An independent evaluation is someone who did not build your AML/CTF program testing whether it is well designed and whether it actually works.
It replaced the old independent review, and the scope widened in the process. The old review looked at Part A. The evaluation looks at the whole program: your ML/TF risk assessment, the design of your policies, and whether in practice you identify, assess, mitigate and manage risk and follow your own rules.
For a firm that became a reporting entity when table 6 professional services commenced on 1 July 2026, the first one is years away. The decisions that make it survivable are being made now.
What the evaluator has to assess
Three things, and your policies have to require all 3 of them. AUSTRAC’s guidance sets them out:
- Your risk assessment process, meaning how you arrive at your view of ML/TF risk rather than just the document it produces
- The design of your AML/CTF policies, meaning whether they would work if followed
- Your compliance and risk management in practice, meaning whether they are followed
That third limb is why an evaluation is not a document review. The evaluator samples what your people actually did, not what the manual says they should have done. A firm with an immaculate program and no evidence that anyone used it fails on the third limb while passing the second.
Businesses operating across jurisdictions have to have Australian obligations thoroughly evaluated, with a reasonable sample drawn from Australian operations.
Who can do it, and who definitely cannot
The evaluator can be internal or external. No qualification is mandated. AUSTRAC’s position is that they should understand your AML/CTF obligations and your sector’s ML/TF risks, and that your policies should explain how you assess whether someone is suitable.
Independence is where section 26F bites. The evaluator has to be free from bias, influence and conflicts of interest, and must have the authority to exercise independent judgement. Specifically, they must not have built or run the program, must not have assessed your ML/TF risks, and must not sit within the teams they are evaluating, including the AML/CTF compliance team.
Which rules out the plan most small firms are quietly holding: the compliance officer evaluating their own program. The person who wrote the policies and set the risk ratings is the one person who cannot sign off on whether they work.
For a 6 person practice that usually means buying it in. For a larger firm with an internal audit function it can be done in house, provided the line between the evaluator and the risk assessment team is real rather than nominal.
You set the frequency, with a floor
Your AML/CTF policies must state how often evaluations happen, and the frequency has to suit the size, nature and complexity of your business. The floor is once every 3 years.
AUSTRAC expects you to document the reasoning behind whatever interval you pick. A single office practice with a narrow service range and a stable client base defending a 3 year cycle is a different conversation from a multi office firm with offshore clients doing the same.
Newly enrolled entities can choose to evaluate earlier than their deadline, and for a firm standing up a program from nothing there is a decent argument for doing exactly that. An evaluation 18 months in finds the gaps while they are still cheap.
Your first deadline depends on your AAN
This is the part worth checking today, because it is decided by a number you were given at enrolment and nobody tells you twice.
For newly regulated businesses, the transitional rules stagger the first evaluation by the last 2 digits of your AUSTRAC account number.
Figure 1. The staggered first evaluation deadline for newly regulated businesses.
Both digits odd puts you at 30 June 2029. Second last odd with last even is 31 December 2029. Both even is 30 June 2030. Second last even with last odd is 31 December 2030.
If you were already enrolled on 30 March 2026 and have had at least one independent review under the pre reform Rules, your first evaluation is due on the later of 4 years after that review or 31 March 2027. For a firm whose last review was in 2024, that means 2028. For one whose last review was in 2021, it means 31 March 2027, which is not far away.
Your AAN comes with enrolment, so if you went through enrolling with AUSTRAC and filed the confirmation without reading it, that is where the number is.
The report, and what happens after it
The evaluator produces a written report. It should set out the process they followed, their findings on the risk assessment and on policy design, their compliance findings, and what they tested and sampled.
Your policies must require that report to go to your governing body, and to any senior manager who approves the program, as soon as reasonably practicable after it is prepared. There is no filtering step in between. A partner cannot read it first and decide the board does not need the awkward parts.
Where the evaluation produces adverse findings and you update your risk assessment or your policies in response, the update has to be documented within 14 days of making it. That is a short clock and it is easy to miss while everyone is still arguing about the findings.
What to do now, years before the deadline
- Find your AAN and work out your actual deadline from the last 2 digits. Put it in the calendar with a 6 month lead.
- Write the evaluation frequency into your AML/CTF policies, with the reasoning for the interval you chose.
- Write down how you will assess whether a prospective evaluator is suitable, before you need one.
- Decide now whether it will be internal or external, because an internal evaluator needs organisational separation that takes time to build.
- Make sure your policies require the report to reach the governing body and any approving senior manager directly.
- Keep the evidence trail as you go. An evaluator samples what you did, and record keepingis what turns a claim into a finding in your favour.
A program that has been maintained continuously evaluates well. One that gets rebuilt in the 3 months before the deadline does not, and the gap shows up in the third limb every time. Keeping the risk assessment, the customer files and the decision trail in one system rather than across a shared drive is what HP-KYC is for, and the 90 day build plan covers getting the program itself in place.
Frequently asked questions
How often does an independent evaluation have to happen?
At least once every 3 years. The actual frequency is set by your own AML/CTF policies and has to be appropriate to the size, nature and complexity of your business, with your reasoning documented. Anything less frequent than 3 years is not available.
Can our AML/CTF compliance officer run the evaluation?
No. The evaluator must not have built or run the program, must not have assessed your ML/TF risks, and must not sit within the teams being evaluated, which includes the compliance team. For most small practices that means engaging someone external.
Does the evaluator need a specific qualification?
No qualification is mandated. AUSTRAC expects the evaluator to understand your AML/CTF obligations and the ML/TF risks in your sector, and expects your policies to set out how you assess whether a candidate is suitable. Documenting that assessment is part of the obligation.
When is a Tranche 2 firm’s first evaluation due?
It depends on the last 2 digits of your AUSTRAC account number. Both odd is 30 June 2029, second last odd with last even is 31 December 2029, both even is 30 June 2030, and second last even with last odd is 31 December 2030. You can choose to evaluate earlier.
Who has to receive the evaluation report?
Your governing body, and any senior manager who approves the AML/CTF program, as soon as reasonably practicable after the report is prepared. Your policies have to require this, so the report cannot be screened or summarised on the way up.
What is the difference between an independent review and an independent evaluation?
The review was the pre reform obligation and covered Part A of the program. The evaluation covers the whole program, including the risk assessment process, the design of the policies, and whether the business actually complies in practice. The Part A and Part B structure no longer exists.
The technical detail
Current as at October 2026.
Obligation. Section 26F(4)(f), Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), with Rules section 5-10. Related provisions: sections 26D, 26H and 116 of the Act, and Rules sections 5-1, 5-4, 5-10 and 5-15.
Scope. Policies must require the evaluator to assess the reporting entity’s ML/TF risk assessment process, the design of its AML/CTF policies, and its compliance and risk management in practice. Multi-jurisdiction businesses must have Australian obligations thoroughly evaluated using a reasonable sample from Australian operations.
Frequency. Set by the reporting entity’s own AML/CTF policies, appropriate to the size, nature and complexity of the business, with a minimum of once every 3 years. Reasoning for the chosen interval should be documented. Newly enrolled entities may evaluate earlier than their transitional deadline.
Evaluator. May be internal or external. No prescribed qualification. Must understand the entity’s AML/CTF obligations and sector ML/TF risks. Must be free from bias, influence and conflicts of interest, with authority to exercise independent judgement. Must not have built or operated the program, must not have conducted the ML/TF risk assessment, and must not sit within the teams being evaluated, including the AML/CTF compliance team. Policies must set out how evaluator suitability is assessed.
Reporting. A written report is required. It must be given to the governing body and to any senior manager who approves the program, as soon as reasonably practicable after preparation. The report should cover the evaluation process, findings on the risk assessment and policy design, compliance findings, and what was tested and sampled.
Post evaluation. Any update to the ML/TF risk assessment or AML/CTF policies made in response to adverse findings must be documented within 14 days after the update.
First evaluation deadlines. Part 7, AML/CTF Transitional Rules 2026. Newly regulated businesses, and entities previously providing only item 54 services, by reference to the last 2 digits of the AUSTRAC account number: both odd, 30 June 2029; second last odd and last even, 31 December 2029; both even, 30 June 2030; second last even and last odd, 31 December 2030. Entities enrolled on 30 March 2026 with at least one prior independent review under the pre-reform Rules: the later of 4 years after the most recent review, or 31 March 2027.
Commencement. Reformed obligations commenced 31 March 2026 for existing reporting entities and 1 July 2026 for table 6 professional services. Penalty unit $364 from 1 July 2026.
