Independent evaluation of your AML/CTF program.

The risk assessment is evaluated on how it was undertaken or reviewed. The evaluation reads the documents behind it, confirms that the reviews section 26D requires were carried out when a significant change occurred, when AUSTRAC communicated risk information, and in any event at least once every three years, and checks that the assessment was updated to address what those reviews found and approved by a senior manager under section 26P.

The policies are evaluated on design: whether each matter the Act and the Rules require the policies to deal with is dealt with, including customer due diligence, targeted financial sanctions, the actions that need senior manager approval, the information provided to the governing body, personnel due diligence and training, the assessment of potential suspicious matters, the prevention of tipping off, and the conduct of the independent evaluation itself.

Compliance is tested on sampled records. Customer files are sampled against the customer due diligence policies: what was collected, what was verified, how the customer was risk rated and whether ongoing due diligence ran as written. Transactions are sampled against the monitoring and reporting policies. Personnel records are sampled against the due diligence and training policies. The report records what was tested, which files were sampled, and how the tests and the sampling were carried out, because that is what AUSTRAC says the report will typically include. For an entity operating in more than one jurisdiction, the sample includes a reasonable share of the Australian operations, as AUSTRAC expects.

AUSTRAC expects the entity to give the evaluator access to the documents behind the risk assessment and the policies, the risk assessment and policies themselves, the relevant staff and senior managers, customer identification and transaction records, the results of the entity's own monitoring and reviews, and previous independent evaluation or review reports. The request list is agreed at scoping so the fieldwork runs against records that are already assembled.

AUSTRAC expects them to receive it as soon as reasonably practicable once it is prepared. Black Shard's report is written as a board paper: a summary of the evaluation process, the aspects of the business reviewed and the method used; findings on how the risk assessment was undertaken or reviewed and on the design of the policies; findings on compliance with the policies; and what was tested, the files sampled and how the tests and sampling were conducted. Each adverse finding names the provision of the Act, the Rules or the policy it concerns and the evidence behind it. The findings are presented to the governing body on request.

The response is the entity's. If the report contains adverse findings on the risk assessment, section 5-1 of the Rules requires a review as soon as practicable after the governing body receives the report, and section 26D requires the assessment to be updated to address what the review finds. If it contains adverse findings on the policies, section 5-4 requires the policies to be reviewed and, where required, updated. Any update to the risk assessment or the policies must be documented within 14 days after it is made, under section 5-15, and approved by a senior manager under section 26P. AUSTRAC states the entity need not agree with every adverse finding, and expects it to record how each finding was addressed, who is responsible, how progress is tracked, and the reasons for any finding it has not acted on.

Section 116 of the Act requires records reasonably necessary to demonstrate compliance with the program obligations, retained for seven years after they stop being relevant. For the evaluation that means the sampled files, the report, the record of the discussions with senior managers and the governing body, the record of why the evaluator was considered suitable, and the record of the response. The engagement closes with that set assembled.

The evaluation is delivered Australia-wide, with fieldwork run remotely against the entity's systems and records and on site where records are held on paper.

Section 26T disapplies subsection 26F(4) for a reporting entity whose designated services are all item 54 arranging services, so an AFSL holder that only arranges for its clients to receive designated services carries no independent evaluation obligation. Send a brief to info@blackshard.com.au with the sector and designated services, the enrolment date, whether a prior independent review was carried out and when, and the deadline the transitional rules set for the business. The independence check runs first, and the scope, the sample and the timetable to the governing body's meeting follow.