Ask most agencies about their AML/CTF program’s independent review, and you’ll often get a slightly confused answer. Some think it’s something AUSTRAC does to them. Others assume it’s an extra layer of red tape that only matters once you’re big enough to worry about it. Neither is right, and the confusion itself is worth clearing up, because an independent review is one of the more genuinely useful things in the entire AML/CTF framework, not just a box to tick.
Here’s what it actually is, why it’s yours to arrange rather than something imposed on you, and how to get real value from it rather than just a certificate to file away.
What “independent” actually means
The key word here is independent, not external. A common misunderstanding is assuming this has to be a third party consultant brought in from outside the business. What it actually requires is objectivity: the review needs to be conducted by someone who wasn’t personally responsible for designing or running the program day to day. For a larger agency, this could genuinely be an internal person from a different part of the business who’s had no hand in building the AML/CTF program. For most real estate agencies, given how small the compliance function typically is, an external reviewer is usually the practical way to achieve genuine independence, simply because there often isn’t anyone internal who both understands the requirements and had no involvement in creating the program.
The point isn’t where the reviewer sits on an org chart. It’s whether they can look at your program honestly, without any incentive to find it perfect because they built it.
What it’s actually for, and how it’s different from an AUSTRAC examination
This distinction matters more than almost anything else in this article. An AUSTRAC examination is something the regulator initiates, on their timeline, potentially with real consequences if serious gaps are found. An independent review is something your agency initiates, proactively, specifically so you find your own gaps before anyone else does.
Think of it less as an exam and more as a genuine health check. A good independent review isn’t trying to catch you out, it’s trying to give you an honest, accurate picture of whether your program, as written, actually matches what’s happening in your business day to day. That’s valuable regardless of whether AUSTRAC ever comes knocking, because a program that quietly drifts out of alignment with reality is a risk to your business whether or not it’s ever formally examined.
What an independent review actually examines
A genuine review goes well beyond checking that the right documents exist. It tests whether the program actually functions.
It checks whether your risk assessment still reflects your actual business, or whether the agency has quietly changed (new office, different transaction types, a new customer segment) without the document catching up. It samples real customer due diligence files to see whether staff are actually following the documented procedure, not just whether the procedure reads well on paper. It checks whether training has genuinely been delivered and evidenced for every relevant staff member, not just assumed. It looks at whether reporting decisions, including cases where staff considered a report and decided not to lodge one, were actually documented with reasoning, not just left as a gut call nobody wrote down. And it checks whether your record keeping could actually produce a complete file on request, rather than requiring someone to reconstruct history from memory.
This is, in effect, exactly the kind of ninety second scan we’ve described elsewhere: does the paper trail match the practice, consistently, across the business, not just in the cases someone happened to handle carefully.
How often you actually need one
AUSTRAC’s guidance is that independent review should happen at intervals appropriate to your agency’s size and risk profile, rather than a single fixed number that applies to every business identically. What that means in practice is a genuine judgement call, and it’s one worth making deliberately rather than by default.
What matters more than landing on the exact right interval is simply having a date on the calendar at all. Agencies that treat independent review as something to think about “eventually” tend to never actually get to it, and the program quietly ages without anyone checking whether it still holds up. Put a rough date in the diary now, even a provisional one, and treat pushing it back as a decision that needs a genuine reason, not something that happens by default because nobody raised it.
How to actually prepare
The instinct many agencies have is to scramble and tidy everything up right before a scheduled review, presenting the best possible version of the program rather than the honest one. This defeats the entire purpose. The value of an independent review comes specifically from it being accurate, not polished. If your reviewer only sees the version of your program that’s been freshly cleaned up for the occasion, you’ve paid for a review that can’t actually tell you anything useful, because it’s not looking at how your business genuinely operates most of the time.
Real preparation looks like gathering what already exists: your current Program Manual and its version history, a genuine cross section of CDD files (not just the cleanest ones), your training records as they actually stand, and any internal notes on transactions that were considered for reporting, whether or not a report was ultimately lodged. Let the reviewer see the real state of things. That’s what makes the findings worth having.
A worked comparison
One agency spends the two weeks before their scheduled review updating training records that had lapsed, backfilling missing notes in CDD files, and generally presenting a version of their program that doesn’t quite reflect how the past year actually went. The review comes back clean. Nothing has actually been learned, and the underlying gaps that prompted the scramble are still there, just better hidden for one point in time.
A second agency goes into their review with everything exactly as it stands, including a training gap for two staff members who joined mid year and a CDD file that’s missing a piece of documentation. The review flags both clearly. The agency fixes them properly, with a genuine record of when and how, and walks away with an actual improvement rather than a temporary cosmetic fix. If either agency is ever examined by AUSTRAC itself, only one of them has a program that’s actually been tested honestly.
What a review should actually produce
A proper independent review produces a written report: what was examined, what was found, and specific recommendations. That report itself becomes part of your evidence trail, proof that your agency takes the review process seriously and genuinely acts on what it finds, not just that a review technically took place at some point.
Where Lead Comply fits into this
Our Program Manual service is built around the understanding that a program only stays genuinely useful if it’s tested honestly against reality, not just written once and left untouched. We help agencies prepare properly for an independent review, and can conduct that review itself, bringing the same evidence first, documentation always standard we apply to building the program in the first place. If you’re not sure whether your current program would hold up to genuine scrutiny, or you’re due for a review and aren’t sure where to start, our free 30 minute Compliance Gap Audit is a useful first step before committing to the full process.
Create your free account and book No Obligation Compliance Gap Audit→ Lead Comply AML Portal
