Outsourcing AML/CTF Functions & Managing Key Compliance Risks for Australian Businesses

Introduction

Under the reformed AML/CTF framework, which commenced in stages on 31 March 2026 for existing reporting entities and 1 July 2026 for newly regulated entities providing tranche-two designated services, Australian reporting entities may outsource functions including customer due diligence, customer monitoring and reporting. However, outsourcing does not, by itself, transfer statutory obligations, responsibility or liability under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (‘AML/CTF Act’) or the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth) (‘AML/CTF Rules’).

This article outlines the legal and compliance risks of using external providers, including inadequate oversight, reporting failures and restricted information sharing. It also distinguishes ordinary outsourcing from formal reliance on another entity’s customer identification procedures and summarises practical controls recommended by Australian Transaction Reports and Analysis Centre (AUSTRAC).

Interactive Tool: Check Your AML/CTF Outsourcing Compliance Risks & Gaps

What AML/CTF Functions Can Australian Reporting Entities Outsource?

Which AML/CTF Functions Can Be Outsourced?

Reporting entities can engage third parties to perform AML/CTF functions on their behalf, either on a one-off or ongoing basis, and the provider does not need to be another reporting entity. Commonly outsourced functions include:

• developing an AML/CTF program, often as a one-off engagement before the business starts providing a designated service;
• conducting customer due diligence;
• customer and transaction monitoring;
• preparing suspicious matter reports and other reporting; and
• record-keeping and other administrative support, including reviewing or improving existing reporting, transaction monitoring and record-keeping functions.

Importantly, outsourcing a function does not outsource the obligation, as explained below. Any outsourced service should also be tailored to the reporting entity’s own ML/TF risks rather than adopted from a generic or global template, for the reasons set out in the key risks section.

Distinguishing Outsourcing from Formal Reliance Arrangements

Where a third party collects and verifies KYC information on the reporting entity’s behalf, Section 37 of the AML/CTF Act allows this to be carried out by an agent of the reporting entity. Formal reliance, however, is different. Under the AML/CTF Act:

• Section 37A of the AML/CTF Act permits a reporting entity, subject to the statutory conditions, to rely on another person’s collection and verification of customer KYC information, or other prescribed procedures, under a written agreement or arrangement that satisfies the applicable requirements in Rule 6-29 of the AML/CTF Rules;
• Section 37B of the AML/CTF Act requires regular assessments of arrangements covered by Section 37A, at the times prescribed by the AML/CTF Rules, and a written record of each assessment within 10 business days after its completion; and
• Section 38 of the AML/CTF Act deals with reliance in other circumstances.

Legal Responsibility for Outsourced AML/CTF Functions

Retaining Statutory Liability

Outsourcing an AML/CTF function does not, by itself, discharge the reporting entity’s statutory obligations under the AML/CTF Act or the AML/CTF Rules.

In particular, Section 26G of the AML/CTF Act requires a reporting entity to comply with its AML/CTF policies, while Section 41(2) requires it to report suspicious matters when the statutory conditions are met. Similarly, AUSTRAC’s outsourcing guidance explains that reporting entities remain responsible for managing their compliance risks when using external providers.

As a result, the reporting entity generally remains legally liable for any breach of its AML/CTF obligations, even where the breach arises from an outsourced function, and may incur any resulting penalty. A contract with the service provider can allocate tasks, performance standards and remedial steps, but it cannot remove the reporting entity’s statutory responsibility for compliance.

The Role of the Governing Body & Senior Management

Under Section 26H(1) of the AML/CTF Act, the governing body must exercise appropriate ongoing oversight of the reporting entity’s identification and assessment of ML/TF risks and its compliance with its AML/CTF policies, the AML/CTF Act, the regulations and the AML/CTF Rules.

It must also take reasonable steps to ensure that the reporting entity appropriately identifies, assesses, manages and mitigates the money laundering, terrorism financing and proliferation financing risks it may reasonably face in providing its designated services. Importantly, if the governing body fails to meet these requirements under Section 26H(1), the reporting entity itself contravenes Section 26H(2) of the AML/CTF Act, and Section 26H(3) makes that contravention a civil penalty provision.

Under Section 26P(1), a senior manager of the reporting entity must approve its ML/TF risk assessment and AML/CTF policies, including updates to either.

Beyond these statutory requirements, AUSTRAC’s outsourcing guidance expects the outsourcing procedures in the AML/CTF program to record:

• who oversees the arrangement and is accountable for it;
• how the arrangement is resourced and monitored;
• how reports reach senior management; and
• how non-compliance is addressed and remediated.

For AFSL holders and APRA-regulated entities, our Service Provider (Outsourcing) Policy Template (APRA & ASIC | AFSL) documents how material service provider arrangements are overseen.

Key Risks of Outsourcing AML/CTF Functions for Australian Businesses

Inadequate Customer Due Diligence & Transaction Monitoring

Outsourced customer due diligence and transaction monitoring may fail when procedures are generic or not based on the reporting entity’s specific ML/TF risk assessment. AUSTRAC guidance identifies the use of template or global AML/CTF programs without appropriate amendments as a source of serious and systemic compliance failures.

Tailoring matters because ML/TF risk depends on the features of the particular business. A provider applying a generic process may monitor for irrelevant indicators while missing suspicious activity linked to the reporting entity’s:

• customer types;
• designated services;
• delivery methods; or
• jurisdictions, including any foreign jurisdictions.

As a result, these gaps can leave the following insufficiently assessed:

• customer identity;
• beneficial ownership;
• source of funds; or
• unusual behaviour.

They may also result in missed suspicious matter reporting obligations under Section 41(2) of the AML/CTF Act, where the statutory conditions for reporting are met. In that case, the reporting entity must submit the report within the applicable statutory timeframe: generally three business days after forming the relevant suspicion, or 24 hours where the suspicion relates to the financing of terrorism.

Inexperienced or Unsuitable Service Providers

A provider may lack the expertise, qualifications or resources needed to perform AML/CTF functions accurately. In particular, risks increase where the provider:

• has limited knowledge of Australian AML/CTF requirements; or
• does not understand the reporting entity’s industry, customer base and ML/TF risks.

A provider without this understanding is also more likely to supply a generic or template product, creating the gaps described above. The due diligence steps below are designed to identify these weaknesses before the provider is engaged.

Information Sharing, Privacy & Tipping-Off Risks

Sharing information with an external provider may create tipping-off and privacy risks. Under Section 123(1) of the AML/CTF Act, a reporting entity, its officers, employees or agents, and certain other specified persons commit an offence if they disclose information covered by Section 123(2) to another person (other than an AUSTRAC entrusted person) and the disclosure would or could reasonably be expected to prejudice a relevant investigation.

Under Section 123(1), the maximum penalty is imprisonment for two years, 120 penalty units, or both. The offence is therefore not a general prohibition on all disclosures of AML/CTF information.

For these purposes, protected information includes information about:

• a suspicious matter report;
• a report prepared for submission; or
• a requirement to provide information to AUSTRAC.

That said, a disclosure to an external provider is not automatically prohibited by Section 123 of the AML/CTF Act, but it must be assessed against the elements of that offence and any applicable exceptions.

In particular, the fact that a disclosure supports AML/CTF compliance does not, by itself, establish that it is lawful. 

Inadequate Oversight & Governance

Unclear responsibilities can prevent a reporting entity from identifying poor performance, emerging ML/TF risks or failures in outsourced processes. Weak escalation arrangements may also delay action when the provider:

• misses performance targets;
• fails to report suspected non-compliance; or
• cannot support required records.

These gaps also have governance consequences. As explained above, Section 26H of the AML/CTF Act requires the governing body to maintain ongoing oversight of the reporting entity’s identification and assessment of ML/TF risks and its compliance with its AML/CTF policies.

Because outsourced functions still form part of that compliance, weak oversight of the provider can undermine the governing body’s ability to meet this obligation. The contractual terms and monitoring practices that address this risk are covered in the agreement and monitoring sections below.

Conducting Due Diligence on AML/CTF Outsourcing Providers

Assessing the Suitability of an Outsourcing Provider

AUSTRAC recommends assessing whether a provider has the experience, qualifications, expertise and resources needed for the relevant AML/CTF functions. The assessment should consider whether the provider understands the reporting entity’s industry, business model and specific ML/TF risks.

In practice, useful checks may include:

• Requesting a demonstration of the provider’s services and systems to test its technical capability;
• Asking how its solution will be tailored to the reporting entity’s customers, designated services, delivery methods and jurisdictions, and how it will use the entity’s ML/TF risk assessment;
• Verifying relevant qualifications, resourcing and performance history; and
• Obtaining references from similar businesses, including references not selected by the provider where possible.

A provider that can offer only a generic or template product, without a clear explanation of how it will be adapted, is a warning sign for the risks described above. AUSTRAC also recommends confirming that the provider is willing to accept performance monitoring and procedures for addressing breaches, which should then be reflected in the outsourcing agreement.

When Do Statutory Personnel Due Diligence Requirements Apply?

The provider checks above reflect AUSTRAC’s recommendations for screening an outsourcing provider. They are separate from the statutory personnel due diligence requirements. Under Section 26F(4)(d) of the AML/CTF Act, a reporting entity’s AML/CTF policies must address due diligence in relation to persons employed or otherwise engaged by the reporting entity.

However, whether personnel employed by an external service provider fall within this requirement depends on the engagement arrangements; their involvement in an outsourced service does not, by itself, establish that they are engaged by the reporting entity.

In turn, Rule 5-8 of the AML/CTF Rules specifies the personnel due diligence requirements that the reporting entity’s AML/CTF policies must address, including assessment of each relevant person’s:

• skills, knowledge and expertise relevant to their AML/CTF responsibilities; and
• integrity.

Importantly, the assessment must occur before the person is employed or engaged and during that engagement.

Essential Elements of an AML/CTF Outsourcing Agreement

The outsourcing agreement records what the parties have agreed before or during engagement: the provider’s responsibilities and performance standards, its reporting obligations, the reporting entity’s access rights and the procedures that apply if things go wrong. How the reporting entity uses these terms once the arrangement is operating is covered in the monitoring section below.

Establishing Clear Responsibilities & Performance Targets

AUSTRAC’s guidance on outsourcing recommends documenting the AML/CTF services the provider will perform, the person within the reporting entity responsible for oversight and the arrangements for monitoring and addressing non-compliance. A written agreement can help establish the provider’s responsibilities and performance standards, complementing the internal oversight arrangements recorded in the AML/CTF program.

However, a written and legally binding outsourcing agreement is not a universal statutory requirement merely because AML/CTF functions are outsourced, although a written agreement or arrangement is required for reliance under Section 37A of the AML/CTF Act. The agreement can also state:

• whether the arrangement is ongoing or one-off; and
• how the services fit within business processes.

In addition, performance targets should set clear quality and timeliness standards. To document the tailoring expectations tested during due diligence, the agreement can also require the provider to apply the reporting entity’s own ML/TF risk assessment and AML/CTF policies, and to update its processes when those documents change.

Reporting Obligations, Access Rights & Breach Procedures

The agreement should document the reporting and quality assurance arrangements that will apply. AUSTRAC’s outsourcing guidance expects outsourcing agreements to include appropriate mechanisms for verifying whether the provider is meeting agreed performance targets. For example, these may require the provider to:

• provide periodic performance reports in an agreed format and frequency;
• document its work;
• give the reporting entity access to records and provider-held data when requested;
• report suspected non-compliance and emerging ML/TF risks within agreed timeframes; and
• cooperate with scheduled independent evaluations of the outsourcing arrangement and the associated ML/TF risks, where applicable.

The agreement should also set out proportionate responses to failures, including:

• a required timeframe for correcting a breach;
• suspension while deficiencies are addressed; and
• termination for serious or systemic non-compliance.

As a general starting point to adapt for AML/CTF services, our Outsourcing Agreement Template (Australia) covers service levels, audit and exit terms.

Finally, record-keeping arrangements should support the reporting entity’s own record-keeping obligations. These terms do not monitor the provider by themselves; they give the reporting entity the contractual rights it will rely on once the arrangement is operating.

Monitoring Outsourced AML/CTF Functions & Managing Breaches

Once the arrangement is operating, the focus shifts from what the agreement says to what the reporting entity actually does: checking the provider’s performance, identifying failures, investigating problems and responding to them.

Ongoing Performance Reviews & Quality Assurance

AUSTRAC’s outsourcing guidance expects reporting entities to monitor and review ongoing outsourcing arrangements at regular periodic intervals, rather than only after an incident. In particular, reviews should check:

• whether the provider meets agreed performance targets;
• whether the reporting entity continues to meet its AML/CTF obligations; and
• whether changes to ML/TF risks require adjustments to the arrangement.

Using the reporting and record-access rights in the agreement, review procedures may include:

• reviewing the provider’s periodic performance reports against the agreed standards;
• examining the provider’s documented procedures;
• sampling customer identification and verification work; and
• comparing expected outcomes with actual outcomes, including the number and content of suspicious matter reports.

These checks, together with any problems the provider reports under the agreement, help the reporting entity identify failures early. Findings should then flow through the oversight and reporting lines recorded in the AML/CTF program, so that senior management and the governing body can act on them.

Responding to Compliance Failures & Regulatory Liability

A failure by an outsourced provider should be investigated promptly to identify whether the issue arose from the arrangement, an incorrect ML/TF risk assessment or another cause. From there, the reporting entity should escalate relevant breaches to senior management or its governing body, assess the effect on affected functions and implement corrective steps.

The reporting entity should then decide which of the contractual remedies in the agreement to use. Consistent with AUSTRAC’s recommendation that responses be proportionate, the choice between remediation within a set timeframe, suspension and termination should reflect how serious and how persistent the failure is.

Where the provider is required to remediate, the reporting entity should track the remediation to completion and re-test the affected function before treating the issue as resolved.

Contractual remedies address the provider’s performance, but not the reporting entity’s own exposure. Because statutory liability remains with the reporting entity (see Retaining Statutory Liability above), corrective steps should also address the compliance consequences of the failure itself, such as affected customer records or reports.

Conclusion

Outsourcing can provide access to specialist AML/CTF knowledge, but it does not, by itself, discharge a reporting entity’s obligations under the AML/CTF Act or the AML/CTF Rules.

In practice, this means identifying the risks of outsourcing, testing a provider’s suitability and approach to tailoring before engagement, recording expectations and remedies in the agreement, controlling information sharing, and then actively reviewing performance and responding promptly to failures. These controls reflect AUSTRAC’s outsourcing guidance and should be distinguished from the specific requirements imposed by the AML/CTF Act and the AML/CTF Rules.

With these controls in place, reporting entities can manage outsourcing risks while maintaining their AML/CTF obligations. Contact Click Legal’s AML/CTF compliance lawyers for advice on outsourcing arrangements to request a consultation and obtain clear commercial advice suited to the business’s needs.

Frequently Asked Questions