What is anti-money laundering?

Money laundering is usually described in three stages. Placement gets dirty cash into the financial system, for example by depositing it across several merchant accounts. Layering hides where it came from by pushing it through a chain of transfers, accounts and crypto conversions, often offshore. Integration brings it back as apparently lawful money: a property purchase, a business loan to a related entity, or high-value equipment.

AML controls are designed around those stages. In business finance the common tricks are manipulated invoices and sham transactions, so lenders check that a deal makes commercial sense, that the customer's funds match its trading history and that money goes to and comes from the parties named in the contract.

The Act applies to reporting entities: businesses that provide a designated service. The list is wide. It takes in banks and other credit providers, remittance and foreign exchange services, casinos and gaming operators, digital currency exchanges, trust and company service providers, dealers in bullion and high-value goods, and some business finance and merchant services. Real estate agents, conveyancers, lawyers and accountants are caught when they provide specified services such as conveyancing or trust work.

If you provide one of those services you must enrol with AUSTRAC within the statutory window after you start providing it, and remittance and digital currency exchange providers must be registered before they begin. The obligations scale with your risk: a small remitter runs a simpler program than a bank, but the same principles apply. If you are unsure whether you are caught, AUSTRAC's guidance and the Act itself are the places to check.

Every reporting entity needs a written, risk-based AML/CTF program with a nominated compliance officer, staff training and periodic independent review. The program has to identify the risks in its customers, finance options, delivery channels and the countries it deals with, then set controls to match.

Day to day, that means identifying and verifying customers before providing a designated service, applying enhanced due diligence to higher-risk customers, and monitoring transactions for patterns that do not fit. Three reports go to AUSTRAC: a suspicious matter report as soon as a suspicion forms, threshold transaction reports for large cash transactions, and reports of international funds transfers. Records of identification, transactions and the program itself must be kept for the statutory period so that AUSTRAC can audit them.

AUSTRAC can investigate, bring civil penalty proceedings, direct remediation and refer intentional conduct for prosecution. Its high-profile cases against a major bank and a large wagering operator both turned on the same failures: transaction reports that were never lodged, weak customer due diligence and monitoring systems nobody was checking.

Enforcement focuses on systemic problems rather than one-off mistakes. A business that keeps dated records of its risk assessment, its remediation work and its independent reviews can show good faith if AUSTRAC comes knocking. Compliance also protects the business itself: an Australian credit licence holder with weak AML controls is exposed to legal, financial and reputational risk well beyond the fine.