AUSTRAC’s Enforcement Tools Explained: Remedial Directions, Enforceable Undertakings & Civil Penalties

Introduction

If your business is a reporting entity under Australia’s AML/CTF regime, it’s easy to assume the Australian Transaction Reports and Analysis Centre (AUSTRAC) enforcement follows a single, predictable path from warning to penalty. Remedial directions, enforceable undertakings, and civil penalties are distinct tools AUSTRAC can use separately or together.

This article explains how each tool works, when AUSTRAC may use it, and what it means for your business so you can respond with clarity.

Interactive Tool: Check Your AUSTRAC Enforcement Risk & Next Step

Understanding AUSTRAC's Remedial Directions

What Can a Remedial Direction Require?

A remedial direction is a written direction that the AUSTRAC CEO may give to a reporting entity where, under Section 191(1) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), the AUSTRAC CEO is satisfied that the entity has contravened, or is contravening, a civil penalty provision apart from Section 191(4). Under Section 191(2)(a), the direction can require the entity to take specified action to prevent the same contravention, or a likely contravention, from happening again.

The required action may include:

• Administrative systems – implementing effective systems to monitor compliance with the relevant civil penalty provision.
• Staff knowledge and training – implementing a system that gives officers, employees and agents a reasonable understanding of the requirements affecting them.
• Outstanding reports – for specified reporting failures, submitting the required report to the AUSTRAC CEO within the period stated in the direction.

Non-Compliance with Remedial Directions

A reporting entity must not contravene a remedial direction given under Section 191(2) of the AML/CTF Act. Section 191(4) creates that obligation, while Section 191(5) makes the contravention itself a civil penalty provision.

Ignoring the direction can therefore create a separate enforcement problem. The original compliance failure may remain unresolved, while the failure to follow the written direction gives AUSTRAC a further basis to seek a civil penalty order.

Understanding Enforceable Undertakings Given to AUSTRAC

What Can an Enforceable Undertaking Require?

An enforceable undertaking is a written commitment offered by a person and accepted by the AUSTRAC CEO under Section 197 of the AML/CTF Act. The commitment must be expressed to be an undertaking under Section 197, and may require the person to:

• take specified action;
• refrain from specified action; or
• take steps directed towards preventing future contraventions.

The undertaking can therefore address both the original compliance issue and the systems needed to prevent it happening again. Under Section 197(3) of the AML/CTF Act, the person may withdraw or vary the undertaking only with the AUSTRAC CEO's consent, while Section 197(4) empowers the AUSTRAC CEO to cancel the undertaking by written notice.

Breach of Enforceable Undertaking

A breach can turn a negotiated compliance commitment into Federal Court proceedings. Under Section 198(1) of the AML/CTF Act, the AUSTRAC CEO may apply to the Federal Court if the undertaking remains in force and the AUSTRAC CEO considers that the person has breached it.

Under Section 198(2) of the AML/CTF Act, the Federal Court may order the person to:

• comply with the undertaking;
• pay the Commonwealth up to the financial benefit obtained directly or indirectly from the breach;
• compensate another person for loss or damage; or
• comply with another order the Court considers appropriate.

The risk is not limited to failing to complete the promised action; the breach can create additional court-ordered financial and compliance consequences.

When Can AUSTRAC Seek Civil Penalties Against Your Business?

Who Decides Whether a Civil Penalty Is Imposed?

The AUSTRAC CEO cannot itself make a civil penalty order under Division 2 of Part 15 of the AML/CTF Act. Under Section 176(1), only the AUSTRAC CEO may apply to the Federal Court for a civil penalty order. Section 175(1) gives the Federal Court the power to decide whether a person contravened a civil penalty provision and whether a pecuniary penalty should be paid to the Commonwealth.

The Federal Court makes that decision using the civil evidence and procedure rules under Section 179. This separation matters for a reporting entity because an AUSTRAC application is not the final penalty: liability and the amount payable are determined by the Court.

How Large Can AML/CTF Civil Penalties Be?

The maximum exposure is substantial. Under Section 175(4) of the AML/CTF Act, the maximum pecuniary penalty payable for a contravention by a body corporate is 100,000 penalty units, while Section 175(5) sets a maximum of 20,000 penalty units for a person besides a body corporate. Where the same conduct contravenes two or more civil penalty provisions, Section 175(6) provides that the person is not liable to more than one pecuniary penalty under Section 175 for that same conduct.

For contraventions occurring on or after 1 July 2026, one penalty unit is valued at $364, under Section 4AA of the Crimes Act 1914 (Cth). The Federal Court must consider relevant matters under Section 175(3) of the AML/CTF Act, including:

• the nature and extent of the contravention;
• the nature and extent of any loss or damage caused;
• the circumstances in which it occurred; and
• similar previous conduct found by an Australian or, where appropriate, foreign court.

A civil penalty order becomes a civil debt payable to the Commonwealth under Section 175(7) of the AML/CTF Act, so poor AML/CTF controls can create a significant financial liability for the business.

Differences Between Enforcement Tools & AUSTRAC's Decision Process

Remediation Versus Punishment

As a practical distinction, the three tools serve different purposes:

• Remedial directions and enforceable undertakings are mainly directed at changing conduct, correcting failures and supporting future compliance.
• Civil penalty proceedings can result in a Federal Court order requiring payment to the Commonwealth.

Can AUSTRAC Use More Than One Enforcement Tool

AUSTRAC's enforcement tools do not operate as a fixed escalation ladder. A reporting entity does not necessarily receive a remedial direction first, followed by an enforceable undertaking and then civil penalty proceedings.

Depending on the circumstances, AUSTRAC may:

• pursue remediation;
• seek civil penalty orders; or
• use more than one enforcement mechanism at the same time.

Treating these tools as strictly sequential can leave a business unprepared for the possibility that compliance measures and financial proceedings may overlap.

How AUSTRAC Decides What Enforcement Action to Take

As a matter of regulatory approach, AUSTRAC uses a risk-based process when deciding whether formal enforcement action is appropriate and which response best fits the conduct. Its assessment may consider:

• The nature of the non-compliance – including the seriousness of the breach and whether it appears isolated or widespread.
• ML/TF risk – including whether the conduct exposed the reporting entity or the financial system to criminal abuse.
• Willingness to comply – including the entity's compliance history, engagement with AUSTRAC and efforts to identify, manage and reduce ML/TF risks.

AUSTRAC may also consider whether the reporting entity voluntarily disclosed the issue and what effect the proposed action is likely to have on the entity and the wider reporting-entity population. Voluntary disclosure does not prevent formal enforcement action, although AUSTRAC states that it may be relevant to the decision and any penalty.

Examples of AUSTRAC Enforcement Action Against Australian Businesses

Recent Civil Penalty Proceedings

AUSTRAC's published proceedings show that civil penalty action can involve both large institutions and smaller reporting entities. The Federal Court ordered:

• Westpac Banking Corporation ('Westpac') to pay $1.3 billion in October 2020;
• Crown to pay $450 million in July 2023; and
• SkyCity Adelaide to pay $67 million in June 2024.

More recent proceedings include AUSTRAC's application against Mount Pritchard and District Community Club on 30 July 2025, concerning alleged serious and systemic non-compliance.

In May 2026, after each entity admitted failing to lodge its 2023 compliance report, the Federal Court ordered:

• Castra Licensee to pay a $50,000 pecuniary penalty and $15,000 in costs; and
• Princeton Securities (NSW) to pay $45,000 and $5,000 in costs.

Ongoing & Concluded Enforceable Undertakings

AUSTRAC publishes enforceable undertakings so reporting entities can see the actions businesses have committed to take or stop. The published examples include:

• Hillside (Australia New Media) Pty Limited trading as bet365, listed as ongoing in 2026; and
• Bank of Queensland Ltd, listed as ongoing from 2023.

Concluded undertakings include:

• Sportsbet Pty Ltd, which commenced an undertaking in 2024;
• Cryptolink Pty Ltd;
• Gold Corporation;
• PayPal Australia Pty Ltd; and
• Cash Converters.

For a reporting entity, the practical consequence is that an undertaking is not merely a private promise: it creates specific commitments and may place the business under continuing public scrutiny.

Issuance of Remedial Directions

AUSTRAC also publishes remedial directions requiring reporting entities to take specified actions to comply with AML/CTF requirements. The published examples include:

• a direction issued to Australian Military Bank Ltd in 2021; and
• earlier directions involving:
  • ClassicBet Pty Ltd;
  • Acacia Ridge Hotel;
  • Allsafe International Pty Ltd; and
  • Little Persia.

As noted earlier, a remedial direction can require future compliance changes or the submission of an outstanding report, and breaching it is itself a civil penalty provision.

Practical Steps for Reporting Entities If AUSTRAC Identifies Compliance Failures

Immediate Assessment & Remediation Steps

A reporting entity should assess the failure promptly, identify the ML/TF risks involved, and begin correcting the underlying issue. When deciding whether enforcement action is appropriate, AUSTRAC considers the entity's willingness and effort to comply, including its demonstrated efforts to:

• identify;
• manage; and
• reduce ML/TF risks.

The entity should document the steps taken and address both isolated errors and broader weaknesses in its AML/CTF systems with advice from AML/CTF compliance lawyers at Click Legal. Delayed or incomplete remediation can make it harder to demonstrate a genuine effort to comply when AUSTRAC assesses the seriousness, circumstances, and likely consequences of the non-compliance.

Engaging with Regulators & Seeking Legal Advice

A reporting entity should escalate the issue through its internal governance channels and engage constructively with AUSTRAC. AUSTRAC's approach is to maintain an ongoing and positive relationship with a reporting entity after formal enforcement action begins, where appropriate, while continuing activities directed at managing ML/TF risks.

Professional legal advice can help the entity respond to AUSTRAC, assess the compliance failure, and deal with the relevant AML/CTF requirements. Voluntary disclosure does not prevent enforcement action, but AUSTRAC considers it when deciding how to respond, and it may also be relevant to any penalty if formal action follows.

To help assess your current compliance framework and identify potential gaps before regulatory intervention, download the AML/CTF Compliance Checklist (Free).

Conclusion

AUSTRAC can use remedial directions to require corrective action, accept enforceable undertakings setting out agreed commitments, or apply to the Federal Court for civil penalty orders that may impose serious financial consequences. These tools are not fixed stages, so reporting entities should treat AML/CTF compliance as an ongoing responsibility involving governance, reporting, risk management and documented remediation.

If your business is facing AUSTRAC scrutiny or reviewing its AML/CTF framework, consider contacting Click Legal’s AML/CTF compliance lawyers. Click Legal helps reporting entities build compliance arrangements that are legally sound, properly documented and consistent with how the business operates.

Frequently Asked Questions