Your Compliance Officer Is at the Beach Until January. AUSTRAC Says the Job Still Has to Be Covered.

Some time in the week before Christmas, the partner who agreed to be your AML/CTF compliance officer will switch on an out of office reply and disappear for three weeks. That is what holidays are for. The trouble is that the clients don't all disappear with them. A settlement is booked for 22 December. A client wants a company set up before the new year. Someone rings on 5 January asking whether they can pay the deposit in cash.

This is the first summer shutdown since Tranche 2 obligations started on 1 July 2026, so most small firms haven't had to plan one yet. AUSTRAC has thought about it. Its compliance officer guidance has a section headed "When an AML/CTF compliance officer is absent", and it is short, practical and more forgiving than people expect. The catch is that it judges the arrangements you made before you left.

What AUSTRAC requires while the compliance officer is away

The starting rule has no exceptions. You must always have someone fulfilling the functions of an AML/CTF compliance officer, and you must inform AUSTRAC of any person you designate as one (AUSTRAC, AML/CTF compliance officer, node 1290 (opens in a new tab), last updated 31 March 2026).

Then the relief. AUSTRAC gives short-term leave and illness as examples of absence, and says the responsibilities and functions of the role must be covered while the compliance officer is away. But they can be covered without designating another compliance officer, because the role is about overseeing and coordinating compliance. Unlike a senior manager, the compliance officer doesn't have to personally carry out the actions that meet a particular obligation (node 1290 (opens in a new tab)).

So nobody needs a new title for January. What AUSTRAC looks at instead is whether the cover worked. It names four things that decide whether the compliance officer met their functions during an absence (node 1290 (opens in a new tab)):

• the length of the absence
• how effective the arrangements are that the compliance officer has established to oversee and coordinate compliance
• how effective the arrangements are that the compliance officer has established so the business can communicate with AUSTRAC while they are away
• the nature, size and complexity of the business. Smaller businesses with less complex risk profiles may need less oversight and coordination than larger, complex ones.

Read the middle two again. Both are about arrangements the compliance officer has established. "Call me if anything comes up" is an arrangement, technically. Whether it is an effective one depends on whether anyone knows they are allowed to call, what counts as "anything", and whether there is reception at the campsite.

AUSTRAC also suggests that, where possible, you identify other eligible employees who could be the compliance officer, and make sure you can quickly designate a replacement if the current one becomes ineligible or is away for long periods (node 1290 (opens in a new tab)). Eligible means employed or engaged at management level, a resident of Australia if you provide designated services through a permanent establishment here, and a fit and proper person. In a smaller business, AUSTRAC says management level may be the owner, a director, or a person responsible for managing broader risks or operations.

If you do formally designate someone else, the usual paperwork applies. AUSTRAC must be notified within 14 days of the appointment using the enrolment form in AUSTRAC Online, and AUSTRAC expects your records to show who acted as compliance officer and when they acted (node 1290 (opens in a new tab)). The 14-day rule for enrolment details walks through that update.

The approvals nobody else can sign

The compliance officer's job can be covered by arrangement. The senior manager's can't. AUSTRAC says a senior manager must fulfil their obligations personally and can't delegate them (AUSTRAC, senior manager, node 1289 (opens in a new tab), last updated 25 March 2026). Those obligations include:

• approving your risk assessment, your AML/CTF policies and any update to either
• approving the start of a designated service to a customer you have established is a foreign PEP, or a high-risk customer who is also a domestic or international organisation PEP. That extends to beneficial owners who are those PEPs, and an existing customer who becomes one needs approval before you continue
• approving any written agreement with a third party that will collect and verify CDD information for you
• any other approvals your own AML/CTF policies require, and those policies must identify who is authorised to give them.

The full list, and who holds which role in a small firm, is in who signs what.

One sentence on AUSTRAC's page is your holiday plan if you have partners: if your business has more than one senior manager, any of them can meet these obligations (node 1289 (opens in a new tab)). Stagger the leave so one senior manager is always reachable, and check that your policies don't name only the one who is away.

With a single senior manager, the plan is blunter. Either that person stays reachable for an approval, or the client who needs one waits. A new client who screens as a foreign PEP on 29 December can't be started until the senior manager says yes.

The clocks that keep running

Several obligations come with deadlines, and none of the AUSTRAC pages that set them offers a pause for a business that has closed for the holidays. Four are worth listing before you lock the door.

Suspicious matter reports. An SMR is due within 24 hours of forming the suspicion if it relates to terrorism financing, and within 3 business days after the day you formed it for anything else. If you claim the SMR includes information protected by legal professional privilege, you have up to 5 business days, except for terrorism financing (AUSTRAC, suspicious matter reports, node 1338 (opens in a new tab), last updated 9 September 2026). Whoever is covering needs to know who takes the call on a suspicion and who files. The SMR guide covers the writing.

Threshold transaction reports. A designated service involving $10,000 or more in physical currency needs a TTR within 10 business days after the day the transaction takes place (AUSTRAC, threshold transaction reports, node 1340 (opens in a new tab), last updated 14 October 2026). Cash received on 22 December becomes a January deadline. More on the $10,000 rule.

Delayed initial CDD. If you started acting for a client before you finished verifying them under AUSTRAC's delayed CDD rules, you must complete initial CDD as soon as reasonably practicable and no later than 20 business days after you started providing the service. It also has to be done before you transfer money or property for the client, or otherwise make it available to them (AUSTRAC, delayed initial CDD, node 1311 (opens in a new tab), last updated 27 October 2026). A file opened that way in mid December hits its limit in January. (How delayed CDD works.)

Real estate counterparties. An agent brokering a sale may delay CDD on the party they aren't acting for. AUSTRAC's window for that CDD closes 28 days after the exchange of contracts, or at least 3 days before the initially agreed settlement day, whichever is earliest. The same window applies to a lawyer or conveyancer who starts helping a buyer before completing CDD (node 1311 (opens in a new tab)). Contracts exchanged on Friday 11 December reach 28 days on Friday 8 January. If your office reopens on the 11th, that file is already late. (Who your customer is in a property deal.)

Whoever covers needs training before they start

The person picking up onboarding in January may not be the person who usually does it. The office manager covers, or a contractor comes in for the summer. AUSTRAC's idea of personnel is wide. It includes contractors and consultants, paid and unpaid volunteers or interns, and people employed by service providers you use, when they perform roles relevant to your AML/CTF obligations (AUSTRAC, identifying personnel roles, node 1333 (opens in a new tab), last updated 20 October 2026).

Two rules follow. Personnel due diligence, including an assessment of the person's skills, knowledge and expertise for the role, must be done before they begin performing AML/CTF-related functions (AUSTRAC, personnel due diligence, node 1389 (opens in a new tab), last updated 13 April 2026). And on top of the initial training due at the start of someone's engagement, AUSTRAC expects training before any personnel take on new duties that may expose them to other ML/TF risks and AML/CTF functions (AUSTRAC, AML/CTF training, node 1335 (opens in a new tab), last updated 27 March 2026).

So the handover is a training session, and it needs a record: who, what and when. The detail is in our guides to personnel due diligence and staff training.

Someone else needs to be able to log in to AUSTRAC Online

SMRs are submitted through AUSTRAC Online (node 1338 (opens in a new tab)). If the only login belongs to the person about to go on leave, fix that now, because adding a user takes steps on both ends.

AUSTRAC's guide to managing users sets them out. New user accounts can only be created by sending an email invitation. Every user account must use a unique email address, so a shared inbox can be used by one user only. A new user then goes through a sign-up process that includes setting up multi-factor authentication. In AUSTRAC's worked example, it is the administrator who sends the invitations (AUSTRAC, how to manage contacts and users, node 1427 (opens in a new tab), last updated 27 March 2026).

That is a job for November, while the administrator is at a desk to send the invitation and the new user has time to finish sign-up and test a login. It is not a job for a Sunday in late December.

If you are a sole practitioner

For sole traders and micro businesses, AUSTRAC notes that one person will often hold all three governance roles: governing body, senior manager and compliance officer (AUSTRAC, governance for sole traders and micro businesses, node 1291 (opens in a new tab), last updated 20 October 2026). There is nobody to hand over to, and the absence guidance does recognise that smaller, less complex businesses may need less oversight (node 1290 (opens in a new tab)).

Your plan is shorter, not empty. Anything already moving when you close keeps its clock: the delayed CDD file, the counterparty CDD on a December exchange, a suspicion you formed on your last afternoon. Clear those before you go, or put a date in the diary to check in. AUSTRAC also allows you to outsource the compliance officer role, as long as the provider meets the eligibility requirements and you stay responsible for them meeting the role's requirements (node 1291 (opens in a new tab)). That is a bigger decision than a holiday. AUSTRAC's case against Mounties, where parts of the program were allegedly run by an outside provider, is a reminder that outsourcing the work doesn't outsource the obligation.

A one-page shutdown plan

Write it in November and keep it with your program.

1. Name the cover. Who oversees day-to-day compliance while the compliance officer is away, from which date to which date, and how they reach the compliance officer if they need to.
2. Name the AUSTRAC contact. Who responds if AUSTRAC gets in touch during the break, and how. AUSTRAC weighs this arrangement specifically.
3. Check the senior managers' calendars. One senior manager reachable for the approvals your policies require, or an agreed rule that clients needing one wait.
4. Add and test a second AUSTRAC Online user. Invitation sent, sign-up and multi-factor authentication finished, login tested.
5. List the open clocks. Delayed CDD files, real estate counterparty dates, December cash receipts, and anything being looked at as a possible SMR.
6. Train the cover before they start. Record who, what and when.
7. Tell the team the escalation path. If something looks unusual on 4 January, who do they call, and what do they write down?
8. Keep a note when you're back. Who acted, what came up and what was decided. It belongs in the compliance officer's next report to the governing body, which is owed at least once every 12 months (node 1290 (opens in a new tab)).

Where AML Mate fits

AML Mate works out each SMR's deadline from the date you formed the suspicion, counting business days with your state's public holidays, and raises an alert when it is less than 12 hours away. TTRs get a 10 business day deadline and an alert in the last 3 days. Training records carry a next due date, and AML Mate flags them as that date approaches. And because you can invite colleagues to your AML Mate account from the Team page, your client files aren't locked inside one person's login while they are away. If you are not sure which designated services your firm provides, the free compliance check starts there and doesn't need a signup.

This article is general information, not legal advice. It relies on AUSTRAC guidance current as at 9 November 2026. For advice specific to your circumstances, consult a qualified AML/CTF professional.