What is in an AML/CTF program?
Your program is the set of policies, procedures and controls that manage your risk. The Act lists what the policies must deal with, including naming an AML/CTF compliance officer, naming senior managers who approve the policies and risk assessment, checking staff before they start, and training them.
It also covers independent evaluations, at least once every 3 years.
Remember
- Compliance officer and senior managers are named in the program.
- Staff checks and training are part of it.
- Independent evaluation at least every 3 years.
Facts and sources for this part
- The Act (section 26F(4)(b) and (c)) says the AML/CTF policies must deal with "designating an AML/CTF compliance officer" and "designating one or more senior managers of the reporting entity as responsible for approving" the AML/CTF policies and the ML/TF risk assessment. [S3]
- The Act (section 26F(4)(d)) says the policies must deal with "undertaking due diligence in relation to persons who are, or will be, employed or otherwise engaged by the reporting entity" and who perform AML/CTF functions. [S3]
- The Act (section 26F(4)(f)) says independent evaluations of the AML/CTF program must happen "at least once every 3 years". [S3]
- The Act (section 26F(4)(e)) says the AML/CTF policies must deal with "providing training to persons who are employed or otherwise engaged by the reporting entity and who perform, or will perform, functions relevant to the reporting entity’s obligations under this Act in relation to: (i) the risk of money laundering, financing of terrorism and proliferation financing that the reporting entity may reasonably face in providing its designated services; and (ii) the obligations imposed by this Act, the regulations and the AML/CTF Rules on the reporting entity;". [S3]
What does the compliance officer do?
The AML/CTF compliance officer oversees and coordinates day-to-day compliance. AUSTRAC says they must report to the governing body at least once every 12 months, and must be at management level and a fit and proper person.
They must be appointed within 28 days of providing designated services, and AUSTRAC must be told within 14 days of the appointment.
Remember
- Oversees day-to-day compliance.
- Reports to the governing body at least yearly.
- Appointed within 28 days; AUSTRAC told within 14 days.
Facts and sources for this part
- AUSTRAC: the AML/CTF compliance officer "must also oversee and coordinate your day-to-day compliance" with the Act, the Rules and the regulations. [S19]
- AUSTRAC: the compliance officer must "give reports to their governing body at least once every 12 months on AML/CTF compliance". [S19]
- AUSTRAC: "You must appoint an AML/CTF compliance officer within 28 days of providing designated services. You must also notify us within 14 days of the appointment". [S19]
- AUSTRAC: the compliance officer must be employed or engaged at management level, and be a fit and proper person. [S19]
What do senior managers do?
A senior manager makes, or helps make, decisions that affect all or a substantial part of the business. The senior manager approves the AML/CTF policies and the risk assessment, and must do so personally. They cannot hand it to someone else.
Senior managers need appropriate training too. A busy owner is not exempt.
Remember
- Approves the policies and risk assessment personally.
- Cannot delegate those approvals.
- Needs training like everyone else in a relevant role.
Facts and sources for this part
- AUSTRAC: "A senior manager is an individual who makes, or is involved in making, decisions affecting all or a substantial part of your business." [S20]
- AUSTRAC: "A senior manager must fulfil these obligations personally. They can’t delegate them." [S20]
- AUSTRAC: a senior manager "will still need to be able to meet their AML/CTF obligations and receive appropriate training". [S20]
What about the governing body?
If the business is not an individual, the policies must make sure the governing body is sufficiently informed of the money laundering, terrorism financing and proliferation financing risks the business may reasonably face.
In practice, that means the compliance officer’s yearly report, and training that lets the board or partners understand it.
Remember
- The governing body must be kept informed of the risks.
- Training for the governing body is part of the plan.
Facts and sources for this part
- The Act (section 26F(4)(a)) says that if the business is not an individual, its policies must deal with "ensuring its governing body is sufficiently informed of the risks of money laundering, financing of terrorism and proliferation financing". [S3]
- AUSTRAC: the compliance officer must "give reports to their governing body at least once every 12 months on AML/CTF compliance". [S19]
How often should these roles be trained?
AUSTRAC gives examples, not rules: compliance officers and senior management every 6 to 12 months, and customer-facing staff every 12 months. It says the frequency depends on what the person does and the risks, and must be appropriate to your business.
Train people before they take on new duties, and when the law or your risks change.
Remember
- Examples: 6 to 12 months for these roles; 12 months for customer-facing staff.
- Your plan sets the real frequency.
- Train before new duties.
Facts and sources for this part
- AUSTRAC gives examples (not rules) of how often to train: compliance officers and senior management every 6-12 months, customer-facing personnel every 12 months. [S1]
- AUSTRAC says its frequency examples "are examples only, and the frequency you deliver training must be appropriate to your business". [S1]
- AUSTRAC: "The frequency and extent of ongoing training will depend on functions the person performs and the ML/TF risks." [S1]
- AUSTRAC expects training "before any personnel conduct new duties that may expose them to other ML/TF risks and AML/CTF functions". [S1]
High-risk roles
AUSTRAC asks businesses to spot high-risk roles and tailor training and checks to them. Roles that can override internal controls or handle large cash amounts are in that group.
If your role can bypass a control, expect more training, more checks and a closer look.
Remember
- Roles that can override controls or handle cash are high-risk.
- Higher risk means more training and checks.
Facts and sources for this part
- AUSTRAC: high-risk roles include those that can "override or bypass internal controls" or "handle high value transactions and physical currency (cash)". [S5]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
What does the AML/CTF compliance officer do?
Show the answer
Right answer: C, Oversees and coordinates day-to-day compliance. AUSTRAC says the compliance officer must oversee and coordinate day-to-day compliance with the Act, Rules and regulations. [S19]
Question 2 of 3
Which is a requirement for the compliance officer?
Show the answer
Right answer: B, Employed or engaged at management level and a fit and proper person. AUSTRAC says the officer must be employed or engaged at management level and be a fit and proper person. [S19]
Question 3 of 3
Does a senior manager need AML/CTF training?
Show the answer
Right answer: A, Yes; they must be able to meet their obligations and receive appropriate training. AUSTRAC says a senior manager will still need to be able to meet their obligations and receive appropriate training. [S20]