Proposed AML/CTF Rules: the red and green flags

The Act will become the primary driver for CDD and prescribes very limited CDD criteria. 

For example, if the customer is an individual, a reporting entity must take reasonable steps to establish that the customer is the person they claim to be, categorise their risk, collect information appropriate to that risk categorisation, and then verify their identity using ‘reliable and independent data’. (See below for a related red flag).

It is commonly accepted that the AML/CTF compliance officer has the central responsibility for implementing, maintaining, and ensuring the reporting entity adheres to appropriate frameworks for compliance with the AML/CTF regime. 

The Draft Rules provide more targeted measures for ensuring the appointed individual is suitable for the role. Significantly, reporting entities will need to put in place policies to ensure their AML/CTF compliance officer has the requisite ‘competence, character, diligence, honesty, integrity and judgment to properly perform the duties’. Reporting entities will also have to examine the individual’s conflicts of interest. It will be interesting to see how employment arrangements and remuneration filter into considerations of conflict, as well as how characteristics such as ‘integrity’ are to be assessed.

There is also an express requirement in the Draft Rules for the AML/CTF compliance officer to provide certain reports to the board at least annually.

Under the Draft Rules, a reporting entity’s policies must require senior manager approval for the provision of designated services to:

• foreign PEPs; and
• domestic PEPs and international organisation PEPs who are high risk.

The Draft Rules also require source of wealth and source of funds to be established for the above categories of PEPs.

We consider that the obligation for senior manager approval provides clarity and will take away some of the guesswork around what AUSTRAC might consider to be appropriate compliance measures.

The concept of reporting groups will replace the current concept of designated business groups when the amendments to the Act take effect. The Draft Rules attempt to define which part of a business group would be the ‘lead entity’.  However, this part of the Draft Rules is only partly complete, which is frustrating.

What the Draft Rules currently say is that a provider of designated services, which is resident of Australia and is registered under Division 2 of Part 5B.2 of the Corporations Act, will be the lead entity if it ‘controls’ all other group members who provide designated services. If there is more than one designated service provider that meets the forementioned criteria, then the lead entity will be the one with ‘the most direct control’ of all other designated service providers within the group.

Groups which currently have multiple reporting entities may therefore need to revisit the structure of their existing compliance arrangements.

Anyone wondering what happens if there is no provider of designated services that ‘controls’ all other group members who provide designated services must wait patiently for the next iteration of the Draft Rules.

Individuals

For account-based and transfer of value designated services (ie items 1, 3, 5, 29, and 30), the Draft Rules require a reporting entity to verify an individual’s date of birth and place of birth. 

It could be difficult to verify place of birth, particularly if the individual does not have a passport. It has been indicated this requirement is to assist AUSTRAC in identifying and verifying place of birth when conducting investigations on foreign individuals. However, it will potentially complicate verification processes for reporting entities conducting these designated services. 

Businesses

The Draft Rules require reporting entities to verify the ‘ownership, control, and management structure’ of businesses. While reporting entities currently need to examine beneficial owners, identifying the management structure is a new requirement. 

Requiring identification and verification of the management structure of a business opens the door to potentially far reaching and complicated CDD processes. Reporting entities will likely need thorough frameworks to maximise efficiencies here.  

Due diligence

In the same manner as the amendments to the CDD arrangements, the Draft Rules propose to provide flexibility in employee due diligence. 

The Draft Rules require a reporting entity to examine an employee’s:

• skills, knowledge, and expertise relevant to their particular responsibilities; and
• integrity.

These requirements are very broad and establishing a framework to assess ‘integrity’ could be challenging. We envisage that reporting entities with current procedures to examine criminal history, negative reports, and bankruptcy would maintain those measures for this purpose. 

Training

Under the Draft Rules, reporting entities must conduct both initial and ongoing employee training having regard to the person’s particular needs in their role.

Significantly, the training must also be ‘readily understandable by the person’. While good in principle, this requirement may prove difficult for an AML/CTF compliance officer to monitor or evaluate. It could also prevent generalised employee training being delivered (for efficiency and cost savings) to groups of employees across an organisation, as it seems to imply training must be considered against individual employee needs. This may prove to be impractical for large reporting entities, some of which may have thousands of employees, and expensive for reporting entities of all shapes and sizes. 

The Draft Rules require suspicious matter reports, threshold transaction reports and other reports to be ‘complete, accurate and free from unauthorised change’. 

It is unclear what is meant by ‘free from unauthorised change’. Does it mean limiting access to making reports within an organisation or ensuring reports are free from external influences?

The Act (as amended) will require independent evaluations (currently known as ‘independent reviews’) to be undertaken at least every three years. It was hoped the Draft Rules would expand this timeframe for lower risk reporting entities, which unfortunately is not the case. 

AUSTRAC has current guidance indicating high risk organisations should conduct independent reviews at least every two to three years. When the amendments to the Act come into effect, all reporting entities will effectively be captured in this timeframe.

For low and medium risk reporting entities, which may currently conduct independent reviews less frequently than their high-risk counterparts based on the current regulatory guidance, this is likely to significantly increase costs, which will be particularly challenging for smaller businesses to absorb. 

Further, the Draft Rules have differently worded evaluation criteria. In some cases, this may mean the independent evaluation process may be more rigorous than independent reviews previously undertaken. The Draft Rules state that a reporting entity’s policies must require the independent evaluation process to:

• evaluate the steps taken when undertaking or reviewing ML/TF risk assessments;
• evaluate the design of the AML/CTF policies;
• test and evaluate the compliance of the entity with its policies (in essence, a quality assurance review every three years);
• produce a written report containing findings; and
• deliver the report to the board and any senior management.

Enhanced customer due diligence (ECDD)

ECDD is now required where a customer seeks designated service/s that has/have ‘no apparent economic or legal purpose’ and the proposed provision of designated service/s would involve:

• unusually complex or large transactions; or
• an unusual pattern of transactions.

Firstly, it is unclear what circumstances would involve a person receiving a service that has ‘no apparent economic or legal purpose’. This appears to put the onus on a reporting entity to establish that there is an economic or legal purpose when a designated service is sought.

Secondly, this has the potential to capture an extraordinarily broad range of circumstances, without there necessarily being a potential connection to suspicious behaviour. For example, what would be considered an ‘unusually large transaction’? This may be difficult for a reporting entity to establish, particularly if their prior interactions with the customer have been limited or non-existent.

Transaction monitoring

The Rules now provide an extensive list of offences that organisations must monitor transactions and behaviour for, including but not limited to corruption, bribery, fraud, forgery, environmental crime, robbery, murder, and cybercrime (in addition to the usual ML/TF offences). While these offences are captured under the existing AML/CTF regime with a requirement to monitor for criminal offences generally, the specific list will place the onus on reporting entities to have transaction monitoring rules that specifically target the detection of these kinds of criminal activities.

This could be a significant shift for reporting entities if they are currently taking a more generic approach, as they will need to develop more targeted transaction monitoring frameworks.