S2/E4: The AML/CTF Act and the Reform, with Jeremy Moller

Introduction Welcome to the Financial Integrity Hubs podcast. At the Financial Integrity Hub, we pioneer research and explore how law and governance strategies can be designed, implemented and enforced to support anti money laundering and counterterrorism financing. This podcast is proudly sponsored by CFCE, providers of online modules to enhance capabilities across AML and CTF global and domestic ratio. These modules are carefully designed for professionals in diverse sectors, including public service, corporate environments and law enforcement agencies. By participating, individuals can gain a competitive edge in their careers and contribute more effectively to their organisations and communities. Find out more at courses.cfce.com dot AU. Speaker 2 Welcome to the Financial Integrity Hub podcast, the show with hot questions and even hotter insights at the intersection of law and financial. Speaker 3 Crime. I'm your host. Speaker 2 Doctor Hannah Harris and today we're speaking with Jeremy Muller, Senior Advisor at Norton Rose Fulbright Australia. Our topic today is Australia's updated Anti Money Laundering and Counterterrorism Financing Act the implications of the reforms for regulated entities, including new tranche to entities and the way reporting entities and other stakeholders can adapt and embrace these reforms as a key tool for combating financial. Speaker 3 Crime. Speaker 2 Reducing risk and building a safer and more just society. Jeremy is a seasoned risk advisory lawyer with over 15 years of experience specializing in anti money laundering, counterterrorism financing and international sanctions. He is a member of both the Law Council of Australia and the NSW Law Society's AML City of Working Groups and the NSW Law Society Ethics Committee. He serves on the Advisory Board of the Australasian Chapter of the Association of Certified Anti Money Laundering Specialists, ACAMS and is also a member of the Financial Integrity Hubs. Speaker 3 Reference group. Speaker 2 Jeremy provides valuable insight into the new requirements and the widened scope of the AML CTAF Act. Speaker 3 From updates to customer. Speaker 2 Due diligence and risk assessment protocols to the expansion of mandatory reporting requirements to previously unregulated tries to entities, including those in real estate and the legal and accounting professions. I thoroughly enjoyed our conversation and I hope you do too. Before we get started, remember to like and subscribe to the Financial Integrity Hub podcast on Spotify and YouTube, and follow the Financial Integrity Hub on LinkedIn to stay in the loop on upcoming news, events and cutting edge research. Speaker 3 Insights. Well, thank you so much for joining us and. Speaker 2 I'm really excited. Speaker 3 For our conversation. Speaker 2 Today discussing the. Speaker 3 Amended anti money laundering. Speaker 2 Legislation here in Australia. Speaker 4 Thanks, Hannah. Great to be here. Speaker 3 Before we jump into the details, bearing in mind that there's a kind of timely element to this 12 months out from those tranched to entities needing to have all their ducks in a row, I would really appreciate it if you give us. Jeremy’s background And our listeners A. Speaker 3 Brief background on. Speaker 2 Yourself and your experience. Speaker 3 In this space. Speaker 4 Yeah. So I started my career in New Zealand. I was a litigator. I was, I was during the global financial crisis, so primarily insolvency work. I had a background in law obviously, but also had done history and politics. So I wanted to travel the world after three years. And I finally after traveling all of 2013 ended up in London and I was actually working in house in risking appliance attains for law firms. And that's when the Russian sanctions started in 24/20/14. So for that reason, I started doing more work in that area and then came across to AML. But that's why I'm very focused on the tranche 2 sectors because I've done this in house within law firms and now for the last seven years back advising clients in this area. Speaker 3 We're very lucky to have this super relevant experience obviously, and with a really long history there in it as well. A whole nother podcast episode to be had on the relationship between AML and sanctions. But let's save that for the next season, shall we? So I guess what I'm now really interested in is your kind of insight into what motivated these changes and updating of Australia's AML Act. What motivated the changes to the AML Act? So obviously, these amendments have received kind of royal assent in December of last year and now we have a kind of staged rollout. You've already mentioned Tranche 2 entities, which I think will kind of be the focus of our conversation. But I'm wondering what your views are on what motivated these changes and what the intent really was behind this expansion. Speaker 4 Yeah, so Australia's had the Anti Money Laundering Act since 2006 and that was focused on what's known as the Tranche 1 entities. So casinos, banks, payment providers, entities like that. Tranche 2 has always been common. That's primarily lawyers, accountants and real estate among some other sectors, but it's really driven by the Financial Action Task Force, which is the global body that reviews countries legislation and also the effectiveness in implementing it. I think one of the challenges is Australia has a relatively short election cycle, but because we only have three-year terms, the challenge can be actually getting this legislation. And we've just gone through 2 consultations. And as you said, we get got the legislation passed late last year, but it means that we've taken 20 years to do this, and we're one of the last countries in the world. So for that reason, yeah, it, it has both taken a while. And the goal has also been to modernize and simplify the ACT, which we can talk more about. But yes, 100,000 you reported into these coming into the IMO Act as part of Tranche 2. Speaker 3 Amazing. Yeah. And I am always fascinated by the the depth of the consultation that goes into legislative updating in Australia is quite unique. I think the scale, as you point out, it can also take a really long time and we've seen it in other areas of legislation as well. Sounds like you're saying the motivation primarily, although it may have ebbed and flowed or been subject to that kind of political uncertainty as well. It's really bringing everything in line with global standards and also because it's taken so long, perhaps some more updating than was originally necessary 20 years ago or even 15 in that regard. Updates to existing reporting entities There are some updates to other aspects, not just trans to. So existing reporting entities will be required to add some additional compliance and risk based measured. Speaker 2 Is that accurate? Could you maybe speak to those a little? Speaker 3 Bit more too. Speaker 4 Yeah. So the act and the rules, the rules are currently drafted being updated and what it's to reflect is things like actually having a formal risk assessment obligation that was previously understood to be done, but not actually formally in the legislation. That also includes things like proliferation financing. So not just money laundering and terrorism financing, but now also proliferation financing. There's quite large changes to how CDD, so customer due diligence, there was some note KYC being conducted, so both when it's conducted but also the extent of it. So things about risk rating your customer upfront, you know more sanctions obligations. So actually formally noting the sanctions requirements under the anti money laundering regime and that includes things like what type of screening and due diligence that you would do there. Then there are quite large changes which are yet to be fully determined, but around value transfer and particularly changes to Australia's international funds transfer instruction reporting regime. So that's going to be overhauled. So that will be a large change for banks and payment providers. So those are probably some of the key ones. It is vast though, the level of change, and I think that's what a lot of existing reporting entities are grappling with is how do I make all of this change in the next year, before 31 March 2026? But also having the resource and the time to, you know, change technology and actually get the systems and processes in place. Speaker 3 So you're speaking to some of the really practical challenges that all reporting entities are going to face with these updates. And I really like that you're speaking to kind of the full scope of this. So not only are we expanding to a wider group of reporting entities, but we're also expanding the scope of the type of harms that the ACT is trying to address with the proliferation addition. And then some of the details around how that compliance that customer due diligence or know your customer obligations are actually utilized or applied in business. Now I'm imagining that businesses have already begun or have been for a long time, beginning and preparing for the application of these new obligations. Trends in the industry response to the new AML requirements Have you noticed any trends? Speaker 2 In the industry. Speaker 3 Response so far that you can speak to. Speaker 4 Yeah, I think it's tough because we have legislative certainty with the bill amending the ACT, but we don't yet have the rules. And so I think there it is hard to know when to start, but also because things like customer due diligence and some of the largest area of what they do. So that is a challenge for reporting entities at the moment trying to understand and kind of grapple with that. There's also and particularly for some of the new reporting entities, a desire to have guidance. So wanted to know how do I practically do this? But also how do I set up my systems and processes? You know, AML is a new thing that's being applied to them, but they've already got business procedures. So I think it's sometimes actually taking the law and taking the rules and actually going, how can we practically apply whether that's looking at my existing data flow, Do I have all the data in one place? What is my business process off? I'm a real estate agent. How do I actually try to transact at the moment? Am I dealing with a certain amount of due diligence that I already have in front of me? Global law firms, as an example, can leverage on what they do overseas. So is there existing risk assessment that you could utilize from one of your other offices and you can you plug into a network like that? But I think critically when we look at this and, and a true challenge of the regime is banks have to comply with it, but also a small practitioner. So one person, a real estate agent, one person sole practitioner is a lawyer and also, yeah, a small accounted firm. So the act and the rules has to speak to those groups. And when you look at lawyers alone, 93% of lawyers in Australia, the law firms are for partners or less, 89% are one. So when you think about that, it's trying to actually, well, AUSTRAC has a challenging job that they have to try and communicate with those various groups and trying to then actually be at a proper level of compliance. So I think that is some of the hardest part at the moment. But there is good resource out there, there's good expertise, but it's now just trying to go through that transition, that change management to make it much more effective. Speaker 3 Yeah. Thanks, Jeremy. A couple of really fascinating points there. I mean, obviously, Sir Ostrad being the regulator responsible for enforcement of the act and the new obligations and the kind of scope of their regulated community, particularly in size and capacity, I guess like a really big challenge there, right? Updates to the Act You also mentioned this is kind of Australia's lagging a little bit in updating its law to fit kind of global norms. And you mentioned just before that there's some guidance that we can look to overseas in terms of the practices that have been happening there potentially for a lot longer than here. I guess there's also a nice opportunity for businesses then to reflect on their existing compliance policies and practices, potentially get some benefit in updating those for more general application. But then as you pointed out also this challenge with size constraints, capacity constraints on smaller operators will a kind of risk based approach and this gets spoken about a lot in the AML space, but this risk based approach. The risk-based approach Idea. Will that assist? Speaker 3 With that in any way and maybe what is your understanding of the risk based approach because I find it a slightly amorphous concept that might be helpful to discuss. Speaker 4 Yeah, I think the phrase always comes back to size, nature and complexity. So if you're a smaller entity, you may only be dealing as a real estate agent and primarily domestic real estate transactions. So again, your control should fit that type of risk. If there's a foreign buyer, that may enhance the risk. But you would think a lot of transactions in Australia and real estate every day happened between, you know, people local, on the ground, relatively small amounts, the money and the big scheme of things. We're talking, you know, hundreds of thousands or multi million, but they're not hundreds of $1,000,000 deals or billions. So it's looking at that size, nature and complexity, other jurisdictions. I think it's helpful that New Zealand regulated a number of years ago and, and sort of just before COVID and have gone through a lot of this and that was in response to the Panama Papers. Given it's a smaller jurisdiction but has some similarities that actually helps with kind of looking at small business. So we can look at how that's impacted with accountants as well as real estate and take some of the learnings. And that's particularly in the rollout. So starting early, making it clear for people and not actually trying to overcomplicate it for those smaller entities. When you look at the larger entities, I think what we're doing is often looking at what happens in the UK and Europe. Of course, banks and payment providers are often multi jurisdiction and they have to comply in those jurisdictions as well. So thinking about how we get a more global standard and that's what the Financial Action Task Force is trying to drive towards this harmonization. I think the challenge is each jurisdiction does it slightly differently. So that's where we get a little bit caught up sometimes. Then you know, the complexity of it and you know, from my perspective, that's why people come see legal advices, you know, the different challenges and the different laws and rules based on different jurisdictions. But yeah, I think here there is an opportunity for change and development. One of the call outs I've made to the market is could we be one of the best in the world at doing this? And that doesn't mean over compliance or overburdening people. It actually means making it efficient, but making sure that we focus on how we can protect the community and get the best intelligence supplies to provide to AUSTRAC as regulator but also financial intelligence unit, because that is actually the purpose of this. Speaker 3 I love that, Jeremy, coming back to the underlying purpose and what we're trying to achieve here, which is obviously an effective regime, right, to try and prevent all of these really impactful harms that we've known are impacting our economy and global society for a really long time. So I really like that you're suggesting this is an opportunity to make Australia the best in the world at AML compliance and at the regulatory frameworks enforcement around that. I think that's a really optimistic perspective. And I wonder if you have any last thoughts or comments you'd like to make and maybe any final recommendations for industry in response in preparation for these amendments? Final recommendations for industry Yeah. I think the main thing is focus on whether you provide a designated service. So for those new Tranche 2 sectors, make sure you do a risk assessment. So that is one of the foundational things that you need to do. I think then looking at those points around, do you have an AML compliance officer, so you're going to need somebody in that role. Are they trained effectively? Do they need a level of certification? Can you reach out to your board and senior management to get their buy in, both from a sort of financial budgeting perspective, but also from a leadership? And then data, data, data. Do you have all of it in the right place? You know, you hire this new AML compliance person, they come in and they say, oh, I'm going to start my job, but I need the data right in front of me to be able to actually do that. So understanding that you may have to leverage it from your existing systems, whether that's your client relationship management tool, whether that's an onboarding system, whether it's actually a billing and finance system. How do we actually start this point of kind of going on the AML journey and thinking about what new technology you may need. And this is not a regime that means you have to spend loads of money just for the sake of it. But going back to the size, nature and complexity, how can you utilize technology to actually be in an enhancer and enabler? So just taking a couple of examples of that, whether it's a screening tool that looks at politically exposed persons and sanctions, because you've got to look at the ownership and control of sanctions as well. And that can be hard if you're just using, you know, the DFAT list, which is an Excel spreadsheet. So how can we actually leverage it that way? The other one being customer due diligence. So how do we look at the beneficial ownership? And if you're having to get the information up to, you know, people who own 25% that can be mean a number of chains. So therefore can you leverage this with products to actually set out how I see that beneficial ownership and do that customer due diligence it's? Speaker 3 Fantastic. That sounds like there's a lot to do, but you're really emphasizing that there's ways to do this efficiently and really focusing on efficiency and effectiveness rather than being overwhelmed by the full scope of what might be required. I know I said that was the last point, but when you mentioned technology and data, it got me thinking. Where to find guidance and recommendations And I also wondered, you've mentioned we're waiting for rules for guidance from from government, from AUSTRAC. Are there any kind of existing places that business can go to get other examples of guidance or recommendations that might support in this effort to decide which data they should be collecting? How is a good way to do it? What some of the tools that are available to us here in Australia might be? Speaker 4 Yeah, so the Law Council of Australia has done 18 months God vulnerabilities analysis of the entire legal profession, very similar to a risk assessment that was done by an independent lawyer in New Zealand who has a background in this area. So reports like that are really useful. The NSW Law Society has created a hub of information that can support lawyers. Other things that I think could be quite practical for business and I know will be of interest to some of the areas that you look into. It seems like if you've done a modern slavery report, now I know that looks at your supply chain, but you may have had some tools that you've used to look at your supply chain that you could use to assist customers. So if you're screening your supply chain, is that same tool can that be leveraged yet customers but also beneficial owners there? I think another thing to be thinking about is sanctions laws are already in place and you don't have to be regulated for that. It applies to me and you, it applies to businesses in Australia. So for that reason, you should have a little level of controls in place for already some of these things. And then when you're thinking about data again and going back to, you know what we were just saying before. Speak to your IT team, you know, speak to your HR team. They will have information about the employees that you may need to do due diligence on. You know, IT team will know what the systems look like, but also how they connect them together. So this really needs to be a group effort. So I often talk to people who are in legal or AML, CTF compliance and say what you really should do is form a committee, get somebody from your senior management that can buy and with the leadership get your own involvement. But then look at ITHR mixture of legal and compliance and the business as well, because it can impact different business units. And I should also add finance. But once you've done that, you'll be amazed by actually how many systems you can leverage, but also maybe the existing products and tools that you can, you know, take into account as well. Speaker 3 Yeah, fantastic. So a couple of external resources that I'll try and get down in the show notes, but then also this really great message of you've probably got a lot of what you need internally. And I think maybe for those bigger entities that are coming into scope, it's a great opportunity to engage with the different aspects of the business as well. From a broader compliance perspective, just reflecting, you mentioned the modern slavery compliance and that's obviously a space I've done some work in, but also the anti bribery compliance area. The importance of whole-business engagement I think that one of the things that comes up in scholarship all the time is that in order for any compliance framework to be effective and meaningful, then needs to be this kind of whole of business engagement. So when you're saying like involve finance, involve HR, involve your actual IT team, I'm sure they'll they'll love to actually be spoken to about data and what they can and can't do and what will work. So that again, seems like a really great opportunity. And I guess on the flip side, potentially an advantage that smaller operators have, they might already have that level of kind of integration and connection. So in some ways that might be one way that it's easier to enable compliance for smaller entities, even though it might seem a little overwhelming, I imagine. Now I will say, any last thoughts Jeremy or comments you'd like to make before we finish off? Speaker 4 Yeah, just to wrap up, you know do think of this around change management and transformation. It is around anti money laundering. But to the point just made, think about modern slavery, think about sanctions, think about scams, think about privacy or each of these areas you can actually make more efficient. So, you know, really take this as an opportunity and if people are finding it hard, you know, reach out to groups like the financial integrity, how that's where there is a good amount of expertise and you know, people in industry, but also great connection with Australians, the FYU and regulator. And looking forward to the upcoming event and late may that also be speaking at. But yeah, it's about building a community and really glad to be part of it. Speaker 3 Oh, fantastic, Jeremy. Thank you so much. And thanks for the shout out to the Financial Integrity Hub. But that's what it's all about, right? Like keeping the network together and allowing us all to learn from each other in this space. So thank you so much for your time. I'm looking forward to you speaking at that event. I will be there too. And I hope that all our listeners today will also be there. Yeah. Thanks again, Jeremy. Really appreciate your time and insight. Speaker 4 No worries. Thanks so much, Hannah. Speaker 1 Financial Integrity Hubs Research is at the cutting edge of understanding and tackling illicit finance threats, providing the international community with the essential knowledge, tools and insights to make a real impact. If you want to stay ahead in the world of financial integrity, make sure to follow us on Spotify, YouTube X or LinkedIn. We're always sharing the latest updates, breaking news and ground breaking research. Join us and be part of the conversation. A huge thank you to Doctor Doran Goldbasch for his academic insights. We also want to give a big shout out to Doctor Craig Cameron, Hyper Concepts, and CFCA for their support in bringing this podcast to life.