The AML/CTF compliance officer

The short answer

1. Choose an eligible person

   An individual at management level who is a resident of Australia and a fit and proper person. s 26J

2. Designate them within 28 days

   Of the day you first provide a designated service, if nobody holds the role yet. s 26K

3. Notify AUSTRAC within 14 days

   Of the designation, in the approved form. s 26M

4. Keep the record

   Of who holds the role, since when, and why they are eligible. s 116 AUSTRAC

5. Report to the governing body

   At least once every 12 months, unless your firm is an individual or the compliance officer is the same person as the governing body. Rules 5-7

Act s 51B the law, read in the authorised textAUSTRAC guidance the regulator's published guidance

The Act calls the role the "AML/CTF compliance officer". Older material often says "AMLCO"; that term is not in the Act.

Who can be the compliance officer

The compliance officer must be one individual, not a firm or a committee.¹ Your firm must make sure that person:²

• is employed or otherwise engaged by the firm at management level; and
• has sufficient authority, independence and access to resources and information to perform the functions effectively.

The person is not eligible unless they:³

• are a resident of Australia, where your firm provides its designated services at or through a permanent establishment in Australia;
• are a fit and proper person; and
• meet any requirements in the Rules.

Designating someone who is not eligible is itself a civil penalty contravention.⁴

What "management level" means. AUSTRAC says it depends on the business and refers to the person's authority, not their title. In a smaller business it may be the owner, a director or the person responsible for managing broader risks or operations, and a person can be at management level without any direct reports.⁵

Fit and proper: the matters you must consider

Before you designate someone, you must have regard to each of these matters:⁶

AUSTRAC adds several practical points:⁵

• Considering these matters "isn't a pass/fail checklist". It helps you decide whether the person is currently fit and proper.
• The compliance officer does not need to be an AML/CTF expert. In a small business, AUSTRAC expects someone with the general skills to learn the firm's risks, who then builds knowledge through training and experience.
• Its examples of conflicts include someone with interests in an AML/CTF software vendor, or someone acting as compliance officer for several other businesses.
• Record what you checked, such as open-source searches, credit checks, reference checks and police checks, and reassess the person periodically.

© AUSTRAC for the Commonwealth of Australia 2026, CC BY 4.0; adapted by AMLCompliant; not endorsed by AUSTRAC.

The 28-day and 14-day rules

If you miss the 28-day deadline, the obligation continues until you designate someone, and each day counts as a separate contravention.⁷ All three duties are civil penalty provisions.⁸ AUSTRAC says you notify it using the enrolment form in AUSTRAC Online, and that the same steps apply if your compliance officer leaves the business.⁵

If the 29 July 2026 enrolment rule applied to you, your first notice was on time if you gave it by the later of 29 July 2026 and 14 days after your name was entered on the Reporting Entities Roll.⁹ That date has passed for firms already enrolled. Every later change of compliance officer follows the ordinary 14-day rule. If your firm has not enrolled at all, read our enrolment guide first.

What the compliance officer does

The Act gives the role these functions:¹⁰

1. to oversee and coordinate the firm's day-to-day compliance with the Act, the regulations and the Rules;
2. to oversee and coordinate the effective operation of, and compliance with, the firm's AML/CTF policies;
3. to communicate with AUSTRAC on the firm's behalf;
4. anything incidental or conducive to those functions, and any function the Rules add.

AUSTRAC says the compliance officer does not need to carry out each obligation personally. The job is to oversee and coordinate the people who do. The functions must still be covered when the compliance officer is on leave or ill. AUSTRAC says that can be done through arrangements the compliance officer puts in place, without designating someone new, and suggests identifying another eligible person who could step in quickly.⁵

Keep the role separate from two others. The governing body must oversee the firm's risk assessment and compliance.¹¹ A senior manager approves the risk assessment and policies and every update.¹² In a small firm one person may hold all three roles.

Reporting to the governing body

Your policies must make sure the governing body receives reports from the compliance officer, at least once every 12 months, on:¹³

• the firm's compliance with its AML/CTF policies;
• how well those policies manage and mitigate the money laundering, terrorism financing and proliferation financing risks the firm may reasonably face; and
• the firm's compliance with the Act, the regulations and the Rules.

AUSTRAC expects these reports, or a record of them, to be in writing and in English. It also expects the compliance officer to keep control of what the reports say. If others suggest changes, AUSTRAC expects the suggestions to be recorded in writing, with the compliance officer's reasons for accepting or rejecting each one.⁵

One-person practices

If your firm is an individual (a sole trader), the governing body is you.¹⁴ The duty to report to the governing body does not apply where the firm is an individual, or where the compliance officer is the same individual who is the governing body.¹⁵ That second limb can cover, for example, a company whose governing body is one director who is also its compliance officer.

AUSTRAC says a person holding all three roles "don't need to report to themselves", but remains responsible for the other duties of each role. It suggests setting aside time to review AML/CTF issues and keeping notes, and recording the version number and approval date on the risk assessment and policies you approve.¹⁶

Outsourcing the role

AUSTRAC says the compliance officer does not need to be an employee, and that you can outsource the role. An external compliance officer must still meet the eligibility requirements, including residence and fit and proper, and have the authority, resources and expertise to do the job.^{5 16} Your firm remains responsible for its obligations.

AMLCompliant does not act as anyone's compliance officer, senior manager or governing body, and we do not lodge reports for you.

When AUSTRAC writes to you

Because the compliance officer communicates with AUSTRAC for the firm, notices usually land on their desk. AUSTRAC said on 28 August 2026 that it had begun issuing section 167 notices to businesses that appear to provide designated services but have not enrolled.¹⁷

The dollar value of a penalty unit is set by the Crimes (Amount of a Penalty Unit) Instrument 2026.¹⁸ Section 168 does something different: it entitles you to reasonable compensation for making copies of documents that a s 167 notice requires.¹⁹

Keep the record

You must keep records reasonably necessary to show you complied with the program obligations.²⁰ AUSTRAC lists what it expects for the compliance officer: the person's name, when they held the role, how they meet the eligibility requirements (including any reassessments), and what you considered in deciding that.⁵

AUSTRAC's compliance officer page and its page on governance for sole traders and micro businesses have the full detail. AUSTRAC links on this page open in a new window. AUSTRAC has not reviewed or endorsed this guide.

Where we fit

• The free option: AUSTRAC publishes free program starter kits for small practices that meet its suitability criteria.
• Your sector: accounting practices, real estate agencies, conveyancers and legal practices.
• The documents: our kit is built on AUSTRAC's starter kits. Document 06 is the compliance officer designation, eligibility and fit and proper record; document 21 holds the annual report to the governing body.
• Set-up with us: in the set-up service we prepare the designation and fit and proper record, and on the call we check with you that AUSTRAC was notified. Your firm chooses the person and gives the notice.
• More: the other guides and every source we use on the sources page.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.