In today's complex regulatory landscape, businesses face an ever-expanding web of compliance requirements that can seem impossible to navigate. New regulations emerge daily, enforcement actions increase, and the cost of non-compliance continues to rise.

The solution lies in creating a systematic approach to managing these obligations through a comprehensive compliance register.

A compliance obligations register is your company's central command centre for regulatory management: a living document that transforms compliance from a reactive scramble into a strategic advantage.

What is a Compliance Obligations Register?

A compliance obligations register is a centralised database that systematically documents, tracks, and manages legal, regulatory, and compliance requirements affecting your company. It goes far beyond a simple list of laws to become a comprehensive management tool that includes specific obligations, assigned responsibilities, critical deadlines, monitoring protocols, and documentation of compliance activities.

Use this discovery phase to aggregate, analyse, rationalise and simplify your existing control framework. Look for opportunities to standardise effective practices across the company, eliminate redundant, duplicative or conflicting approaches, and identify gaps where controls may be insufficient or missing entirely.

This "audit your cupboard" approach serves multiple purposes: it respects the institutional knowledge your teams have developed, provides a realistic baseline for improvement, and often uncovers surprisingly robust practices that can be leveraged company wide. Most importantly, it transforms compliance from an abstract regulatory requirement into a tangible operational reality that your teams can see, understand, and improve upon. And you might just make things simpler in the process!

The consequences of compliance failures extend far beyond financial penalties. Companies face reputational damage, operational disruptions, loss of licenses, and in severe cases, criminal liability for key personnel. A well-maintained register helps prevent these outcomes.

Modern businesses often operate across multiple jurisdictions and industry sectors, each bringing its own regulatory requirements. Without a systematic approach to tracking these obligations, you can often discover compliance gaps only after violations occur.

A well-designed register transforms your compliance approach from reactive firefighting to proactive risk management. It provides the foundation for demonstrating due diligence, supports strategic decision-making, and gives leadership confidence that the company understands and meets its obligations.

Regulatory Identification and Categorisation

Your register must eventually capture the complete scope of applicable requirements, including federal, state, and local laws, industry-specific standards, contractual obligations, and internal policies. Each entry should document the regulation's source, effective date, jurisdiction, and applicable business units / teams that it impacts. Organise obligations by business function, risk level, and compliance frequency to help prioritise resources effectively.

While this scope can feel overwhelming initially, start with high-risk areas and expand systematically.

Move beyond simply listing regulation names to document the specific requirements your company must meet. Include precise compliance deadlines, reporting requirements, record-keeping obligations, training needs, and any exemptions that may apply. This granular approach ensures team members understand exactly what they must do to maintain compliance.

Assign explicit ownership for each obligation, identifying primary responsible parties, backup resources, and escalation procedures. Include contact information, decision-making authority levels, and clear accountability measures. This prevents confusion during compliance activities and ensures consistent execution throughout the company.

Establish regular review cycles for each obligation based on the frequency of regulatory changes and the criticality of specific requirements.

High-risk areas may require monthly reviews (as an example), while stable regulations might need only annual assessment. Build in triggers for special reviews when regulations change or business operations evolve.

Accelerating Development: Smart Shortcuts and Resources

Modern compliance management platforms offer features that can dramatically enhance your register's effectiveness and reduce development time. Look for solutions that provide automated regulatory monitoring, workflow management, document storage, and comprehensive reporting capabilities.

Prioritise tools that maintain current databases of regulatory requirements and can automatically notify you of regulatory changes. You want them to 'push to you' rather than having to conduct the research yourself.

Review recent internal audits, regulatory examinations, enforcement activities, legal reviews, and consultant reports. These documents often identify specific compliance obligations and can quickly populate significant portions of your register. Past findings also highlight high-risk areas requiring immediate attention.

Many industry associations, consulting firms, and software providers offer pre-built compliance registers tailored to specific sectors. These templates include common regulatory obligations for various industries including resources, healthcare, financial services, manufacturing, and others. While they won't capture your company's unique circumstances, they provide a solid foundation that can save months of initial research.

Rather than building a comprehensive register all at once, consider a risk-based rollout:

Phase 1: Critical Compliance Areas (Months 1 – 3)

Start with regulations that pose the highest risk - those with severe penalties, frequent enforcement activity, or direct impact on your core business operations. This might include safety regulations, financial reporting requirements, or industry-specific licensing obligations (like gaming laws compliance, liquor laws compliance and AML).

Phase 2: Operational Requirements (Months 4 – 6)

Add day-to-day operational compliance requirements, routine reporting obligations, and standard business practices that have regulatory implications.

Phase 3: Comprehensive Coverage (Months 7 – 12)

Complete the register by adding remaining obligations, including less critical requirements, emerging regulatory areas, and forward-looking compliance needs.

Mine your existing legal files, compliance policies, and procedure manuals. These documents often reference specific regulatory requirements and can quickly identify applicable obligations. Your legal department likely maintains lists of key regulations for various business activities.

If you don't have a legal department, speak with your external lawyers as they can be a very helpful resource to you.

If you use existing compliance or risk management software, check whether it includes regulatory content libraries. Many platforms offer integration with regulatory databases that can automatically populate portions of your register. This can be a godsend.

Design your register with end users in mind. Use terminology that reflects your business' language rather than complex legal jargon. This approach ensures that operational staff can understand and act on compliance obligations effectively.

That being said, don't be persuaded to take short-cuts or abbreviate the register - it is one thing to tailor the register to staff, so it is comprehensible; it is another to remove important items off the register due to its length. Instead: seek ways to make searching the register easier for your audience.

While shortcuts can accelerate initial development, accuracy remains paramount. Templates and third-party services may not reflect your specific operational reality or include recent regulatory changes. Always validate content against current regulations and your actual business activities.

Establish clear processes for ongoing maintenance from the beginning. Regulatory landscapes change constantly, and your register must evolve accordingly. Build maintenance responsibilities into job descriptions and performance metrics to ensure long-term sustainability.

Once your compliance obligations register takes shape, your attention naturally turns to understanding how your company currently meets these requirements. These existing practices represent your control environment - the foundation upon which you'll build a more systematic approach.

Engage your teams in a comprehensive "control inventory" exercise. Ask them to document their current methods for addressing each obligation, including both formal procedures and informal practices they have developed over time. Gather historical records, process documentation, and evidence of past compliance activities.

This inventory process typically reveals fascinating insights about your company's compliance landscape. You'll likely discover that different departments have developed varying approaches to the same requirement, some more effective than others. What works well in one area may be completely unknown to another.

Building a compliance obligations register represents one of the most important investments your company can make in its long-term success and sustainability. While the initial effort may seem daunting, the alternative—operating without systematic compliance management ('flying blind') - poses far greater risks and costs.

The register serves multiple strategic purposes beyond mere regulatory compliance. It demonstrates company maturity to stakeholders, provides a foundation for strategic planning, enables efficient resource allocation, and creates a competitive advantage through operational excellence. Companies with robust compliance systems often find they can pursue opportunities that competitors cannot, enter new markets more confidently, and build stronger relationships with regulators and partners.

The key to success lies in starting with a clear vision, taking a systematic approach, and building sustainable processes from the outset. Remember that perfection is not the goal initially - progress is. A basic register that covers your highest-risk areas and grows systematically will serve you far better than an ambitious project that never gets completed.

Your compliance obligations register is not just a regulatory necessity: it's a strategic asset that can drive business value, reduce risk, and provide the foundation for sustainable growth. The question is not whether you can afford to build one, but whether you can afford not to.

How To Build A Register of Compliance Obligations

Conducting an effective Money Laundering/Terrorism Financing (ML/TF) Risk Assessment begins with foundational governance elements that define a reporting entity's risk boundaries.

Prepare Your Board's Risk Appetite Statement (RAS)

: This document sets out how the Board views ML/TF risk and the level of risk it is willing to accept.

: Outline how you will conduct your ML/TF Risk Assessment (RAM), including the reporting entity's context, approach, sources of risk, control evaluation methods, and how residual risk will be determined. These steps ensure the assessment is strategic and methodologically sound.

Complete Your ML/TF Inherent Risk Assessment

: Identify and assess the raw exposure to ML/TF risks before considering any controls. This involves evaluating risk factors such as products and services, customer types, geographic locations, and delivery channels. Other factors can also be included.

Test the Design and Operating Effectiveness of Your Controls

: Determine whether existing controls are robust and functioning as intended.

Complete your ML/TF Residual Risk Assessment

: This reflects the risk that remains after controls have been applied, using the results from the control testing.

Map your Residual Risk to your Risk Appetite

: Compare your residual risks against your stated risk appetite to see if they fall inside or outside acceptable levels.

: If risks fall outside of appetite, develop tailored action plans to mitigate them and bring them back within acceptable levels. The Board or governing body should be kept informed of progress.

: Align KRIs to your most material risks to provide clear, data-driven reporting for senior management and the Board, ensuring sustained oversight.

Update your Transaction Monitoring Program (TMP) Rules and Training

: Reflect the findings and lessons learned from the risk assessment to ensure continuous alignment of operational controls with evolving risks.

Conducting an effective ML/TF Risk Assessment is crucial for reporting entities to define risk boundaries and ensure their controls are aligned with evolving risks.

Conducting an ML/TF Risk Assessment: A Quick Ready Reckoner

Under Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws, reporting entities are required to undergo regular independent reviews of Part A of their AML/CTF Program. An independent review is an impartial assessment to ensure you are addressing money laundering and terrorism financing risks, complying with legal obligations, and that your Program is effective. Higher-risk entities should conduct reviews more frequently (e.g., annually), while lower-risk entities might do so every 2-3 years. From next year, reviews will be required at least once every three years. If you're unsure whether you're a higher-risk entity, consider AUSTRAC's National Risk Assessments for guidance.

When seeking someone to conduct this impartial assessment, it's crucial they are independent of the Program's development. The reviewer should understand your business and its ML/TF risks and be appropriately qualified.

Tip 1: Industry Experience and Qualifications.

 Ask potential reviewers if they have conducted independent reviews for other companies in your industry, as this indicates their understanding of potential challenges and risks. Also, enquire about their professional certifications, technical knowledge of AML systems, and grasp of emerging ML/TF typologies.

 If you choose an internal reviewer, ensure they had no involvement in developing any part of the Program, including assessing ML/TF risk and developing controls. You need to be confident in their independence.

Tip 3: Fresh Eyes for External Reviewers.

 If an external party has conducted your review in successive cycles, consider if they can still offer a fresh perspective. If unsure, consider engaging a new reviewer.

Tip 4: Seek Industry Referrals and Confirm Independence.

 Engage with others in your industry to find out who has performed well. There are many qualified independent reviewers available. When engaging them, ask for written confirmation of their independence. AUSTRAC also provides helpful guidance on questions to ask AML/CTF consultants and independent review firms.

What to Expect from an Independent Reviewer

AUSTRAC provides useful guidance on the methodology for independent reviews, which will ultimately depend on your organisation's context, including its size, scale, and complexity. Areas an independent review might consider include:

Whether Part A of your AML/CTF program is current and adequately assesses that policies and procedures manage ML/TF risks.

Assumptions underpinning the ML/TF risk assessment.

Changes to your AML/CTF practices and policies.

Employee understanding and compliance with your program.

Post-implementation reviews of program changes.

Causes of deficiencies or violations and plans for rectification.

Adequacy and effectiveness of your AML/CTF employee training program.

Seniority and authority of your compliance officer.

Effectiveness of transaction monitoring systems in identifying suspicious matters.

Compliance of outsourced functions with Part A of your program.

Implementation of Part A of your program by branches and subsidiaries (including overseas).

You might also consider having your independent reviewer examine Part B of your Program, especially its focus on customer due diligence.

Tip 5: Adopt an Independent Review Procedure.

 Establishing a procedure for independent reviews can be very useful. This document can outline how you select your reviewer, how you confirm their independence, and the scope of the review. It can also help manage internal teams' expectations throughout the review process.

An independent reviewer will typically undertake four steps: Documentation Review, Client Interviews, Sample Testing, and Site Visits.

 This involves inspecting your Group Structure (identifying reporting entities), Program, Risk Assessment, AML/CTF policies and procedures (including those for Annual Compliance Reports, customer due diligence, transaction monitoring, suspicious matter reporting, AUSTRAC feedback, training, and record management), reporting lines, Board visibility, accountability framework, and, if applicable, information sharing practices and resource allocation for groups.

 Before the reviewer begins, compile all current documents into a review folder. If you're unsure of specific requirements, ask the reviewer for a document list beforehand; this will save considerable time later.

 This step will likely involve interviews with the AMLCO and senior representatives from your Board/Senior Management, Operations, People, IT, and Risk and Compliance teams. This may include walkthroughs to understand and evidence the operationalization of the AML/CTF Program.

 Identify and engage these executives and senior leaders early to explain the scope and purpose of the Independent Review and the nature of these interviews.

 The reviewer will test relevant AML/CTF activities, including employee files, procedure compliance, and transactions. Sample sizes will be based on ML/TF risks and system/process walkthroughs. Anticipate testing of:   

Employee records to ensure Employee Due Diligence (EDD) Program adherence.

Records indicating appropriate governance (Board/Committee minutes/resolutions).

Enrolment details and engagement with AUSTRAC.

Transaction Monitoring Program (TMP) alerts, Enhanced Customer Due Diligence (ECDD), and investigation cases.

Tip 8: Understand Sample Testing and Facilitate Access.

 Ensure you understand how the reviewer will conduct sample testing and have the necessary samples and staff available to facilitate a swift assessment.

 This may involve visits to your branches, venues, or where your Program is implemented with customers, and may or may not be part of Step 3.

 If requested, make your frontline staff available to the reviewer, and ensure appropriate management is present during visits.

What to Expect from the Independent Reviewer's Output

The independent reviewer will issue a written Report containing findings and recommendations. It should detail what was tested, how tests were performed, sample sizes, limitations, and confidence levels of findings. Once received, this Report should be provided to the Board and Senior Management.

Tip 10: Discuss Report Format and Delivery.

 Speak with your reviewer about the Report's format and detail. If you wish for them to present their findings and recommendations directly to your Board/Senior Management, ask them to do so.

Your Report will likely contain various findings and recommendations. After it's provided to your Board and Senior Management, we recommend:

Creating a table of findings and recommendations, including columns for management's response and estimated completion time.

Preparing action plans with attributed owners to address the recommendations where required.

Tracking progress, reporting regularly to your Board, and, once finalised, reporting completion to your Board and Senior Management.

The report, its findings, and action items should not be viewed in isolation. Consider how these results integrate with your broader risk, compliance, and assurance frameworks; their interplay with internal audit activities; and how the findings feed into your business's risk assessment cycle.

Independent Reviews are a critical component of Australia's AML/CTF regime, providing assurance that reporting entities effectively control against money laundering and terrorism financing risks. Their effectiveness depends on thoroughness, independence, and your commitment to implementing recommendations. By implementing a robust independent review framework, you demonstrate your commitment to combating financial crime, contributing to the integrity of Australia's financial system and the global fight against it.

Navigating Your AML Independent Review: 10 Quick Tips

Under Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws, a significantly expanded range of businesses and professions will soon be subject to compliance and risk obligations. These "tranche 2" businesses include real estate agents and developers, conveyancers, dealers in precious metals and stones, and professional services providers such as lawyers, accountants, and trust and company service providers. If you operate in one of these sectors, here are five key steps you need to take by June 30, 2026, to get ready for the AML changes.

Step 1: Enrol with AUSTRAC by 31 March 2026

If your business falls within one of the listed sectors, you must enrol with AUSTRAC by 

 AUSTRAC provides guidance on the information required for your Australian Business Profile Form (ABPF). This includes details on your business's services and structure, contact information, key personnel names and contact details, financial statements for the most recent financial year, registration numbers (like ABNs or ACNs), foreign registration details if applicable, and any criminal, civil, or enforcement actions related to your business and key personnel.

To prepare for enrolment, identify which designated services you provide, whether you have one or more entities providing those services, and if you have a Reporting Group. You should also compile ASIC searches and obtain financial statements for each entity to help complete your ABPF. This preparatory work will significantly assist with the following steps.

Step 2: Complete Your ML/TF/PF Risk Assessment by 30 June 2026

Your Money Laundering, Terrorism Financing, and Proliferation Financing (ML/TF/PF) Risk Assessment is the foundation of your AML/CTF Program. This assessment evaluates the inherent and residual risks of your business and services being used for illicit activities. By the end of the 2026 financial year (ready for July 1, 2026), you should have the following documents in place:

An ML/TF/PF Risk Appetite Statement: This document outlines your company's appetite and tolerance levels for ML/TF/PF risks related to customers, products, channels, and business locations. It guides management and staff on Board and Senior Management expectations, helping you understand if your business is operating within or outside its defined risk appetite after the assessment.

An ML/TF/PF Risk Assessment Methodology: This sets out how you will assess your ML/TF/PF risks. Think of it as the "recipe" for your risk assessment.

A Context Assessment: This examines the nature, size, and complexity of your business.

Your ML/TF/PF Risk Assessment: This identifies potential ML/TF/PF risks your business could face, looking at inherent risks (without preventative measures), your controls environment, and residual risks.

If you already have risk and compliance management frameworks, ensure your ML/TF/PF risk documentation is appropriately integrated. It may take time to consolidate details of your controls (measures to prevent, mitigate, or manage risk) and how you monitor/test them, but establishing a solid foundation for your AML/CTF Program is recommended.

Step 3: Prepare Your AML/CTF Program by 30 June 2026

Once your ML/TF/PF Risk Assessment is complete, you can prepare your AML/CTF Program. It is recommended to engage independent assistance for this exercise, especially if it's your first time or if you haven't yet appointed an AML/CTF Compliance Officer (AMLCO).

Step 4: Prepare Your AML/CTF Policy Documents by 30 June 2026

The updated laws require your entity to have several policy documents in place from July 1, 2026. AUSTRAC guidance states that your business must develop and maintain policies, procedures, systems, and controls that appropriately manage and mitigate your business's risks, ensure AML/CTF compliance, and are appropriate for your business's nature, size, and complexity.

Step 4 involves documenting the policies, procedures, systems, controls, and measures that implement your AML/CTF Program from Step 3. These policies may include, but are not limited to:

Governance protocols: How your governing body stays informed of ML/TF/PF risks related to your designated services.

Appointing an AML/CTF Compliance Officer (AMLCO).

Designating senior managers responsible for approving AML/CTF Policies and the ML/TF/PF Risk Assessment.

ML/TF/PF Risk Awareness (and AML/CTF compliance) Training.

Information sharing (especially for Reporting Groups).

Documenting these processes can take time, so it's advisable to start this work soon.

You are required to appoint an AML/CTF Compliance Officer (AMLCO). This person must be employed or engaged at a management level and possess sufficient authority, independence, and access to resources and information to effectively perform their functions. Once appointed, you must notify AUSTRAC within 14 days via AUSTRAC Online (details provided after completing Step 1).

With the projected increase in reporting entities from approximately 17,000 to over 100,000, it's advisable to begin the hiring or internal upskilling and training processes for the AMLCO position now.

As the end of the 2025 financial year approaches, it's crucial to ensure you have enough time to prepare for these significant changes. We recommend starting to consider key measures, particularly steps 2, 3, and 4, soon to prepare for the changes impacting your business from July next year. Remember to inform stakeholders about the impact of these requirements and secure documented approvals from your governing body.

Our Thinking

Latest Insights

How To Build A Register of Compliance Obligations

Conducting an ML/TF Risk Assessment: A Quick Ready Reckoner

Navigating Your AML Independent Review: 10 Quick Tips

Preparing for the Tranche 2 AML Changes: Your Five Key Steps by June 2026 (A Guide for Directors and Executives)