How Often Should You Conduct an Independent Evaluation: 2026 AML/CTF Reforms Explained

Introduction

For reporting entities, conducting an independent evaluation of their anti-money laundering and counter-terrorism financing (AML/CTF) program is a fundamental compliance obligation. This requirement, mandated under Section 26F(4)(f) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), is crucial for effective risk management and ensuring that policies and procedures are robust enough to combat money laundering and terrorism financing (ML/TF) risks, with effect from 31 March 2026.

Determining the appropriate frequency for these evaluations is a key responsibility that requires a careful balance between meeting legal minimums and applying a tailored, risk-based approach. This guide provides essential information on setting this frequency, navigating the transitional rules for the first evaluation, and documenting the rationale behind your decisions to demonstrate compliance.

Interactive Tool: Check Your AML/CTF Evaluation Deadline & Required Frequency

Understanding the Core Requirement to Conduct an Independent Evaluation

The Mandate Under the AML/CTF Act

Reporting entities are legally required to establish policies for the independent evaluation of their AML/CTF programs. This obligation is detailed in Section 26F(4)(f) of the AML/CTF Act (Cth), as inserted by the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth).

The AML/CTF Act (Cth) specifies that these policies must address how independent evaluations are conducted. This includes setting the frequency for these evaluations, which must satisfy two key conditions:

• It must be appropriate to the nature, size, and complexity of the reporting entity’s business, as required by Section 26F(4)(f)(i).
• It must occur at least once every three years, according to Section 26F(4)(f)(ii).

What an Independent Evaluation Covers

Recent reforms have expanded the scope of what an independent evaluation must cover. Specifically, the new requirements dictate that:

• The evaluation must assess your entire AML/CTF program.
• This replaces the previous system, highlighting the key differences between independent reviews vs independent evaluations, where reporting entities were only required to conduct an independent review of Part A of their AML/CTF program

Setting the Frequency of Independent Evaluations

The Minimum Three-Year Requirement

Under the AML/CTF Act (Cth), reporting entities are subject to a mandatory minimum timeframe for their independent evaluations.

Specifically, Section 26F(4)(f)(ii) of the AML/CTF Act (Cth) specifies that an independent evaluation must be conducted at least once every three years.

Consequently, this establishes a baseline AML/CTF compliance requirement for all businesses, regardless of their individual risk profiles.

A Risk-Based Approach to Determine Frequency

While a three-year cycle is the minimum, the law requires a more tailored approach based on individual circumstances.

According to Section 26F(4)(f)(i) of the AML/CTF Act (Cth), the frequency of your independent evaluation must be appropriate to the specific characteristics of your business.

Reporting entities must therefore determine a suitable schedule for their independent evaluation by considering the following factors:

• The nature of your business, specifically the types of products, services, and customers you deal with.
• The size of your operations, including the scale of your transaction volume and employee numbers.
• The complexity of your organisation, such as the intricacy of your business structure, delivery channels, and operational processes.

Furthermore, the chosen frequency must be formally set out within your AML/CTF policies.

Deadlines for the First Independent Evaluation Under Transitional Rules

Deadlines for Newly Regulated Businesses

The Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026 (Cth) (AML/CTF Transitional Rules) establish specific, staggered deadlines for newly regulated businesses to conduct their first independent evaluation. These deadlines are determined by the last two digits of your AUSTRAC Account Number (AAN), which you receive upon enrolment.

According to Part 7 of the AML/CTF Transitional Rules (Cth), your first independent evaluation must be completed by the following dates:

• 30 June 2029, if both the last two digits of your AAN are odd numbers.
• 31 December 2029, if the second-to-last digit is odd and the last digit is even.
• 30 June 2030, if both the last two digits of your AAN are even numbers.
• 31 December 2030, if the second-to-last digit is even and the last digit is odd.

Deadlines for Existing Regulated Reporting Entities

For reporting entities that were already enrolled with AUSTRAC on 30 March 2026 and have previously conducted at least one independent review, the AML/CTF Transitional Rules (Cth) provide a different method for calculating the deadline. This ensures a smooth transition to the new requirement of evaluating the entire anti-money laundering and counter-terrorism financing program.

Under Part 7 of the AML/CTF Transitional Rules (Cth), your first independent evaluation must be conducted by the later of these two dates:

• Four years after the date of your most recent independent review.
• 31 March 2027.

Documenting & Justifying Independent Evaluation Frequency

The Expectation to Document Your Rationale

Beyond simply setting a schedule, reporting entities are expected by AUSTRAC to document the reasoning behind their chosen frequency for an independent evaluation. This documentation should clearly explain how the decision was reached.

Your rationale must be grounded in the specific characteristics of your business. It involves detailing the factors that influenced your decision, which include:

• The nature of your business operations.
• The size and scale of your activities.
• The complexity of your organisational structure and services.

Legal Obligations for Record Retention

The requirement to maintain records is a formal legal obligation. Under Section 116 of the AML/CTF Act (Cth), reporting entities must keep records necessary to demonstrate compliance with their obligations.

These records, including the documented rationale for your independent evaluation frequency, must be retained for a specific period. Section 116(3) of the AML/CTF Act (Cth) mandates that they be kept for seven years after they are no longer relevant to your compliance obligations.

Conclusion

Reporting entities must establish a frequency for their independent evaluation that is appropriate to their business’s nature, size, and complexity, ensuring it occurs at least every three years as required by the AML/CTF Act (Cth). It is also essential to follow the specific transitional rules for the first evaluation and formally document the rationale for the chosen schedule to demonstrate compliance.

Navigating these AML/CTF obligations requires careful planning and a clear understanding of the legal framework. For trusted expertise in conducting an independent evaluation tailored to your specific risk management needs, contact Click Legal’s specialist AML independent evaluation lawyers to ensure your business remains compliant.