The AML/CTF independent review for law firms and conveyancers: who can do it, what it covers and when yours is due

Why the review exists

Your own reviews of the program check that it is up to date. The independent evaluation checks that it works: does it contain what the Act and the Rules require, does the risk assessment describe this practice honestly, do the policies answer those risks, and do the people in the firm actually do what the document says? The findings go to the partners or principal and feed the next version of the program.

Not the trust account examination

Legal profession law requires an external examination of the trust account each year. The AML/CTF independent evaluation is a different obligation under Commonwealth law, on different records: the program, the client files on designated matters, the reports and the training log. Your external examiner may be able to do both if they have AML/CTF knowledge, but one does not satisfy the other.

Who counts as independent

Someone with the skills to assess an AML/CTF program who was not involved in designing or operating it. The Rules do not require an external person; a partner with no compliance role could do it in a larger firm. In a practice of one to ten people the options are a compliance consultant, an accountant or lawyer with AML/CTF experience, or a reciprocal arrangement with a peer practice. The compliance officer cannot review their own program, and in a sole practice that means the review is always external.

What the reviewer looks at

• The program and its version history: enrolment, risk assessment, due diligence, monitoring, reporting including privilege handling, records, training, governance; each version approved by a senior manager.
• The risk assessment against reality: practice areas, entity work, overseas and remote clients, trust account flows, cash policy.
• Client files on designated matters, sampled: identification (VOI as evidence), verification, beneficial owners, risk rating, reviews.
• Reports: SMRs and TTRs lodged within the deadlines with the reasoning and any privilege claim on file; the annual compliance report lodged.
• Training and screening records.
• Findings table and recommendations, with management's response.

When it is due

At least once every three years. The Transitional Rules 2026 stagger the first evaluation for entities that became reporting entities with the reforms, by the last two digits of the AUSTRAC account number: odd then odd, 30 June 2029; odd then even, 31 December 2029; even then even, 30 June 2030; even then odd, 31 December 2030. After the first one, the three-year clock runs from each evaluation. A material change to the program is a reason to bring the next one forward.

Scoping it for a small practice

Agree the scope in writing: the program, a sample of client files on designated matters (say ten, across risk ratings and practice areas), all reports in the period, the training log, the compliance officer's notes. Half a day is realistic: an hour on the program and its history, an hour sampling files against the due diligence policy, an hour of interviews with the compliance officer and one or two staff, and the write-up. Ask for a short report with a findings table: requirement, what was found, rating, recommendation. File it with the program; the annual compliance report asks whether an evaluation was done.

What reviewers find most often in practices

Each of these is a record-keeping habit. A practice that keeps client records, reviews and training in one place walks into the review with the evidence already assembled, which is what PracticeAML's audit trail and exports are for.

• VOI done for PEXA but no AML record around it: no beneficial owners, purpose or risk rating.
• Risk assessments that never mention entity work or overseas clients although the firm has both.
• Trust account receipts from third parties with no note of why.
• Training recorded once, at commencement, and never again as staff joined.
• Program updates without a recorded approval.