Banking
AML in banking
Banks were first into Australia's AML/CTF regime and remain the most supervised part of it. What the obligations require, what must be reported, and what changes in 2026.
Last reviewed
Banking sector obligations
Banks and other authorised deposit-taking institutions were among the first businesses captured by Australia's AML/CTF regime, and they remain the most heavily supervised. The obligations come from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, and they attach to the designated services a bank provides rather than to the label "bank": accounts and deposits, loans, currency exchange, international funds transfers, custodial services and more.
AUSTRAC is explicit about why the sector matters. The movement of funds, including internationally, is identified as a significant vulnerability for financial service providers, linked to money laundering, terrorism financing, tax evasion, corruption, scams and fraud. Banks are also the largest single source of the intelligence AUSTRAC and its law enforcement partners rely on.
What the obligations actually require
Six things, in practice. Enrol with AUSTRAC. Maintain an AML/CTF program grounded in a documented assessment of the institution's own money laundering and terrorism financing risk. Identify and verify customers, and their beneficial owners, before providing most designated services. Monitor the relationship and the transactions on an ongoing basis, applying enhanced due diligence where risk is higher. Report what the Act requires reported. Keep records for seven years and have the program independently evaluated.
None of that is unusual in outline. What makes banking distinctive is volume. At retail scale, customer due diligence and transaction monitoring cannot be a matter of individual judgement applied case by case; they have to be systems that behave correctly by default, with human attention reserved for what the system escalates.
Reporting
Three reporting obligations do most of the work. Threshold transaction reports cover transactions involving $10,000 or more in physical currency. International funds transfer instruction reports cover instructions sent into or out of Australia, which is where a bank's cross-border exposure becomes visible to the regulator. Suspicious matter reports are due within three business days of forming the suspicion, reduced to 24 hours where it relates to terrorism financing.
Structuring deserves separate mention. Deliberately breaking a cash transaction into amounts below the threshold to avoid a report is itself an offence, and a monitoring programme that only looks for transactions at or above $10,000 will miss it by design.
What the 2026 reforms change
Two distinct changes land in 2026, and they are often conflated.
From 31 March 2026, existing reporting entities including banks move to reformed AML/CTF program obligations. The structure becomes more explicitly outcomes-based, built around a documented ML/TF risk assessment that drives proportionate controls, rather than the former split between a Part A programme of systems and controls and a Part B customer identification programme. For an institution with a mature programme this is a restructuring and re-evidencing exercise more than a change of substance, but it does have to be done and demonstrated.
From 1 July 2026, Tranche 2 extends the regime to professional services: lawyers and conveyancers, accountants, trust and company service providers, real estate professionals, and dealers in precious metals and stones. Banks are not newly captured, but they are affected. A substantial number of new reporting entities are their customers, many will need trust or business accounts appropriate to their new obligations, and the professional intermediaries that banks rely on for context about complex ownership structures will be running their own due diligence for the first time.
What enforcement has actually turned on
The largest outcomes in the sector are Westpac's $1.3 billion civil penalty in 2020 and Commonwealth Bank's $700 million penalty in 2018. Both concerned systemic failures sustained over years rather than isolated lapses: reporting obligations not met at scale, and monitoring that did not cover known risks. The instructive point is not the size of the penalties but their cause. In each case the institution had a programme. What it lacked was assurance that the programme was doing what it was documented to do.
That is the gap independent evaluation exists to close, and it is the question worth asking of any monitoring or due diligence arrangement: not whether a control is written down, but what evidence exists that it is operating.
Where the risk concentrates
-
Transaction and deposit accounts
Account opening is where identity is established for everything that follows, which makes it the control point AUSTRAC scrutinises hardest after monitoring.
-
International funds transfers
Moving value across borders is the exposure AUSTRAC singles out for banks, and it carries its own reporting obligation separate from threshold reporting.
-
Physical currency
Cash deposits and withdrawals at or above the $10,000 threshold require a threshold transaction report, including where structuring is used to stay beneath it.
-
Correspondent banking
Acting for another institution means relying on its controls. Due diligence on the relationship itself is a distinct obligation from due diligence on customers.
Common questions
What AML/CTF obligations do banks have in Australia?
Banks are reporting entities because they provide designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. They must enrol with AUSTRAC, maintain an AML/CTF program, identify and verify customers before providing most designated services, conduct ongoing customer due diligence including enhanced due diligence where risk is higher, monitor transactions for suspicious activity, submit threshold transaction reports, international funds transfer instruction reports and suspicious matter reports, keep records for seven years, appoint a compliance officer, and have the program independently evaluated.
Why is banking treated as high risk for money laundering?
Because banks sit at the point where value enters, moves through and leaves the formal financial system. AUSTRAC identifies the movement of funds, including internationally, as a significant vulnerability for financial service providers, linked to money laundering, terrorism financing, tax evasion, corruption, scams and fraud. Scale compounds it: the volume and speed of banking transactions means controls have to work automatically rather than case by case.
What reports do banks submit to AUSTRAC?
Three main types. Threshold transaction reports for transactions involving $10,000 or more in physical currency. International funds transfer instruction reports for instructions transmitted into or out of Australia. Suspicious matter reports where there are reasonable grounds to suspect a matter may relate to money laundering, terrorism financing or another serious offence, due within three business days, or 24 hours where the suspicion relates to terrorism financing. Reporting entities also submit periodic compliance reports.
What changes for banks under the 2026 reforms?
Existing reporting entities move to reformed AML/CTF program obligations from 31 March 2026, with a more explicitly outcomes-based structure built on a documented money laundering and terrorism financing risk assessment rather than the former Part A and Part B split. Separately, from 1 July 2026 Tranche 2 brings professional services including lawyers, conveyancers, accountants, trust and company service providers, real estate professionals and dealers in precious metals and stones into the regime. Banks are affected indirectly too, because many of those new reporting entities are their customers.
What are the largest AUSTRAC enforcement outcomes against banks?
The two largest against banks are Westpac's $1.3 billion civil penalty in 2020 and Commonwealth Bank's $700 million penalty in 2018, both resolved in the Federal Court. The $450 million penalty against Crown Melbourne and Crown Perth in 2023 is the largest outside banking. In each case the failures were systemic rather than isolated, which is the pattern worth attending to: reporting and monitoring gaps that persisted at scale over years.
Does transaction monitoring have to be automated?
The Act does not mandate a particular technology; it requires monitoring capable of identifying suspicious matters given the nature, size and complexity of the business. For a bank, that effectively means automated monitoring, because manual review cannot cover the transaction volumes involved. What AUSTRAC examines is whether the rules and thresholds reflect the institution's own risk assessment, whether alerts are actually worked, and whether the outcomes feed back into tuning.