Common AML Compliance Mistakes to Avoid

Anti-money laundering and counter-terrorism financing (AML/CTF) compliance often breaks down in ordinary business moments. A client is onboarded too quickly. A risk assessment is copied from a template. A staff member notices something unusual but does not know who to tell. A policy exists, but no one follows it.

These mistakes are common because AML/CTF compliance is not just about having documents. It is about building a working system that helps your business identify, manage and respond to money laundering and terrorism financing (ML/TF) risks.

For Australian businesses, especially those affected by the Tranche 2 reforms, avoiding common AML compliance mistakes is important. Law firms, accountants, real estate businesses, conveyancers and other newly regulated sectors need practical processes that fit how their business actually operates.

This article looks at some of the most common AML compliance mistakes, why they can create problems and what businesses can do to build a stronger, more workable compliance framework.

Why AML Mistakes Usually Happen

Most AML compliance mistakes do not happen because a business is trying to ignore the law. They often happen because AML/CTF obligations are treated as a one-off project rather than an ongoing business process.

A business may enrol with Australian Transaction Reports and Analysis Centre (AUSTRAC), appoint an AML/CTF compliance officer, download a policy and assume the hard part is finished. In reality, the program needs to connect with client onboarding, staff training, risk assessment, customer due diligence, reporting, record keeping and internal governance.

These problems generally fall into three broad areas: having the wrong framework, failing to apply it properly and not maintaining it as the business changes. The mistakes below show how these issues can appear in practice.

Mistake 1: Using a Generic AML Program

A generic AML/CTF program may look complete, but it can fail if it does not reflect your business.

Your program should match your:

• Services
• Customer types
• Delivery channels
• Countries or jurisdictions
• Transaction types
• Staff roles
• Internal systems
• Actual ML/TF risks

For example, a law firm handling property and trust matters will not have the same risks as a real estate agency or accounting practice. A high-value dealer may need controls around expensive goods and payment methods, while a conveyancer may need stronger procedures for assessing source of funds where required.

A template can help with structure, but it should be customised before the business relies on it.

Mistake 2: Treating Risk Assessment as a Checkbox

The ML/TF risk assessment is one of the most important parts of AML/CTF compliance. A weak risk assessment can lead to weak policies, weak controls and poor decision-making.

Common AML risk assessment mistakes include:

• Rating everything as medium risk
• Not explaining why a risk rating was chosen
• Ignoring higher-risk services
• Not assessing customer types properly
• Missing foreign jurisdiction risks
• Overlooking delivery channel risks
• Not considering source of funds or beneficial ownership risks where relevant
• Failing to update the assessment when the business changes

A useful risk assessment should help the business decide what controls are needed. It should make the AML/CTF program more practical, not just fill a folder.

Mistake 3: Confusing Identity Checks With Customer Due Diligence

Verifying a customer's identity is important, but it is not the same as full customer due diligence.

Customer due diligence should help the business understand who the customer is, who owns or controls them, why they need the service, whether the activity makes sense and whether any higher-risk factors are present.

For companies, trusts and complex structures, this may include beneficial ownership checks. Depending on the customer and their ML/TF risk, it may also include source of funds or source of wealth checks, politically exposed persons (PEP) and sanctions screening, or enhanced customer due diligence.

A customer can provide valid ID and still present ML/TF risk. That is why customer due diligence needs to go beyond document collection.

Mistake 4: Not Having Clear Escalation Rules

Staff may notice warning signs before senior management does. The problem is that many businesses do not clearly explain what staff should do when something feels unusual.

Examples may include:

• A client refuses to explain the source of funds
• A customer provides inconsistent information
• A third party is paying without a clear reason
• Ownership is difficult to identify
• Instructions change suddenly
• A client pressures staff to move quickly
• The transaction does not match the customer profile

If staff do not know when to escalate, risk decisions can become inconsistent. A strong AML/CTF program should explain who receives escalations, what information should be recorded and when the AML/CTF compliance officer should be involved.

Mistake 5: Appointing an AMLCO Without Real Support

The AML/CTF compliance officer is not just a name to add to a form. This person needs enough authority, time, training and access to oversee AML/CTF compliance properly.

A common mistake is appointing a partner, director, practice manager or staff member without defining the role clearly.

The business should clarify:

• What the AMLCO is responsible for
• What support they will receive
• How staff escalate issues to them
• How they report to senior management
• How the AML/CTF program will be reviewed
• When external AML support is needed

For small businesses, the AMLCO may also have other duties. That can work, but only if the role is properly supported and the person has enough authority and resources to carry it out.

Mistake 6: Leaving Staff Training Too Late

AML/CTF training should not be treated as a one-time slide deck. Staff need to understand how AML/CTF applies to their role.

Client-facing staff may need to know how to identify unusual behaviour. Admin teams may need to know what records to keep. Managers may need to understand escalation and approval processes. AMLCOs may need deeper training on risk, reporting and governance.

Training should be practical. It should use examples relevant to the business, such as property transactions, trust structures, third-party payments, unclear source of funds, complex ownership or higher-risk customers.

If staff cannot apply the training in real situations, the training is not doing enough.

Mistake 7: Poor Record Keeping

AML/CTF compliance depends on being able to show what was done and why.

Poor record keeping can create problems even when the business tries to make the right decision. If there is no record of the risk assessment, customer due diligence, escalation, approval or review, it may be difficult to demonstrate that the business followed its process.

Businesses should keep appropriate records of:

• AML/CTF program documents
• ML/TF risk assessments
• Customer due diligence
• Customer risk ratings
• Enhanced due diligence decisions
• AML/CTF training
• Escalations and approvals
• Program updates
• Control testing and monitoring
• Independent evaluations and responses to findings

Good records support consistency, accountability and ongoing review.

Mistake 8: Not Updating the AML/CTF Program

AML/CTF compliance is not static. Businesses must review their ML/TF risk assessment and AML/CTF policies at least every three years, as well as when relevant changes or other review triggers require an update.

Review may be needed when:

• New services are introduced
• The business enters a new sector
• Customer types change
• Delivery channels change
• New technology is adopted
• Higher-risk matters increase
• Staff identify recurring issues
• AUSTRAC releases updated guidance
• An independent evaluation identifies gaps

A program should evolve with the business. If it does not, controls can become outdated or stop reflecting the risks the business actually faces.

Mistake 9: Ignoring Practical Implementation

Some businesses spend time creating documents but do not test whether staff can actually use them.

A practical AML/CTF framework should answer questions like:

• What happens when a client is onboarded?
• Who checks beneficial ownership?
• When are sources of funds or sources of wealth checks required?
• Who approves higher-risk customers?
• Where are records stored?
• How do unusual matters escalate?
• Who reviews the program?
• How are staff trained?

If the answers are unclear, the program may not work in practice.

How to Fix Common AML Compliance Gaps

A business can reduce AML compliance mistakes by keeping its framework practical and risk-based.

Start with these steps:

• Confirm whether your business provides designated services
• Complete a business-specific ML/TF risk assessment
• Develop or customise your AML/CTF program
• Appoint and support an AML/CTF compliance officer
• Build clear customer due diligence procedures
• Create customer risk rating rules
• Set escalation triggers for higher-risk matters
• Train staff based on their roles
• Keep clear records of decisions and reviews
• Review the program when risks, services or other relevant circumstances change
• Address findings from internal reviews or independent evaluations

The goal is not to create the largest possible compliance file. The goal is to create a system your team can follow consistently.

How One AML Can Help

One AML helps Australian businesses identify and fix AML compliance gaps before they become larger problems.

This includes support with AML/CTF program development, ML/TF risk assessments, AMLCO support, AUSTRAC enrolment preparation, customer due diligence procedures, staff training, starter kit support, AML health checks, independent evaluations and remediation.

For law firms, accountants, real estate businesses, conveyancers and other reporting entities, One AML can help turn AML/CTF obligations into practical processes that match the way the business operates.

If you are unsure whether your AML/CTF framework is meeting your obligations, One AML can help you review your current approach, identify gaps and put practical controls in place.

FAQs

What are common AML compliance mistakes?

Common AML compliance mistakes include using a generic AML/CTF program, weak risk assessments, poor customer due diligence, unclear escalation rules, unsupported AMLCO appointments, limited staff training and poor record keeping.

Is a template enough for AML compliance?

A template may help with structure, but it should be customised to your business, services, customers and ML/TF risks. A generic template may not be enough if it does not reflect how your business operates.

What is the biggest AML risk assessment mistake?

One of the biggest mistakes is treating the risk assessment as a checkbox exercise. The assessment should explain the actual risks your business faces and how your controls manage those risks.

Why is customer due diligence often done incorrectly?

Customer due diligence is often done incorrectly when businesses only collect ID documents and do not properly assess beneficial ownership, customer risk, source of funds, source of wealth or other higher-risk indicators where relevant.

How often should an AML/CTF program be reviewed?

AML/CTF policies and the ML/TF risk assessment must be reviewed at least every three years, as well as when relevant changes or other review triggers require an update. Businesses should also review their framework when their services, customers, delivery channels or ML/TF risks change.

Can One AML help fix AML compliance mistakes?

Yes. One AML can help review your AML/CTF framework, identify gaps, improve your risk assessment, update your program, support your AMLCO and help staff apply AML/CTF procedures properly.

Final Thoughts

Common AML compliance mistakes usually come from one problem: the business has documents, but the documents are not connected to real operations.

An effective AML/CTF framework should help your team identify risk, assess customers, escalate concerns, keep records and apply controls consistently. It should be clear enough for staff to use and specific enough to reflect your business.

For Australian businesses managing AML/CTF obligations, addressing compliance gaps early can save time, reduce confusion and support stronger compliance over the long term.

Contact One AML today to review your AML/CTF framework and take practical steps towards strengthening your compliance approach.

‍