The AML/CTF compliance officer: who can hold the role, what they do and the 28-day and 14-day deadlines

Who can be the compliance officer

Someone employed or engaged by the reporting entity at management level, ordinarily resident in Australia, who is a fit and proper person: that is, someone without a history that would make their judgement on compliance questionable. In a small firm that is almost always a partner, director or the principal. The officer can hold other roles, including fee-earning ones; what they need is the authority to make the firm follow the program and direct access to the governing body.

The deadlines

• Appoint the officer within 28 days of the day the business first provides a designated service.
• Notify AUSTRAC of the appointment within 14 days of making it, through AUSTRAC Online.
• Transitional Rules 2026: businesses enrolled at commencement had until 29 July 2026, or 14 days after enrolling if later, to notify.
• Notify AUSTRAC within 14 days of any change of officer or of their details.

What the role involves

• Owning the AML/CTF program: keeping the risk assessment and policies current, scheduling reviews, taking each version to the senior manager for approval.
• Overseeing customer due diligence: that the policy is followed, that beneficial owners are identified, that high-risk customers get enhanced due diligence.
• Deciding whether a suspicion has formed when staff escalate a concern, lodging SMRs and TTRs within the deadlines, and keeping the records.
• Lodging the annual compliance report and keeping enrolment details current.
• Arranging and recording training and personnel screening.
• Being AUSTRAC's point of contact and keeping the governing body informed.

The first-year task list

The checklist on this page is the officer's first year in twelve items, from confirming designated services to diarising the first independent evaluation. Most of the work is in the first two months: enrolment, the program, the due diligence procedure and the first training session. After that, the role is a few hours a month: new-client ratings, scheduled reviews, the odd escalation, and the annual report in July to September.

Sole practitioners and micro businesses

A sole practitioner is the governing body, the senior manager and the compliance officer at once. AUSTRAC's guidance for sole traders and micro businesses says that is acceptable provided the program records it and the person meets the fit-and-proper requirement. The independent evaluation is the one task that must go to someone else.

Personal responsibility

The reporting entity, not the officer personally, is liable for contraventions. But AUSTRAC expects the officer to have real authority and real time, and its guidance on governing bodies makes clear that partners and directors cannot delegate their oversight away. A firm that appoints a junior staff member with no authority has not met the requirement in substance.