AML Independent Evaluation Readiness: What Evaluators Will Look For

Every reporting entity must have an independent evaluation of its AML/CTF program. For most entities, this happens once every 10 years. But AUSTRAC can require it sooner if risk is elevated or if there are compliance concerns.

For real estate professionals subject to Tranche 2, the first wave of independent evaluations will likely begin 2027–2028.

Are you ready?

What is Independent Evaluation?

An independent evaluator (a qualified external auditor or compliance consultant) reviews your AML/CTF program and reports to:

• You: A confidential report with findings and recommendations
• AUSTRAC: A summary report confirming the program was evaluated (AUSTRAC sees the report if it requests)

Scope: The evaluator assesses whether your AML/CTF program is adequate, based on your risk profile.

Standards: The evaluation is measured against AUSTRAC's expectations and the AML/CTF Act requirements.

Who Can Be an Evaluator?

Your independent evaluator must be:

• Independent: Not employed by or closely affiliated with your business
• Competent: Knowledgeable in AML/CTF compliance
• Fit and proper: Meeting AUSTRAC's standards for evaluators
• Professional indemnity insured: Carrying adequate insurance

Examples: External audit firm, compliance consultant firm, specialized AML evaluation service

Who cannot evaluate: Your software vendor, your AML service provider (conflict of interest), your accountant (unless they have specific AML competency)

What Evaluators Will Examine

Red Flags Evaluators Will Note

• No named Compliance Officer — or CO who is absent/under-resourced
• No documented CDD — customer information held informally
• Incomplete beneficial owner identification — especially for trusts/companies
• No SMR process or documentation — or SMRs filed without documented reasoning
• No staff training records — or training that is generic, not AML-specific
• No risk assessment — or risk assessment that does not reflect actual business
• Policies that don't match practice — documented process that staff don't actually follow

What a "Pass" Looks Like

An evaluator will likely give you a pass (or limited findings) if you can demonstrate:

• A qualified, engaged Compliance Officer making decisions
• Complete customer due diligence files with identity and beneficial owner documentation
• Documented decisions on escalations (SMRs, PEPs, higher-risk customers) with CO reasoning
• Training records showing all staff are competent
• A risk assessment that reflects your actual business and customers
• Policies that match what you actually do
• Records that are organized, retained, and retrievable

Typical Evaluation Timeline

Week 1-2: Evaluator meets with you, reviews program overview, requests documents

Week 3-4: Evaluator reviews key documentation, interviews Compliance Officer

Week 5-6: Evaluator samples customer files, reviews SMR decisions, checks staff training

Week 7: Evaluator compiles findings and recommendations

Week 8: You receive draft report; opportunity to comment

Week 9: Final report issued

Cost: $3000–$10,000 depending on complexity and agency size

Preparing for Evaluation Now

Document Everything

Start now:

• Finalize and document your ML/TF Risk Assessment
• Document your AML/CTF policies clearly
• Ensure all customer CDD files are complete and organized
• Document SMR decisions with reasoning
• Maintain training records for all staff
• Ensure your Compliance Officer is named and engaged

Fix Gaps Now

If you identify gaps before evaluation:

• Incomplete CDD files: Gather missing documents now
• No SMR process: Establish documented process and decision authority
• No training records: Conduct training and document it
• Weak Compliance Officer: Strengthen role or consider external CO

Mock Evaluation (Optional)

Some agencies engage their external service provider (like AMLHQ) to conduct a pre-evaluation review. This identifies gaps before the formal evaluation and gives you time to remediate.

Key Takeaways

• Independent evaluation is coming. Plan for it 2027–2028.
• Evaluators care about evidence of genuine governance, not just software.
• Your Compliance Officer is the key — they must be qualified and engaged.
• Documentation is everything. What you did, who decided, why they decided — that is what evaluators review.
• Start preparing now. Gaps found during evaluation are much harder to fix than gaps found and remediated proactively.