Due diligence checklist, Australia
AML/CTF Act (AUSTRAC): what to ask a vendor
Anti-Money Laundering and Counter-Terrorism Financing Act 2006. AUSTRAC. Reporting entities keep customer identification, monitoring and AUSTRAC reporting in step with the Act and Rules.
What it is
Reporting entities keep customer identification, monitoring and AUSTRAC reporting in step with the Act and Rules.
Who it applies to
Applies to every financial institution in Australia, when procuring financial crime and fraud, payments, core banking, digital banking.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Customer identification and verification that meets the AML/CTF Rules | The identification and verification methods supported, the rules they follow, and the record kept for each check. |
| 2 | Suspicious matter, threshold transaction and international funds transfer reporting to AUSTRAC | The hosting regions and a data flow description naming every country data is stored in or processed from, and the transfer mechanism for anything leaving the country. |
| 3 | Seven-year record keeping for transactions and identification | The retention schedule showing how long records are kept, where, and how they are retrieved for the institution or a regulator. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have