reports say.
Senior manager approvals can't be delegated
A senior manager is an individual who makes, or takes part in making, decisions that affect the whole or a substantial part of your business (Act s 5). AUSTRAC's senior manager guidance says they must fulfil these obligations personally and can't delegate them. They approve your ML/TF risk assessment and AML/CTF policies and every update (s 26P). They also approve starting a service for a foreign PEP, or for a high-risk customer who is a domestic or international organisation PEP, and entering into a written reliance arrangement (Rules s 5-5). A provider can draft your program, but a senior manager approves it, personally.
The governing body oversees
Your governing body is the individual or group with primary responsibility for the business's governance and executive decisions (s 5). AUSTRAC says that may be the board in a larger business and the owner in a smaller one. Under section 26H it must oversee your risk assessment and your compliance, and take reasonable steps to make sure the business manages its risks and complies. For outsourcing, AUSTRAC expects you to document how the governing body and senior management oversee the arrangements, receive reports on the risks they create and resolve non-compliance.
Independent evaluation: not by whoever built the program
Your policies must provide for an independent evaluation of your AML/CTF program at least once every 3 years (Act s 26F(4)(f)). The evaluator can be internal or external. AUSTRAC expects them not to be involved in developing your program, systems and controls, not to be responsible for implementing or maintaining it, and not to be your compliance officer or part of the compliance team. On those expectations, the provider that wrote your program, or the one acting as your compliance officer, shouldn't also evaluate it. The evaluator's written report goes to your governing body and to the senior manager who approves the program (Rules s 5-10).
What AUSTRAC expects from an outsourcing arrangement
Managing an outsourcing arrangement, in order
From AUSTRAC’s outsourcing guidance, for any reporting entity
- Step 1
Identify the risks
Check the outsourcing fits the risk assessment your senior manager approved.
- Step 2
Do due diligence on the provider
Experience, qualifications, a demonstration and references.
- Step 3
Know the limits on sharing
Tipping off is a criminal offence. Privacy law can apply too.
- Step 4
Put it in writing
Services, performance targets, oversight and what happens on a breach.
- Step 5
Monitor and review
Provider reports, sample checks and expected against actual outcomes.
- Step 6
Document it in your AML/CTF program
A senior manager approves the update.
Sources: AUSTRAC, Using outsourcing to help meet your obligations; AUSTRAC, Tipping off Reviewed
The outsourcing guidance sets out six steps: identify the risks that outsourcing may create, including whether it fits the ML/TF risk assessment your senior manager approved, do due diligence on the provider, understand the legal limits on sharing information, use a written agreement, monitor and review the arrangement, and document all of it in your AML/CTF program.
- Check the provider first. You must do appropriate due diligence before you enter the arrangement, and meet your personnel due diligence obligations for the people you engage to perform AML/CTF functions. AUSTRAC suggests a demonstration, an explanation of how the provider will tailor the service to your business, checks of their qualifications, resourcing and track record, and references, including from businesses the provider didn't suggest.
- Avoid generic programs. AUSTRAC expects you not to use a template or global program without amending it, and warns that doing so could lead to serious and systemic compliance failures. A good sign is a provider that develops its solution after consulting you about your customers, services, delivery methods and the countries you deal with.
- Put it in writing. At a minimum, AUSTRAC expects an agreement that sets out the services and performance targets, gives you a way to check they are being met, and deals with what happens if the work isn't done properly. It suggests naming the person in your business who oversees the agreement, and including a business continuity plan, who owns and controls any data the provider holds (and whether you can share it with regulators), and how you will act on independent evaluation findings.
- Protect information about reports. Disclosing certain information, such as the fact that you lodged a suspicious matter report, where it would or could reasonably be expected to prejudice an investigation is the criminal offence of tipping off (Act s 123). Your arrangements must not involve unauthorised disclosure of that information, and AUSTRAC suggests legal advice where they might. Privacy law can also limit what you share.
- Keep checking the work. For an ongoing arrangement, AUSTRAC suggests periodic reports from the provider, reviews of random samples of their work, such as how identity checks were carried out, and comparing expected outcomes with actual ones. If a provider monitoring your customers isn't picking up any suspicious activity, AUSTRAC says to look for the cause.
AUSTRAC expects your program to document how you assess the risks of an arrangement, choose a provider, check the service and monitor it, and a senior manager approves that update. AUSTRAC also publishes a sample checklist for engaging an outsourced service provider.
What StackGo does here
StackGo is software, not a compliance service, and it doesn't take on your obligations. In AUSTRAC's terms, using software to meet your obligations in-house isn't outsourcing (AUSTRAC points instead to its guidance on engaging a RegTech). Nor is it reliance, which is only on a reporting entity or a business regulated under foreign laws that follow the FATF Recommendations. Choosing AML/CTF software covers what to ask a vendor.
StackGo's IdentityCheck runs the customer due diligence steps your policies set, from your practice software. An Intake form collects the client's details, documents and consent and creates the client record. Each person completes a biometric ID check, and an Australian company can have business verification and beneficial ownership reports, at extra cost (Verify). Every party is screened against PEP, sanctions and adverse media sources (Screen), your team records a High, Medium or Low rating with the decision (Assess), and Monitor re-screens monitored clients every month.
StackGo doesn't write your program, act as your compliance officer, approve high-risk clients, lodge reports with AUSTRAC or evaluate your program. Those stay with your firm, or with an adviser you engage on the terms above. To see a client checked end to end, book a demo.
Frequently asked questions
Can we outsource our AML/CTF compliance officer?
Yes. The Act allows a compliance officer who is engaged rather than employed, as long as they are at management level, fit and proper, and resident in Australia if you provide designated services through an Australian establishment. You remain responsible for checking they meet those requirements, and for notifying AUSTRAC.
If the provider gets it wrong, who pays?
Generally your business. AUSTRAC says you remain legally liable for any breach under an outsourcing arrangement and incur any penalty. For customer checks done by an agent, the Act says the reporting entity, not the agent, is liable to civil penalties.
Can the firm that wrote our program do our independent evaluation?
AUSTRAC expects your evaluator not to have been involved in developing your program and not to be responsible for maintaining it, so it shouldn't be the same firm.
Is relying on another firm's ID check the same as outsourcing?
No. Reliance under sections 37A or 38 is on another reporting entity or a regulated foreign business, on conditions set by the Rules, and while they are met the Act treats you as having collected and verified the information. Outsourcing can be to any provider, and it doesn't change who has to meet the obligation.
Do we have to outsource anything?
No. AUSTRAC says you can outsource governance roles but that this isn't required. Small practices that meet its criteria can customise AUSTRAC's program starter kit themselves.
Sources
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006, sections 5, 26F, 26H, 26J, 26K, 26L, 26M, 26P, 28, 37, 37A, 37B, 38, 41 and 123 (compilation in force from 1 October 2026)
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025, sections 5-5, 5-7, 5-8, 5-9, 5-10, 5-11, 5-13, 6-29, 6-30 and 6-31 (compilation in force from 31 March 2026)
- AUSTRAC: Using outsourcing to help meet your obligations (updated 13 July 2026)
- AUSTRAC: Overview of reliance on customer identification by a third party (updated 13 October 2026)
- AUSTRAC: Reliance under customer due diligence arrangements (updated 27 March 2026)
- AUSTRAC: Reliance on a case-by-case basis (updated 12 October 2026)
- AUSTRAC: AML/CTF compliance officer (updated 31 March 2026)
- AUSTRAC: Senior manager (updated 25 March 2026)
- AUSTRAC: Governing body (updated 20 October 2026)
- AUSTRAC: Governance and oversight for sole traders and micro businesses (updated 20 October 2026)
- AUSTRAC: Step 5, conduct an independent evaluation (updated 31 March 2026)
- AUSTRAC: Personnel due diligence (updated 13 April 2026)
- AUSTRAC: Tipping off (updated 2 October 2026)