A plain-language compliance glossary: the screening, due diligence and AML/CTF terms Australian compliance teams work with every day.
The legal framework Australian AML/CTF obligations flow from.
Australia's primary anti-money laundering law. It requires businesses that provide designated services, called reporting entities, to enrol with AUSTRAC, assess their money laundering and terrorism financing risk, maintain an AML/CTF program, carry out customer due diligence, keep records and report suspicious matters and certain transactions to AUSTRAC.
Does the AML/CTF Act apply to you? →Australia's AML/CTF regulator and financial intelligence unit. AUSTRAC receives reports from reporting entities, produces financial intelligence for law enforcement, issues guidance and the AML/CTF Rules, assesses compliance and can take enforcement action, including civil penalty proceedings.
The legislative instrument made by AUSTRAC that sets out the detailed requirements sitting under the AML/CTF Act, such as how customer due diligence must be carried out and what reports must contain. New Rules were made to support the 2024 reforms.
The extension of Australia's AML/CTF regime made by the 2024 reforms. Since 1 July 2026, lawyers, conveyancers, accountants, real estate agents, trust and company service providers, and dealers in precious metals and stones are reporting entities for the designated services they provide.
Tranche 2 readiness review →Anti-money laundering and countering the financing of terrorism: the umbrella term for the laws, controls and processes that stop criminal funds moving through the financial system. Australia's framework uses the term AML/CTF; the FATF sets the international standard it follows.
The intergovernmental body that sets global AML/CFT standards through its 40 Recommendations, and assesses countries against them in mutual evaluations. Australia is a long-standing member. FATF guidance also shapes screening practice, including how adverse media should inform customer risk assessment.
The FATF's list of jurisdictions under increased monitoring for weaknesses in their AML/CFT regimes, alongside its list of high-risk jurisdictions subject to a call for action. Both feed directly into country risk ratings and decisions about when enhanced customer due diligence is needed.
The list of persons and entities subject to targeted financial sanctions under Australian law, maintained by the Australian Sanctions Office within the Department of Foreign Affairs and Trade. It covers both United Nations sanctions and Australia's autonomous sanctions.
Sanctions screening and monitoring →Australia's main privacy law and its Australian Privacy Principles. Screening involves handling personal information, so the Privacy Act governs how screening data is collected, used, secured and retained. Reporting entities are covered for their AML/CTF activities even if they would otherwise be exempt as a small business.
AUSTRAC's online system for enrolment, registration and reporting. Reporting entities use it to enrol, keep their details up to date and lodge the reports the AML/CTF Act requires, including suspicious matter reports.
The categories of people and organisations that carry defined obligations or elevated risk.
A business that provides a designated service under the AML/CTF Act and is therefore bound by its obligations. Reporting entities include banks and other deposit-taking institutions, lenders, remitters, digital currency exchanges, life insurers, superannuation funds, gambling providers, bullion dealers and, since Tranche 2, lawyers, accountants, real estate agents and other professional services.
Are you a reporting entity? →A service listed in the AML/CTF Act that brings the business providing it into the AML/CTF regime. Obligations attach to the designated services a business provides, not to the business as a whole, which is why working out exactly which services you offer is the first step in any compliance assessment.
Someone who holds or has held a prominent public function, and who therefore carries a higher risk of involvement in bribery, corruption or the misuse of public funds. PEP status is not an accusation; it triggers enhanced due diligence, senior approval and closer monitoring rather than automatic rejection. Australia's rules recognise domestic, foreign and international organisation PEPs.
PEP screening and monitoring →A person holding a prominent public position in an Australian government body, whether Commonwealth, state, territory or local, such as ministers, senior officials, senior judges, high-ranking military officers and the heads of state-owned enterprises. Enhanced due diligence is required when the relationship is assessed as high risk.
A person holding a prominent public function in another country, such as a head of state, member of a royal family, senior politician, senior judge, senior executive of a state-owned company or high-ranking military officer. Foreign PEPs always require enhanced customer due diligence.
A senior officer of an international organisation, such as a United Nations agency or a multilateral development bank. Like domestic PEPs, they call for enhanced due diligence when the relationship is assessed as high risk.
The immediate family members and known close associates of a PEP. Risk and screening obligations extend to them, because illicit funds are commonly held or moved through people connected to the prominent person rather than by the person directly.
The individual who ultimately owns or controls a customer, traced through however many layers of shareholding, trusts or nominee arrangements sit in between. Under Australia's rules, ownership means holding 25% or more, and control can arise in other ways. Identifying beneficial owners is a core AML/CTF requirement for non-individual customers, because entity structures are the standard way real ownership is hidden.
KYB and beneficial ownership →Disguising the criminal origin of funds so they appear legitimate. It is classically described in three stages: placement, where cash enters the financial system; layering, where transactions obscure the trail; and integration, where the funds re-emerge as apparently clean assets.
The duties the AML/CTF Act places on a business, and the processes that meet them.
The program every reporting entity must maintain. It combines a documented assessment of the business's money laundering and terrorism financing risk with the policies, procedures, systems and controls that manage it, and it is usually the first thing AUSTRAC asks to see.
AML/CTF program questions in the FAQ →The person a reporting entity appoints to oversee its AML/CTF program day to day. The role should sit at management level, with the authority, independence and resources to make the program work and to escalate issues to senior management.
The process of establishing and verifying who a customer is before and during a business relationship. KYC is the foundation the rest of compliance stands on: risk assessment, screening and monitoring all depend on knowing reliably who you are dealing with.
KYC performed digitally: electronic identity verification, document collection and screening in one onboarding flow, rather than paper forms and manual checks. Done well, it verifies customers before onboarding completes and leaves an automatic evidence trail.
HLBNGA's eKYC platform →Due diligence on corporate customers and counterparties: verifying that the entity exists, understanding its ownership and control structure, identifying its beneficial owners and directors, and screening all of them. KYB matters because a company's risk sits with the people behind it.
KYB screening →The AML/CTF Act's core requirement: identify the customer, verify that identity against reliable sources, identify beneficial owners and anyone acting on the customer's behalf, understand the purpose of the relationship, and keep that knowledge current through ongoing due diligence. The depth scales with risk, which is what the risk-based approach means in practice.
The deeper level of due diligence applied to high-risk customers, such as foreign PEPs, complex entity structures or customers connected to high-risk jurisdictions. It typically adds source of funds and wealth checks, adverse media analysis, senior management approval and closer ongoing monitoring, with the reasoning documented. Often called EDD.
AI-powered EDD with KYCopilot →The principle, set by the FATF and built into the AML/CTF Act, that compliance effort should be proportionate to risk: stronger controls where risk is higher, simpler ones where it is lower. It replaces box-ticking with judgement, and it requires a documented risk assessment to stand on.
Re-screening and reviewing existing customers throughout the relationship, not only at onboarding. Customer risk changes: people become PEPs, appear on sanctions lists or attract adverse media after they were accepted. Point-in-time checks cannot catch that; continuous or scheduled re-screening can.
Continuous monitoring with RiskSecure 360 →Two related enhanced due diligence questions. Source of funds asks where the money in this specific transaction or relationship comes from; source of wealth asks how the customer accumulated their overall assets. Both test whether the customer's money is plausibly legitimate.
The report a reporting entity must give AUSTRAC when it forms a suspicion that a customer or transaction may be connected to money laundering, terrorism financing or other serious crime: within three business days, or within 24 hours where terrorism financing is suspected. The customer must not be tipped off that a report was made.
The report a reporting entity must give AUSTRAC when it provides a designated service involving a transfer of physical currency of AUD 10,000 or more, within 10 business days of the transaction.
A report of an instruction to transfer money or property into or out of Australia, given to AUSTRAC by the reporting entity that sends or receives the instruction. IFTI reports give AUSTRAC visibility of cross-border flows.
The retrievable record of what was checked, what was found, who decided and when. The AML/CTF Act requires records to be kept for seven years, and in an AUSTRAC review the difference between a control that exists and a control that can be proven is the audit trail. A decision that cannot be evidenced is very hard to defend after the fact.
A screening alert on someone who is not actually the risk in question, most often a name match against a different person. High false-positive rates are the main operational cost of screening: every one consumes analyst time. Reducing them without missing true matches is the core quality measure of a screening system.
How HLBNGA reduces false positives →The screening types AML/CTF obligations translate into, and the technology behind them.
Checking customers and counterparties against targeted financial sanctions lists, such as the DFAT Consolidated List and those issued by the UN Security Council. Sanctions obligations are strict rather than risk-based: they apply to every customer regardless of risk rating, and dealing with a designated person's assets can be a serious criminal offence.
Sanctions screening and monitoring →Sanctions aimed at specific listed persons and entities rather than whole countries: asset freezes and prohibitions on making funds or assets available to them. In Australia they are imposed under the Charter of the United Nations Act 1945 and the Autonomous Sanctions Act 2011, and anyone holding a designated person's assets must freeze them and notify the authorities.
Any curated list used in screening: sanctions lists, PEP databases, law-enforcement wanted lists, regulatory enforcement lists or internal restricted lists. Watchlists are indispensable but always lag reality, which is why adverse media screening exists alongside them.
Screening news and other public sources for negative information about a customer: fraud, corruption, sanctions evasion, organised crime and similar signals. Adverse media typically surfaces risk long before a person or company reaches any formal watchlist, which makes it an early-warning layer in due diligence.
Adverse media screening →HLBNGA's patented AI scoring technology for adverse media. It reads at sentence level rather than matching keywords, weighs the frequency, severity and credibility of negative mentions, and produces a contextually accurate 0 to 100 risk score for a person or company, with every score source-cited and carrying a full audit trail.
How COMFORT™ works →Applying screening discipline to suppliers, agents, intermediaries and other business partners, not only to customers. Third parties carry the same sanctions, corruption and reputational exposure as customers, and are usually screened to a far lower standard, which is exactly why they are a common route for risk to enter a business.
Third-party screening →Identifying the people, organisations and locations linked to a screened entity, so risk that sits one step away is visible: a clean company with a sanctioned director, or a customer whose close associate is a PEP. Network context is often where the real finding is.
Association mapping in I2G →Book a Tranche 2 readiness review, or bring your questions to a compliance specialist.