AML/CTF Act for Mortgage Brokers: Scope and Checks

The Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act applies according to the services your business provides, rather than your mortgage-broker title. Establish whether your business provides a designated service, then separate its own obligations from the checks you perform for a lender.

A broker can collect identification and funding evidence for a lender without becoming the reporting entity for that loan. Commercial finance, lending and other services need their own scope assessment, even when the same brokerage provides them.

Establish Whether AML/CTF Applies

Establish AML/CTF applicability by identifying the legal entity providing the service, the customer and what you actually do for them. The Australian Transaction Reports and Analysis Centre (AUSTRAC) regulates designated services with the required geographical link to Australia. Its scope-check guidance points to the service tables in section 6 of the Act.

Record each service separately before deciding which obligations belong to your business.

Work your business performs	Scope question	Practical distinction
Arranging a residential mortgage for an individual	Are you arranging credit, or providing another listed service yourself?	Collecting documents for the receiving lender doesn’t itself make you the lender
Assisting with company or trust finance	Does the actual assistance meet a designated-service definition, subject to applicable guidance and exemptions?	A residential property used as security doesn’t settle the service classification
Making a loan	Does the lending activity meet the relevant section 6 service description?	Lending your own funds requires a separate assessment from broking another lender’s loan
Providing another service alongside broking	Do you also manage client funds, establish legal arrangements or provide another listed service?	Assess the additional activity even if broking is your main business

For company or trust finance, section 6 table 6 item 4 covers specified assistance with equity or debt financing. AUSTRAC’s professional designated-service guidance explains the transaction and assistance tests. A general discussion of financing options differs from acting on instructions to organise a financing transaction.

Commercial finance broking also has a specific regulatory clarification process. The Commercial & Asset Finance Brokers Association of Australia (CAFBA) reports AUSTRAC’s instruction to defer compliance steps on that issue until it publishes its final position. Use CAFBA’s published position alongside the broker reform guide for that distinction.

An Australian credit licence authorises credit activities. An Australian financial services licence (AFSL) and a credit-representative appointment have different functions. Holding one doesn’t mean you hold another, or resolve every designated-service test.

Item 54 of table 1 specifically concerns arrangements made in the capacity of an AFSL holder. AUSTRAC’s item 54 guidance explains its conditions and limited exemptions. Don’t apply that provision to ordinary credit broking solely because you arrange a loan.

Keep the reason for your scope conclusion, the activities considered and the guidance used. If your work changes, revisit the conclusion before treating the additional service as covered by the old assessment.

Read the AML/CTF Act and Rules

The relevant AML/CTF provisions determine which services are regulated and what the responsible entity must do. The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 established the framework in 2006. Later amendments change that Act, while Rules supply detail for obligations under it.

Anti-money laundering means preventing and detecting attempts to conceal the criminal origin of money or other assets. Counter-terrorism financing concerns money or resources used to support terrorism, including funds that originally came from legitimate activity. AML/CTF compliance means meeting the obligations that apply to the service and entity, through the required controls and reporting.

AUSTRAC is Australia’s AML/CTF regulator and financial intelligence agency. Its description of its role explains how reports from regulated businesses support financial-crime intelligence.

Use the Federal Register of Legislation to read the Act version effective on the relevant service date. A future law compilation shows how amendments will affect the text from a future commencement date. Its availability doesn’t bring those provisions into force early.

The current AML/CTF Rules 2025 are a separate legislative instrument. AUSTRAC’s legislation directory also identifies relevant instruments and legislative updates. Read applicable exemptions and transitional provisions alongside the substantive rule.

For a broker’s scope assessment, start with section 5’s definitions and section 6’s designated-service tables. Identify the service provider and the customer named in the relevant table. Then follow the provisions governing the reporting entity’s program, customer due diligence, reporting and records where they apply.

A reporting entity is the person providing a designated service within the Act’s scope. For a lender’s loan, identifying a customer as the lender’s authorised agent doesn’t transfer the lender’s whole program to your brokerage. AUSTRAC enrolment follows applicable reporting-entity obligations, while registration requirements depend on the particular regulated service.

Map the Applicable Controls

Map each control to the reporting entity responsible for it and the person authorised to complete your part. For a lender-directed process, obtain the current instruction and its compliance contact through the lender or your aggregator. An aggregator is the business that connects brokers to lender panels and supporting services.

Your procedure needs to specify which evidence you collect, how you complete an authorised check and where you send unresolved issues. Include who can approve an exception, the permitted document-transfer method and what completion evidence belongs in your file. Record the instruction version so staff can distinguish it from a superseded form.

National Australia Bank (NAB), as at October 2026, describes its own NAB due-diligence guide as collecting identity information and understanding funds and wealth. It also collects information about beneficial owners or controllers. Those are NAB’s customer requirements, rather than a universal checklist for every broker or lender.

If your business independently provides a designated service, it needs to address its own applicable obligations. AUSTRAC’s program overview explains risk assessment and policies. Its governance guidance identifies oversight and compliance roles.

Use AUSTRAC’s reporting guidance and independent-evaluation guidance for those duties. Apply any service-specific exemptions. These whole-business obligations aren’t automatically imposed on every mortgage broker collecting a lender’s documents.

Put the brokerage’s procedure owners and update process in its compliance manual.

Complete Customer and Ownership Checks

The lender’s authorised instruction decides which identifying details you collect and which ownership evidence you verify. Customer due diligence includes establishing who the customer is and, where applicable, who ultimately owns or controls them. A company name or trust name alone doesn’t identify all the relevant individuals.

Under AUSTRAC’s ownership and control guidance, a beneficial owner is an individual who owns at least 25% of the customer or controls them. That ownership can be direct or indirect. Control can exist without that shareholding.

Ownership through another company requires following the chain to the relevant individuals.

Fictional File: A Company Trustee

In this fictional mortgage file, Harbour Trustee Pty Ltd applies as trustee for the Harbour Family Trust. The receiving lender requests the trust deed, company ownership evidence and identification for the individuals its process identifies. These requests are assumptions for this example, rather than a statement of any named lender’s mortgage policy.

The broker records the exact trustee and trust names and collects the current deed with any amendments. A company extract identifies the trustee company’s directors and shareholders. Where a shareholder is another company, the broker obtains the further ownership information the lender requires.

One deed amendment is missing, so the broker marks the evidence incomplete and requests it through the authorised channel. The broker sends the outstanding issue to the lender’s nominated contact. The file remains incomplete until the lender’s process records the required resolution.

NAB’s public trust customer checklist, as at October 2026, illustrates why a bank asks about trustees and beneficiaries. It concerns new business accounts, so don’t substitute it for a mortgage lender’s instructions. Follow the identity-check procedure for the full broker check sequence and completion evidence.

Politically Exposed Persons and Sanctions

A politically exposed person (PEP) holds a prominent public role in a government body or international organisation. A domestic PEP holds that role in Australia. Applicable definitions also cover specified family members and close associates.

AUSTRAC’s PEP guidance explains the risk-based checks. If the lender’s process assigns you a screening step, retain the identifying details and route a possible match to its nominated decision-maker. PEP status or a matching name alone isn’t proof of wrongdoing.

Sanctions screening compares relevant people and entities against sanctions information. The Department of Foreign Affairs and Trade (DFAT) publishes Australia’s Consolidated List. Sanctions obligations require their own consideration, even where a business isn’t an AML/CTF reporting entity.

A possible match needs comparison with identifiers such as date of birth and aliases. Record who assesses it and who decides whether the file can proceed. DFAT directs people who identify a match to seek legal advice before dealings involving the listed person or their assets.

Escalate Source-of-Funds Concerns

Escalate a concern about where money came from through the lender or aggregator’s designated channel, preserving the evidence as received. Ordinary deposit evidence shows funds available for the purchase. A source-of-funds inquiry asks how the client obtained the money used in the transaction.

AUSTRAC’s funds and wealth guidance distinguishes source of funds from source of wealth. Source of wealth explains how the person accumulated their overall assets. A bank account identifies where money sits, while wages, inheritance or sale proceeds can explain its origin.

In a fictional file, a client says the deposit comes from selling a business. A recent bank statement shows a large incoming transfer. If the lender requests source evidence, the broker obtains the sale documents and transfer evidence specified by that process.

The broker finds that the transfer sender doesn’t match the claimed purchaser. Record the discrepancy and the client’s explanation without changing the original documents. Send both to the designated contact and follow their instruction about further requests or progression.

The reporting entity must assess whether the facts trigger a suspicious matter report. Your broker escalation and the entity’s statutory report are different records. If your business has its own reporting obligation, its authorised compliance process must address that obligation too.

AUSTRAC’s tipping-off guidance explains restrictions on disclosing reporting information. Keep sensitive reporting material out of routine customer communications and shared file notes. Refer document anomalies to the mortgage-fraud escalation guide.

Train for Lender and Aggregator Procedures

Train each staff member for the identification, evidence-handling or escalation work assigned to their role. A processor collecting documents needs to know what makes the collection incomplete. The person receiving escalations needs to know their authority and the next permitted action.

When a lender or aggregator issues a new instruction, turn it into a short operational refresher. Record the issuing organisation, procedure version and staff covered. Use a fictional file to practise the changed step, then check that staff reach the expected completion or escalation result.

For example, give a processor the fictional trust file with the missing deed amendment. The expected outcome is an incomplete status and escalation to the nominated contact. A correctly completed form that hides the missing amendment doesn’t meet that outcome.

The Mortgage & Finance Association of Australia (MFAA) lists AML/CTF in its Compliance Essentials course and requires an annual Compliance Refresher for members. Its professional-development guidance recognises lender and aggregator training. Use those resources alongside the receiving lender’s current operating instructions.

For a reporting entity’s own personnel obligations, AUSTRAC’s personnel training guidance addresses people performing AML/CTF functions. Apply it within that entity’s program and any applicable exemption. A broker refresher or training certificate alone doesn’t demonstrate compliance with all those obligations.

Keep Records and Test the Process

Keep a file record that shows which authorised instruction you followed and how each assigned step finished. Use the following fields for a broker file check.

Record	What the reviewer must be able to establish
Instruction and version	Which lender or aggregator process governed the step
Evidence source	Who supplied each document and how it was received
Check result	What was completed, by whom and when
Unresolved issue	What remained missing or inconsistent
Escalation recipient	Who received the concern and when
Completion record	The decision or confirmation that closed the assigned step
Storage and access	Where authorised staff can retrieve evidence without exposing it to others

In a fictional review of the Harbour Family Trust file, the reviewer finds the missing amendment request and lender escalation. The file also contains the subsequent lender instruction and completion record. The reviewer can trace the resolution without guessing from a ticked box.

If the escalation email exists but its response is missing, request the completion evidence and retain the incomplete status where the procedure requires it. Review access permissions and the approved transfer method at the same time. Keep personal information in authorised storage and follow the applicable retention schedule.

AUSTRAC’s record-keeping guidance addresses reporting-entity records. Establish what your brokerage must retain under its own obligations and the lender or aggregator’s instruction. Don’t copy a reporting entity’s retention rule into every broker file without establishing its basis.

This file check tests whether your brokerage followed its assigned process. An independent evaluation examines the reporting entity’s complete program and its operation. Resolve missing completion evidence before closing your assigned checks, then carry the outcome into the broader broker compliance file review.