AML/CTF Reform for Existing Reporting Entities: The 31 March 2026 Program Uplift

On 31 March 2026 the AML/CTF program you have run for years stops being the thing AUSTRAC measures you against. What replaces it is not a tougher checklist. It is the absence of a checklist, and that is harder.

Most of the noise about Australia’s AML/CTF reform is aimed at the newly captured sectors, the lawyers, accountants, real estate agents and precious-metal dealers who come into scope for new designated services from 1 July 2026. That is the tranche-two story, and it is real. But there is a quieter deadline three months earlier that lands on everyone already regulated: banks, remitters, digital-currency exchanges, gaming operators, every existing reporting entity. On 31 March 2026 the modernised obligations under the AML/CTF Amendment Act 2024 commence, and the program you carry over unchanged will almost certainly not meet them.

The Part A / Part B scaffolding is gone

For fifteen years the shape of an Australian AML/CTF program was fixed by statute. Part A dealt with identifying and managing money-laundering and terrorism-financing risk; Part B dealt with customer identification. Firms built their documentation, their audits and their board packs around that division because the law told them to. The Amendment Act removes the prescriptive Part A / Part B structure and replaces it with two obligations that are easy to state and hard to satisfy: conduct a money-laundering, terrorism-financing and proliferation-financing risk assessment, and maintain AML/CTF policies that respond to what the assessment found.

Note the third letter. Proliferation financing, the funding of weapons-of-mass-destruction programmes, is now named alongside money laundering and terrorism financing, bringing the regime into line with the FATF standards. If your current risk assessment does not address it, that is a gap you can see today without a consultant.

The removal of the prescribed structure is the point people miss. When the law dictates the headings, a program can be compliant on its face while being inert underneath. Take the scaffolding away and there is nowhere for an inert program to hide. AUSTRAC no longer asks whether you have the required parts. It asks whether your systems and controls actually reduce the risks you face, and expects you to show the working.

What outcomes-based actually demands of the technology

“Outcomes-based” and “risk-based” are easy phrases to nod along to and easy to underestimate. In engineering terms they mean your controls have to be traceable to a stated risk, and the effectiveness of each control has to be observable. That is a different design brief from “implement the mandated rules”.

The risk assessment is the load-bearing artefact. It must, at minimum, weigh the risk posed by your customer types, the designated services you provide, the channels through which you deliver them, and the foreign jurisdictions you touch. Every downstream control, customer due diligence, ongoing monitoring, transaction monitoring thresholds, reporting, should be derivable from it. Where a supervisor finds a monitoring rule that maps to no assessed risk, or an assessed risk that no control addresses, the gap is now visible in a way the old structure blurred.

Transaction monitoring is where this bites hardest for firms with real volume. A rule set tuned years ago to a prior risk view, running on typology assumptions nobody has revisited, is exactly the stale carry-over the reform is built to expose. The uplift is not “add more rules”. It is being able to show why each rule exists, what risk it covers, how often it is reviewed, and what its alert quality tells you about whether it works. That is a data-lineage problem before it is a compliance problem, and it is the same discipline we described in building a BSA/AML program from zero for US investment advisers — the tooling differs, the obligation to trace controls to risk does not.

Governance stops being a signature

The new regime is explicit about who owns what. The governing body, the board or its equivalent, must oversee the AML/CTF program and satisfy itself that risks are being identified and mitigated. A named AML/CTF compliance officer owns the operational implementation. This is not a cosmetic relabelling of the old “AML compliance officer” role. It draws a line between oversight and operation and asks each side to evidence its part.

In practice a supervisor will want to see the board minute where the risk assessment was considered and challenged, not merely received; the compliance officer’s reporting line and authority; and evidence that oversight changed something. A board that approves an unchanged program in thirty minutes has produced a document, not governance. If you have read our work on regulated firms, this is the same evidential bar we set out for a program that has to pass an exam: stated compliance without evidence of operation is the position regulators have stopped accepting.

The date is not a cliff, but do not treat it as soft

AUSTRAC has acknowledged that many existing entities will not have every change fully implemented by 31 March 2026. Its published expectation is that where you cannot fully transition in time, you hold a documented implementation plan: a clear read of your current-state gaps against the new obligations, a timeline with accountability, and how you will keep managing ML/TF risk while you close the distance. That is genuine flexibility on the mechanics. It is not flexibility on the risk. The regulator has been plain that entities ignoring their obligations, or running systems that do not effectively manage risk, will continue to face civil penalty proceedings and, for the registered, cancellation or suspension.

So the honest reading of the deadline is this: on 31 March 2026 you need either a program that meets the new obligations or a credible plan, backed by evidence, showing how you get there and how risk is contained in the meantime. “We did not get to it” is not one of the available positions.

The firms that will struggle are the ones treating this as a documentation refresh, the way some treated the other 2026 reporting deadlines as a form to fill in. Rewriting the program is the visible task. Rebuilding the risk assessment so that every control traces back to it, and retuning monitoring so its effectiveness can be shown rather than asserted, is the real one. Start from the risk assessment. If it is honest, the rest of the uplift tells you what it needs to be.

Sixteen Pillars is a technology governance consultancy based in Cyprus. Engagements run remote across the EU, UK, Middle East and further afield, with on-site time where the engagement requires it.