Beyond the numbers: Explore the trends and ideas shaping Australian business. Listen now.
By: Martin Stone, Annelies Homersham
05 Nov 2026 7 min read
The questions cover the nature of their business, the ML/TF risks they face and progress against their implementation plans. Supporting documents requested include the AML/CTF Policy, ML/TF risk assessment and AML/CTF reforms implementation plan.
The themes are not entirely new. AUSTRAC’s 2025 compliance report asked about business delivery channels, ML/TF risk assessments and customer risk assessment methodologies. It also explored AML/CTF controls and governance, and asked respondents to rate their understanding of obligations under the AML/CTF Amendment Act 2024. Alongside these familiar themes, the questionnaire asks about progress against implementation plans.
The implementation plan questions should also be considered in the context of AUSTRAC’s published regulatory expectations. In its December 2025 update, AUSTRAC acknowledged the extensive nature of the reforms and the implementation challenges facing some existing reporting entities. Its expectations nevertheless retain a clear focus on reporting entities understanding, managing and mitigating ML/TF risk.
AUSTRAC’s May 2026 statement adds a further dimension: implementation should support a genuinely risk-based approach. It expects reporting entities to strengthen their understanding of their risks and document the controls used to mitigate them, making clear that controls should differ according to the level of risk.
The correspondence is also consistent with AUSTRAC’s published regulatory priorities for 2026–27. As part of its focus on realising the benefits of the reforms, AUSTRAC expects existing reporting entities to maintain effective ML/TF risk management while making meaningful progress in implementing the required changes. AUSTRAC has also signalled a focus on reporting entities that do not manage their risks effectively, including those whose AML/CTF programs are not applied in daily operations.
While the questionnaire’s specific purpose should not be assumed, its themes align with these published priorities.
The two-part request calls for more than consistency between questionnaire answers and uploaded documents. The AML/CTF Policy, ML/TF risk assessment and implementation plan should together explain the organisation’s risks, how they are managed and mitigated, and how outstanding implementation work addresses identified vulnerabilities, control gaps and new legislative requirements.
For reporting entities, this presents a practical question: can your organisation explain its current ML/TF risks and vulnerabilities, how and why they have changed since its last compliance report, and whether its reform implementation priorities reflect those changes?
Changes in products or designated services, delivery channels or geographic exposure may alter the organisation’s ML/TF risks. The risk assessment should reflect those changes, while the policy and implementation plan should show how the resulting exposures and any gaps against the new legislative requirements are being addressed.
Where questionnaire answers and supporting documents are incomplete or difficult to reconcile, preparing the submission can become a time-consuming exercise in resolving definitions, locating evidence and explaining differences. The same issues can also limit management’s ability to understand residual exposure, prioritise investment and challenge whether implementation is progressing as intended.
The answers and supporting documents should present a consistent account of how identified ML/TF risks are managed and mitigated. Reporting entities should also be prepared to discuss the significance of remaining vulnerabilities or gaps, the measures managing exposure and the further action required.
Reform implementation and business-as-usual risk management cannot be treated as separate exercises. Reporting entities should be able to explain how they are maintaining effective controls while completing outstanding reform implementation work.
Although completing the questionnaire is not compulsory, it offers recipients a useful opportunity to explain their risk management approach and reform progress. AUSTRAC has noted that it will consider referring reporting entities that do not respond for supervisory follow-up.
A focused review can help reporting entities prepare a well-supported response while improving the information used to manage financial crime risk. The five practical steps below provide a starting point:
Identify the questions to answer and documents to upload, including any requirements for document versions or reporting dates. Clarify the scope of the request and the ML/TF risk factors relevant to your response, taking account of the response deadline and any definitions supplied by AUSTRAC.
Check that the ML/TF risk assessment reflects the current business, including customers, products and designated services, delivery channels and geographic exposure. Assess whether material vulnerabilities and control gaps are captured and reconcile relevant information with the organisation’s submitted 2025 compliance report.
Assess the implementation plan and reported progress against AUSTRAC’s published expectations, taking account of the obligations and transitional arrangements applicable to the business. Reporting entities should have information to hand to support their assessment of progress, explain material changes to their plans and understand how the changes are reflected in day-to-day operations.
Be prepared to answer questions about how outstanding actions address material ML/TF exposures, vulnerabilities and control gaps, and support proportionate controls. This includes being able to explain relevant interim controls and how remaining work is prioritised according to risk.
Bring together the relevant teams to consider what preparing the response has revealed about ML/TF risk management and reform progress. Discuss what is on track, where gaps or delays remain, and whether additional funding, resources or management attention are needed to address them.
These discussions can turn the response into a practical checkpoint for management, clarifying whether ML/TF risks are being managed effectively, reform implementation is on track and further investment or action is needed. Reporting entities that have not received the request can use the same approach to review their own position.
Whether you are preparing a response or reviewing reform progress, Grant Thornton can help assess your ML/TF risks and vulnerabilities, check consistency between questionnaire answers and supporting documents, and identify where further action or investment may be needed.
Contact our financial crime team to discuss a focused review of your questionnaire answers and supporting documents, or your reform implementation progress.
In this episode of Beyond the Numbers with Grant Thornton, AML/CTF expert Neil Jeans explores why organisations should assess their exposure, even if they think risk is low, and where businesses can start so they’re in the best defensive position should any issues arise.
Increasingly complex global trade and geopolitical tension mean that knowing your direct suppliers is no longer enough. Organisations increasingly need visibility across the full supply chain. Modern supply chains can be difficult to trace beyond the first few tiers.
On 28 August 2026, AUSTRAC began issuing section 167 notices to businesses that appear to be providing designated services but have not enrolled under Australia's AML/CTF regime.
