Somewhere in your AUSTRAC Online account is your AUSTRAC account number. You received it when you enrolled, you have quoted it on forms, and you have almost certainly never looked at the last two digits. AUSTRAC has. Under the transitional rules, those two digits decide the deadline for your first independent evaluation (AUSTRAC, AML/CTF Transitional Rules 2026).
If that sentence raised the question "my first independent what?", this article is for you, because the obligation comes with homework that is due long before the evaluation is.
One program, three kinds of scrutiny
The reformed Act puts your AML/CTF program under three different microscopes, and they are easy to blur together.
The first is your own review. You must monitor your risk assessment and policies yourself and review them when triggers fire, a new service, a new delivery channel, an AUSTRAC communication about emerging risks (AUSTRAC, review and update your AML/CTF program). That is internal, continuous, and trigger-driven rather than calendar-driven.
The second is the independent evaluation, and it is separate by design. Your AML/CTF policies must ensure that someone independent periodically evaluates how you did your risk assessment, whether your policies are designed to meet the Act and Rules, and whether you actually complied with your own policies in practice (AUSTRAC, conduct an independent evaluation). AUSTRAC's guidance is explicit that this sits in addition to your own reviews.
The third is the one nobody schedules: an external audit ordered by AUSTRAC under section 162, at your expense, like the order served on Bankstown District Sports Club. You cannot diarise that one. The independent evaluation, by contrast, arrives on a date you can already look up.
Check two digits, get a date
Independent evaluations must happen at whatever frequency your policies set, and at least once every 3 years (AUSTRAC, conduct an independent evaluation). For the tens of thousands of firms that entered the regime in 2026, that raised an obvious scheduling problem: if everyone's clock started on 1 July 2026, everyone's first evaluation would fall due in the same quarter of 2029, chasing the same small pool of evaluators.
So the transitional rules stagger the start. If you are a newly regulated business, you will comply with your policy frequency requirements if you conduct your first independent evaluation by a date determined by the last two digits of your AUSTRAC account number (AUSTRAC, AML/CTF Transitional Rules 2026):
| Last two digits of your AAN | First evaluation due by |
|---|---|
| Both odd | 30 June 2029 |
| Second-last odd, last even | 31 December 2029 |
| Both even | 30 June 2030 |
| Second-last even, last odd | 31 December 2030 |
A firm whose account number ends in 37 owes its first evaluation by 30 June 2029. A firm ending in 82 has until 30 June 2030. Same obligations, same enrolment month, a year apart, decided by digits nobody chose.
Existing reporting entities that were enrolled on 30 March 2026 and have already had an independent review under the pre-reform Rules work differently: their first evaluation is due by the later of 4 years after that review or 31 March 2027 (AUSTRAC, AML/CTF Transitional Rules 2026). If that is you, the diary entry comes from your last review report, not your account number.
After the first evaluation, the transitional arithmetic falls away and the frequency written in your own policies takes over, subject to the 3-year minimum.
The 2029 deadline has 2026 homework
Here is the part that matters this month rather than in three years. The evaluation may be distant, but the policies that govern it are a present-tense obligation. Your AML/CTF policies must already set out the frequency of your independent evaluations, appropriate to the nature, size and complexity of your business, and AUSTRAC expects you to document the rationale for that frequency. They must set out how you will determine that an evaluator is independent and suitable. They must set out what the evaluator will do, and how your business will respond to the findings (AUSTRAC, conduct an independent evaluation).
A program that is silent on independent evaluation is incomplete now, in August 2026, even though no evaluator will darken your door before 2029. If your program came from a template that predates the reform, this is a section worth checking today, because the old regime's "independent review of Part A" is not the same thing and no longer describes the obligation.
Who is actually allowed to evaluate you
There are no mandatory qualifications for the evaluator. There is instead an independence test, and in a small firm it bites harder than you might expect. AUSTRAC expects your evaluator to have the authority to exercise independent judgement, and expects that they are not responsible for implementing or maintaining the program, were not involved in developing it, were not involved in assessing your risks, and are not your compliance officer or part of the compliance team (AUSTRAC, conduct an independent evaluation).
Run that list against a four-person practice. The compliance officer is out. The partner who wrote the program is out. Whoever sat in the room for the risk assessment is out. An internal evaluator is technically allowed, AUSTRAC gives an internal audit team as the example, but firms with an internal audit team are not reading this paragraph. For most small firms, independent means external.
Suitability is the other half: AUSTRAC expects the evaluator to know the AML/CTF obligations that apply to your business and to have experience in your sector and its risks. Certifications, professional body membership and prior evaluation work are all listed as things worth considering, not requirements (AUSTRAC, conduct an independent evaluation). Your policies are supposed to record how you will weigh this, and your records are supposed to show why the person you eventually picked qualified.
The report goes up, not in a drawer
The evaluation ends in a written report. AUSTRAC expects it to summarise the evaluation process, the findings on your risk assessment and policy design, the findings on whether you complied with your own policies, and what was tested and sampled. Your policies must require the report to go to your governing body and to any senior manager responsible for approving the program (AUSTRAC, conduct an independent evaluation). In a small firm those titles usually map onto one or two heads, but the delivery still needs to happen, and be seen to happen.
Adverse findings carry consequences. If the report finds problems with your risk assessment, you must review it and update it if required, and update your policies to match. If it finds problems with your policies, same drill. Updates you make must be documented within 14 days of making them (AUSTRAC, conduct an independent evaluation). You are allowed to disagree with a finding, but AUSTRAC expects the disagreement and its reasons on paper, not in the pub.
And all of it is a records exercise. AUSTRAC lists what it expects you to be able to produce: the report itself, the sampled files, records of the discussions with senior managers and the governing body, why you considered the evaluator suitable, how you addressed each finding, and who was responsible (AUSTRAC, conduct an independent evaluation). That folder belongs in the same discipline as the rest of your AML/CTF record keeping.
Why going early is not just keenness
AUSTRAC's guidance makes an unusual move: it suggests newly enrolled entities consider conducting the first evaluation earlier than the transitional deadline, because problems get found while they are still cheap to fix, and because evaluators with the right skills may be more readily available now than in the 2029 crush (AUSTRAC, conduct an independent evaluation).
There is a quieter reason too. An evaluation of a program that has been running, with risk ratings someone actually decided, reviews that actually happened and records that actually exist, is a health check. An evaluation of a program that sat untouched since enrolment is an autopsy. The evaluator tests whether you complied with your own policies, and three years of quiet non-compliance is exactly the kind of adverse finding that then obliges you to rebuild under time pressure.
Fifteen minutes this week
- Log in to AUSTRAC Online and read the last two digits of your account number. Write the matching deadline from the table above into your compliance calendar.
- Open your AML/CTF program and find the independent evaluation section. Check it states a frequency, the rationale for it, how you will pick an evaluator, and what happens to the report. If any of that is missing, that is a gap to close now, not in 2029.
- Start a shortlist of possible evaluators, even a rough one. Your accountant's AML adviser, a sector consultant, a practitioner from a firm that is not yours. The independence rules above are the filter.
- Keep the records habit going, because the evaluation is ultimately a test of whether your paper trail matches your policies. If your program lives in AML Mate, the program editor keeps versions, approvals and review dates stamped as you go, and the audit export hands an evaluator the document trail in one file instead of a shoebox.
The transitional rules did something quietly sensible here: they turned a stampede into a queue. The cost of that favour is that your place in the queue is already assigned, printed in two digits you have never read, on a number you already have. Look it up. Diarise it. Then make sure the program the evaluator eventually reads is one that has visibly been alive the whole time.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.