A Complete Guide to AML Compliance for Australian FinTechs

Four Key AML Compliance Requirements for Australian FinTechs

Under the AML/CTF Act 2006, FinTechs must meet four key obligations that reflect the private sector obligations set out by the Financial Action Task Force (FATF). 

1. Register with AUSTRAC

Firms that provide designated financial services must enroll with AUSTRAC. This covers all firms that provide services listed in Article 6 of the AML/CTF Act, including account or deposit-taking, lending and credit, currency exchange or investments, insurance, wires and remittances, etc. To register with AUSTRAC, FinTechs will observe the following steps:

• Complete registration forms: Fill out the necessary forms, providing detailed information on the firm's ownership, structure, and AML/CTF program.

• Submit supporting documents: Attach relevant documents, such as the AML/CTF program, risk assessment, and organizational charts, as part of the registration submission.

• Await verification and approval: AUSTRAC will review the submitted information and documents. Once satisfied with the firm's compliance, AUSTRAC will approve the registration, allowing the firm to operate legally. Once approved, some reporting entities are required to pay an annual industry contribution levy.

• Renewal: Once registered, remittance service providers and digital currency (cryptocurrency) exchange (DCE) providers must apply to renew their registration every three years.

2. Develop and Maintain an AML/CTF Compliance Program

Creating a robust AML compliance program requires a combination of policies, procedures, training, and technology to effectively mitigate the risks associated with money laundering and terrorism financing. To develop an effective and efficient AML/CFT program, firms should:

• Conduct a risk assessment: The risk assessment should identify and evaluate the money laundering and terrorism financing risks associated with the firm's business activities, clients, and geographic locations.

• Appoint a Compliance Officer: Designate a qualified individual as the AML Compliance Officer responsible for overseeing the development, implementation, and maintenance of the AML compliance program.

• Develop policies and procedures: Create written policies and procedures tailored to the firm’s risk profile, addressing CDD, record-keeping, reporting, and other AML/CTF measures required by regulations.

• Create record-keeping systems: Implement systems for maintaining accurate and up-to-date records of customer transactions, identity verification, and any suspicious activities, meeting regulatory requirements for record-keeping.

• Establish ongoing monitoring and review measures: Create procedures for ongoing monitoring of customer transactions, periodic reviews of the AML program's effectiveness, and prompt adjustments to address emerging risks or regulatory changes.

• Conduct independent audits and testing: Carry out periodic independent audits and testing of the AML compliance program to assess its effectiveness, identify weaknesses, and implement improvements as necessary.

3. Reporting Obligations

FinTechs must also develop clear protocols for reporting suspicious transactions or activities internally and externally, ensuring compliance with regulatory reporting requirements to relevant authorities. Among the reporting obligations expected of Australian FinTechs include:

• Threshold transaction reports (TTRs): FinTechs in Australia are obligated to submit TTRs to AUSTRAC for transactions equal to or exceeding the prescribed threshold amount. These reports help monitor large and potentially suspicious transactions, aiding in the detection of money laundering and other financial crimes.

• International funds transfer instruction reports (IFTIs): Firms must report IFTIs to AUSTRAC, providing details on cross-border transfers of funds. This obligation assists in tracking international financial flows and identifying potential instances of money laundering or terrorism financing.

• Cross-border movement reports: FinTechs are required to report certain cross-border movements of physical currency or bearer negotiable instruments to AUSTRAC. This reporting obligation helps prevent illicit cash movements across borders and contributes to efforts in combating money laundering and related activities.

• Suspicious matter reports (SMRs): FinTechs have a duty to submit suspicious matter reports to AUSTRAC when they have reasonable grounds to suspect a transaction or activity is related to money laundering, terrorism financing, or other financial crimes. SMRs play a crucial role in facilitating the investigation of potentially illicit activities, contributing to the overall integrity of the financial system.

4. Record Keeping

Undertaking AML/CTF requirements generates a significant amount of data. To help the work of AUSTRAC and wider law enforcement, firms are expected to maintain records on AML/CFT operations for a minimum period of seven years, providing them to official bodies of law enforcement on request. 

Datasets firms should keep a record of include:

• Transactions records: These records document the details of financial transactions conducted by a business. They include information such as the date, amount, parties involves, and nature of the transaction. Maintaining these records is crucial for financial transparency, audit trails, and regulatory compliance. 

• CDD/know your customer (KYC) data: This data includes personal and financial information, enabling businesses to identify and prevent potential financial crimes, such as money laundering and fraud.

Information about the firm’s AML/CTF program:Relevant information includes documentation of policies, procedures, risk assessments, and internal controls aimed at ensuring compliance with laws and regulations.

AML Compliance Challenges for FinTechs in Australia

Australian law sets clear requirements concerning a FinTech’s key obligations, particularly what needs to be in its AML/CTF program. However, when it comes to implementation, there are challenges, which can be grouped into three areas – paper, people, and platforms.

• Paper: Starting a new business requires documentation, which is mandated by Australian law and provides visible evidence of the firm's understanding of its responsibilities. Without it, confidence in the firm falls immediately. The documentation should cover policies, processes, and procedures for every aspect of the key obligations.
• People: As a company grows, it needs to hire more staff for the AML/CTF compliance team. The team’s size and structure depend on the business’ nature, and growth can lead to dedicated teams for each aspect of AML/CTF. These teams are structured into the "Three Lines of Defense." The first line deals with daily risks, the second line creates the AML/CTF program, and the third line evaluates the results. The AML/CTF department can eventually become large and extended.
• Platforms: Firms face practical challenges related to technology in AML/CTF functions. Multiple platforms are used to collect, maintain, and process data, including customer relationship management (CRM) systems, identification and verification (ID&V) platforms, screening, monitoring, case management systems (CMS), and social network analysis (SNA) tools. Simply having a tool in place is not enough to fulfill AML/CTF obligations effectively. The platforms used must be appropriate for the firm's needs.

Penalties for Non-Compliance with the AML Regulations

Non-compliance not only poses legal risks but can also lead to reputational damage and loss of trust among customers and stakeholders. FinTechs should therefore prioritize a comprehensive approach to AML compliance, integrating technological solutions and proactive risk management strategies.

Depending on the circumstances, firms could face the following penalties from AUSTRAC:

• Civil penalty orders: These can be up to 100,000 penalty units, with each unit worth $313 if the date of offence is after July 1, 2023.

• Enforceable undertakings: This is a written agreement between AUSTRAC and a firm that has not complied with the AML/CTF Act. Typically, these agreements include: 

• An acknowledgement from the firm that the law has not been followed.

• An agreement from the firm to complete certain actions to become compliant.

• A commitment from the firm to future compliance measures.

• Infringement notices: These are monetary penalties that can range from thousands to millions of dollars depending on the nature and extent of the non-compliance.

• Remedial directions: This is a written instruction that requires firms to take specific actions to comply with the AML/CTF Act. The purpose of a remedial direction is to ensure that firms do not breach the same part of the Act again. 

• Written notices: AUSTRAC can issue written notices requiring firms to appoint an external auditor or carry out a money laundering and terrorist financing (ML/TF) risk assessment. The regulator can do this if it suspects non-compliance or deems a ML/TF assessment to be inadequate or outdated.

Best Practices for FinTechs to Meet Australia's AML Requirements 

Due to the numerous aspects of Australia’s AML/CTF regime and the intricate and diverse nature of modern financial services, each firm must develop its own plan to address its compliance obligations. While these are decisions each business has to make for itself, the following best practices can assist FinTechs in meeting Australia's AML requirements:

• Regularly assess and update risk profiles: Regular risk assessments allow FinTechs to identify emerging risks promptly. Using historical data and industry intelligence helps stay ahead of evolving risks. It’s crucial to ensure that risk assessments are not static and are revisited periodically to align with the dynamic nature of the financial landscape.

• Empower staff through ongoing training: Fostering a culture of compliance involves providing regular training on AML/CTF policies, emerging risks, and regulatory updates. Encouraging awareness of the impact of financial crime is essential. Simulated exercises can be valuable for testing staff responses to potential AML/CTF scenarios, reinforcing preparedness.

• Initiate regular internal audits and reviews: Setting up a dedicated internal audit team is pivotal for assessing the effectiveness of AML/CTF procedures. Developing a checklist based on regulatory requirements and industry best practices provides a structured approach. Acting promptly on audit findings and updating policies and procedures as needed contribute to a robust compliance framework.

• Foster collaboration with authorities: Establishing a designated liaison for communication with AUSTRAC and other relevant authorities is key. Actively participating in industry forums and engaging in open dialogue on AML/CTF challenges promotes collaboration. Sharing relevant information and intelligence with authorities strengthens the collective effort against financial crime.

Automated AML Software Solutions for FinTechs

To ensure regulatory compliance, the Australian FinTech industry must implement strong AML solutions that are tailored to their risk appetite. When selecting vendors for AML solutions, firms should evaluate the capabilities of the following software:

• Fraud detection: Advanced fraud detection solutions leverage machine learning algorithms to scrutinize financial transactions in real-time. These systems proactively mitigate potential fraudulent activities by analyzing patterns and identifying anomalies. 

• Transaction monitoring: Sophisticated transaction monitoring tools are crucial to AML systems. They continuously analyze financial transactions, employing both rule-based and behavioral analysis to identify deviations from typical patterns. Automation ensures ongoing surveillance, enabling FintTechs to mitigate the risk seamlessly.

• Payment screening: Payment screening solutions enable FinTechs to screen transactions against various databases, ensuring compliance with international sanctions and regulatory requirements. Real-time screening and integration with global watchlists facilitate prompt intervention, preventing illicit fund transfers and supporting compliance with Australian AML laws.

• Sanctions and watchlists screening: Sanctions and watchlist screening software enable firms to screen in real-time and take swift action when sanctioned entities are detected. 
• Adverse media screening: Advanced adverse media screening software employs natural language processing (NLP) capabilities to scan news sources and public records for negative information associated with customers or transactions. This comprehensive analysis aids in risk assessment, allowing FinTechs to make informed decisions based on early detection of adverse media.