AML compliance officer requirements in Australia
Under Australia’s AML/CTF Act, every reporting entity must designate an AML/CTF compliance officer within 28 days of first providing a designated service. The officer must be at management level, resident in Australia if you operate here, and fit and proper. You then have 14 days to tell AUSTRAC who it is.
This guide is for owners, partners and practice managers at reporting entities, including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. The rules come from the AML/CTF Act, the AML/CTF Rules and AUSTRAC’s own guidance, checked on 21 October 2026.
Who must appoint an AML/CTF compliance officer?
Every reporting entity must designate one individual as its AML/CTF compliance officer, under section 26J of the Act. A reporting entity is any business that provides a designated service listed in the Act.
A business of any size is covered. For a sole trader or micro business, AUSTRAC’s governance guidance for sole traders says one person will often hold all three governance roles: governing body, senior manager and compliance officer.
Who can be the compliance officer?
- Who must appoint
- Every reporting entityOne individual, designated under s 26J
- Appoint by
- Within 28 days of your first designated serviceEach day late is a separate contravention (s 26K)
- Level
- Management levelSet by authority, not direct reports. Can be engaged rather than employed
- Residence
- Resident of AustraliaIf you provide designated services through a permanent establishment in Australia
- Character
- Fit and properDecided before you appoint, against the matters in rule 5-14
- Notify AUSTRAC
- Within 14 days of the appointmentNewly regulated: by 29 July 2026 or 14 days after enrolling, whichever is later
- Report to governing body
- At least once every 12 monthsIn writing (rule 5-7)
Sources: AUSTRAC, AML/CTF compliance officer; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26J, 26K, 26L, 26M); Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (rr 5-7, 5-14) Reviewed
The Act sets three eligibility tests. The person must be employed or engaged at management level, and must be fit and proper. If you provide services through a permanent establishment in Australia, they must also live here.
Management level is about authority, not headcount. AUSTRAC’s compliance officer guidance says a person can be at management level without direct reports. In a smaller business it may be the owner or a director; in a larger one, a risk, operations or general manager.
The officer does not have to be an employee. You can engage an external compliance officer, but they still need the authority, resources and expertise to do the role. You stay responsible for meeting your obligations.
No qualification is prescribed. AUSTRAC says the officer does not need to be an AML/CTF expert, only able to learn your risks and build further skills through training. The Act names no certificate such as CAMS.
What does fit and proper mean?
Before you appoint anyone, you must decide whether they are fit and proper. Rule 5-14 of the AML/CTF Rules lists the matters you must consider:
- their competence, skills, knowledge, diligence, expertise and judgement for the role
- good character, honesty and integrity
- any conviction for a serious offence
- adverse findings in civil, criminal, regulatory or disciplinary proceedings about their management or professional conduct
- whether they are an undischarged bankrupt
- whether they have signed a personal insolvency agreement
- any conflict of interest that creates a material risk they will not do the role properly
Key point
Under Australia’s AML/CTF Act, a reporting entity must decide its AML/CTF compliance officer is fit and proper before appointing them.
This is not a pass or fail checklist, AUSTRAC says. It helps you decide whether the person is fit and proper now. Spent convictions are still protected under Part VIIC of the Crimes Act 1914.
AUSTRAC gives two examples of a conflict. One is an officer with interests in an AML/CTF software company that could sway which screening vendor they pick. The other is an officer acting for several other businesses.
The test is ongoing. AUSTRAC expects you to reassess the officer from time to time so they stay fit and proper.
When do you appoint and notify AUSTRAC?
Appointing and notifying, in order
Australia’s AML/CTF Act, for any reporting entity
- Day 0
First designated service
The 28-day clock to designate a compliance officer starts.
- Before you appoint
Decide they are fit and proper
Consider each matter in rule 5-14 and keep a record.
- Within 28 days
Designate the compliance officer
Each day late is a separate contravention.
- Within 14 days
Notify AUSTRAC
Through the enrolment form in AUSTRAC Online.
Newly regulated: by 29 July 2026 or 14 days after enrolling, whichever is later.
-
Report to the governing body
At least once every 12 months.
Sources: AUSTRAC, AML/CTF compliance officer; AUSTRAC, AML/CTF transitional rules 2026; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26K, 26M) Reviewed
The clock starts when you first provide a designated service. You have 28 days to designate the officer under section 26K, then 14 days from the appointment to notify AUSTRAC under section 26M.
Key point
Under Australia’s AML/CTF Act, a reporting entity must designate an AML/CTF compliance officer within 28 days of first providing a designated service.
Newly regulated businesses get longer to notify. The AML/CTF transitional rules give them until 29 July 2026 or 14 days after enrolling, whichever is later. A business that enrolled on 29 July 2026 has until 12 August 2026.
Businesses already enrolled on 30 March 2026 had to notify AUSTRAC by 30 May 2026. You notify through the enrolment form in AUSTRAC Online, which opened to the new professions on 31 March 2026.
The same steps apply when your officer leaves or becomes ineligible. You must designate someone else within 28 days and tell AUSTRAC. You must always have someone performing the role.
What does the compliance officer do?
The officer oversees and coordinates. They do not have to carry out each obligation themselves, AUSTRAC says, but they must make sure the people who do are doing it.
Under section 26L and the Rules, their functions are to:
- oversee day-to-day compliance with the Act, the Rules and the regulations
- oversee how well your AML/CTF policies work, and whether staff follow them
- communicate with AUSTRAC on your behalf
- report in writing to your governing body at least once every 12 months
That report covers your compliance with your policies, how well they manage your money laundering and terrorism financing (ML/TF) risks, and your compliance with the law. The officer keeps control over its content, so accurate but inconvenient findings reach the governing body.
A sole trader who is both officer and governing body does not report to themselves. The wider AML/CTF obligations the officer oversees include customer screening and reports to AUSTRAC.
What records should you keep?
You must keep records showing you appointed an eligible officer. AUSTRAC expects them to show:
- the name of the person appointed
- the dates they acted as compliance officer
- how they meet each eligibility requirement, including any reassessments
- what you considered, such as open-source searches and credit, reference and police checks
If you suggest changes to a governing body report, AUSTRAC expects them in writing, with the officer’s reasons for accepting or rejecting them.
What happens if you do not appoint one?
Each part of the rule is a civil penalty provision: appointing on time, appointing an eligible person, giving them enough authority and notifying AUSTRAC. A late appointment counts as a separate contravention for each day it is overdue, under section 26K(4).
Under section 175 of the Act, the Federal Court can order up to A$36.4 million per contravention for a company and A$7.28 million for an individual. See our guide to AML non-compliance penalties.
AUSTRAC can also issue an infringement notice for not designating a compliance officer or not notifying it, without going to court.
Frequently asked questions
Does the compliance officer need a qualification such as CAMS?
No. The Act and Rules set no qualification. AUSTRAC says the officer does not need to be an AML/CTF expert, but must have the competence and judgement for your business’s size and risks, and keep learning.
What happens when the compliance officer is on leave?
You do not need to designate someone else for a short absence, AUSTRAC says, if their oversight arrangements keep working. For longer absences, have another eligible person ready to designate quickly.
Can one person be the compliance officer for several businesses?
Within a reporting group, yes, if they meet the eligibility tests for each member. Outside a group, AUSTRAC names acting for several businesses as a possible conflict of interest to weigh in the fit and proper test.
Next steps
Check who is designated today, when you told AUSTRAC and whether your file shows the fit and proper assessment. Real estate agencies can use our real estate compliance officer guide. For the rest of your setup, see the AUSTRAC program starter kits and our AML compliance checklist.
StackGo’s IdentityCheck runs know your customer (KYC) and AML identity checks inside the customer relationship management (CRM) or practice management software your team already uses. Results are written back to the client record. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.
Sources
The facts on this page come from these sources, checked on 21 October 2026.
- AUSTRAC, AML/CTF compliance officer
- AUSTRAC, Governance and oversight for sole traders and micro businesses
- AUSTRAC, AML/CTF transitional rules 2026
- AUSTRAC, AUSTRAC opens enrolment for new professions in next step for AML reforms (31 March 2026)
- AUSTRAC, Consequences of not complying
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26J, 26K, 26L, 26M, 175)
- Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (rr 5-7, 5-14)