You have to name an AML/CTF compliance officer, the AMLCO, and the appointment has to be real. The AMLCO is the person who runs your AML/CTF program day to day: who decides how customers are verified, when reports go to AUSTRAC, and what happens when something looks wrong.
The role exists because your firm is a reporting entity: a business that provides a designated service, a service listed in the tables to s6 of the AML/CTF Act 2006 (Cth) (Table 6 for professional services, Table 5 for real estate, Table 2 for precious metals and stones), and is therefore captured by that Act. Tranche 2 made accountants, legal practitioners, conveyancers, real estate agents, dealers in precious metals and stones, and trust and company service providers reporting entities from 31 March 2026, and the AMLCO obligation applied to them from 1 July 2026. If you provide one of those services, the obligation to appoint an AMLCO applies to you now.
Who can hold the role
The role has to be held by an individual: a real person with a name, not a committee, not a shared title, and not an outsourced function with no one answerable behind it (s26J(1)). The Act then sets two kinds of requirement: what the firm must ensure about the person, and who is eligible at all.
| Requirement | Where it comes from | What it means in practice |
|---|---|---|
| An individual, not a position | s26J(1) | A named person the firm and AUSTRAC can hold to account |
| Management level, with sufficient authority, independence and access to resources and information | s26J(2), a civil penalty provision | The person is employed or engaged at management level and has sufficient authority, independence and access to resources and information to perform the AMLCO’s functions effectively: in practice, the systems, records and staff time the role needs |
| A resident of Australia, where you provide your services through a permanent establishment in Australia | s26J(3)(a); for an individual, resident means ordinarily resident (s14(1)) | The person has to live here, not hold the role from an offshore office |
| A fit and proper person | s26J(3)(b) and (4); Rules 5-14 | Before appointing, you decide whether the person is fit and proper, having regard to the matters below |
Residency and fitness are the eligibility test: appointing someone who does not meet it is a contravention in its own right (s26J(6)). Whether someone is fit and proper is a considered judgement, not a pass or fail checklist. Rules 5-14 lists the matters you must have regard to in making it:
- whether they have the competence, skills, knowledge, diligence, expertise and soundness of judgement to do the job, given the nature, size and complexity of your firm;
- whether they have good character, honesty and integrity;
- whether they have been convicted of a serious offence (the spent convictions scheme still applies);
- whether they have been the subject of civil or criminal proceedings, or a regulatory or disciplinary process, in Australia or overseas, that related to managing an entity or a commercial or professional activity and involved an adverse finding about their competence, diligence, judgement, honesty or integrity;
- whether they are an undischarged bankrupt, or have entered a personal insolvency agreement, in Australia or overseas;
- whether they have a conflict of interest that creates a material risk they will not properly perform the role.
A matter on that list is something you weigh and record, not an automatic bar. AUSTRAC’s guidance also expects the assessment to be revisited periodically.
Several deadlines attach to the appointment, and they are short.
| What | When |
|---|---|
| Appoint an AMLCO after you start providing a designated service | Within 28 days (s26K(1)) |
| Notify AUSTRAC of the appointment | Within 14 days of appointing (s26M(1)), or by the later transitional date if it applies to you (AML/CTF Transitional Rules 2026, s 19: see below the table) |
| Appoint a replacement if the AMLCO stops being eligible | Within 28 days of them ceasing to be eligible (s26K(2)) |
| Appoint a replacement if the AMLCO resigns or leaves | Within 28 days, as AUSTRAC’s guidance expects |
| Notify AUSTRAC of a new AMLCO | Within 14 days of appointing (s26M) |
For a firm captured on 1 July 2026, the 28-day clock started then. The first notice to AUSTRAC has a transitional date: if you provided a Tranche 2 service before 1 July 2026 and no other designated service, your notice is on time if AUSTRAC receives it by the later of 14 days after your name is entered on the Reporting Entities Roll and 29 July 2026 (AML/CTF Transitional Rules 2026, s 19). If you have not made a documented appointment, fix that first.
Seniority is the practical test, and the Act requires the AMLCO to be employed or engaged at management level (s26J(2)(a)). An AMLCO who has to ask permission before opening records, reallocating staff time or stopping a transaction is running the program at someone else’s pace, and the obligations do not slow down to match. The role needs someone whose decisions bind the firm, or every deadline sits behind an approval chain that was never built for it.
Independence is the one people miss, and it is a statutory duty. The firm must ensure the AMLCO has sufficient authority, independence and access to resources and information to perform the role effectively (s26J(2)(b)), and that is a civil penalty provision (s26J(5)). It sits beside the eligibility test in s26J(3) rather than inside it. It matters because the AMLCO decides what gets checked, what gets reported and what gets stopped, and the same person should not sit on both sides of those decisions. In a small firm that is easier to want than to arrange.
Access is the third practical test, after seniority and independence, and it is part of the same duty in s26J(2)(b): the systems, the records and the staff time the role depends on. An AMLCO without them has the title and nothing else, and an appointment that cannot operate is not an appointment at all.
In most Tranche 2 firms the AMLCO is a principal, a partner or a practice manager: someone already accountable for how the firm runs. In a firm of one, the sole practitioner is usually the only candidate, and holding the role yourself is workable if the record of the appointment acknowledges the conflict and says how it is managed. A firm with several offices or service lines needs the role held by someone who can see across all of them. Whether a single AMLCO can cover several entities in a group is not something we can confirm, so if your structure has more than one reporting entity in it, plan on an appointment for each until you have advice saying otherwise.
What the role is accountable for
The AMLCO is accountable for the reporting, and the deadlines are specific. A suspicious matter report (SMR), the report AUSTRAC receives when you form a suspicion about a matter, is due three business days from the moment the suspicion forms, or 24 hours where it relates to terrorism financing, under s41(2) of the Act. Where you reasonably believe some (not all) of the information the report must contain may be privileged, and the privilege belongs to someone other than your firm (usually your client), the report goes with an LPP form, the privilege claim form AUSTRAC accepts for the withheld information, and a non-terrorism report is due in five business days under s 41(2)(aa); the privilege page works through those paths. A threshold transaction report (TTR), for cash of $10,000 or more, is due within ten business days under s43(2). Each of those clocks is owned by the AMLCO: the systems that make them visible, and the escalation that meets them.
The role also owns the secrecy side. Under s123 of the Act, tipping off is an offence: disclosing that a suspicious matter report has been given or is required to be given, or the report itself, a copy of it, or a document setting out what it contains (including that a suspicion was formed), where the disclosure would or could reasonably be expected to prejudice an investigation, whether or not one has started (s123(1) to (3)). It applies to the firm and its officers, employees and agents, including people who have left, and limited exceptions apply (s123(4) and (5)). The maximum penalty is two years imprisonment, 120 penalty units, or both. The AMLCO is the person who makes sure staff can raise a suspicion without the subject of it finding out, and the tipping-off page covers the shape of that offence.
The day-to-day work is the due diligence the firm performs before a service is provided: who the customer is, who ultimately owns them, and whether the transaction matches what they have said. Higher-risk customers get deeper checks, on where the money comes from and what the transaction is for. The AMLCO sets how all of this happens, checks that it happens, and decides where the line sits between a standard check and a deeper one. The AML/CTF program is the document the role runs, and the independent evaluation is the check on it: the evaluator has to be independent of the program’s design and operation, which is why the AMLCO usually cannot be the evaluator.
Records sit with the role as well. The program, the due diligence files, the reports and the reasoning behind decisions are retained for seven years, and the AMLCO is the person who can produce them when asked.
The role does not absorb the firm’s obligations. Naming an AMLCO does not make the firm compliant, does not move liability, and does not reduce what you must do. It creates a person who owns the program, which is why the appointment matters and why a name on paper with nothing behind it changes nothing.
What catches people out
The obvious candidate can be the one with the conflict. In a small firm, the person with the time and the knowledge is often the practitioner whose own work the program exists to check. Name that person, and the decision-maker is deciding on their own engagements: whether their own customer’s transaction is suspicious, whether their own file gets the closer look. The consequence is a program whose checks are applied by the person they exist to catch, and an independent evaluation that flags the appointment rather than passing it.
The role carries personal accountability. When a report is late or a customer was never verified, the questions run to the person who owned the program, not only to the firm. The named AMLCO answers for the program personally, which is a reason to give the role what it needs and to record the appointment and its scope rather than leave it informal.
A nominal appointment is a failure in its own right. Name someone and give them no access to the systems they must oversee, and the firm has the appearance of a program with none of the operation: the AMLCO cannot see the flags, the files or the deadlines, so reports go out late and transactions go unchecked. The consequence is a program that is treated as not operating, because the person accountable for it never had the means.
What is still unsettled
The eligibility requirements and the statutory deadlines above are settled. What sits around them is less so.
The AML/CTF Rules (2025) were remade with new numbering, so any rule reference you find in older guidance needs re-checking before it goes into your own procedure. The AMLCO is not part of the enrolment content the Rules set out (Rules 3-2 to 3-5), but you must notify AUSTRAC of the appointment separately, within 14 days (s26M(1)), or for a firm that provided only Tranche 2 services before 1 July 2026, and no other designated service, by the later of 14 days after its entry on the Reporting Entities Roll and 29 July 2026 (AML/CTF Transitional Rules 2026, s 19).
Write the appointment and its reasoning now, and expect to revise both as the detail firms up.
Where to start
Start here:
- Name the person: choose the AMLCO and write down the reasoning: seniority, independence, access. If the only candidate has a conflict, record how it will be managed rather than leaving it unspoken.
- Give the role working access: the systems, the records, the staff time, and a private route for staff to raise concerns without the subject of a suspicion finding out.
- Write the appointment into the program: the appointment, its scope and its limits belong in the AML/CTF program, approved and recorded, so the independent evaluation checks a real role rather than a name on paper.
How duely handles this
The AMLCO is a single role, not a permission that several people can hold, and it comes with a console only that person can open. Appointment details and the cadence dates sit on the firm record, and the escalations that need AMLCO attention (risk, sanctions, review outcomes) land in one queue rather than being spread across the product. Approving an AML/CTF program is blocked while no AMLCO is appointed, so the appointment cannot be quietly deferred.