Who Owns AML in Your Firm? The AML compliance officer question

One of the first practical questions law firms need to answer is deceptively simple: who is in charge of AML? Not in a vague, everyone-is-responsible way. Someone needs to own the framework, act as the point person, keep the process moving and be the name the firm can rely on when AUSTRAC engagement is required.

That person is commonly referred to as the AML/CTF compliance officer, or AMLCO. For some firms, the choice is obvious. For others, it becomes a slightly awkward internal discussion involving partners, practice managers, risk teams and the person who already seems to own every difficult operational project.

The AMLCO role matters because AML is not a one-off implementation task. It is ongoing governance. The person in the role needs enough authority to influence behaviour, enough practical understanding to make the framework workable, and enough support to avoid becoming the firm’s compliance dumping ground.

A common mistake is to appoint someone in name only. That might tick a box in the short term, but it creates problems quickly. If the AMLCO has no time, no training, no access to senior decision-makers and no ability to challenge risky behaviour, the role will struggle. AML needs ownership, but it also needs backing.

So what should firms look for? The AMLCO does not necessarily need to be the most senior lawyer in the firm. They do need to understand how the firm works. They need to be comfortable with process, records and risk-based thinking. They need to be able to communicate clearly with fee earners and support staff. They need to be calm under pressure, because suspicious matters and difficult client conversations rarely arrive neatly packaged.

The role should also be clearly defined. What can the AMLCO decide alone? What must be escalated to the managing partner, risk committee or board? Who covers the role when they are away? How are conflicts handled if the AMLCO is involved in the matter? How often do they report to leadership? These details might feel administrative, but they make the difference between a role that functions and a title that simply exists.

Firms should also be realistic about resourcing. If the AMLCO is expected to implement the program, train staff, review escalations, monitor compliance, maintain registers, update policies, liaise with AUSTRAC and keep up with guidance, that is not a five-minute side project. Even in a small firm, the role needs allocated time. In a larger firm, it may need a working group or support team.

The most effective AMLCOs will not try to personally police every matter. Instead, they will build a system where the right information reaches them at the right time. That means clear triage. Low-risk routine checks should not clog up the same pathway as genuine concerns. People need to know what can be handled within the standard process and what needs escalation.

This is where internal culture becomes important. If staff worry they will be criticised for raising concerns, they will stay quiet. If partners treat AML as an administrative nuisance, junior staff will follow that cue. The AMLCO needs leadership support to create a culture where asking questions is normal and documenting decisions is part of good practice.

The AMLCO role is also not static. The first few months after 1 July should generate useful insights. Which practice areas are producing the most questions? Which client types are taking longer to onboard? Are there recurring red flags? Are staff applying risk ratings consistently? The AMLCO should be able to feed those lessons back into the framework. 

Ultimately, AML ownership is about more than naming a person. It is about giving that person the authority, time, tools and senior support to make the framework real. A well-supported AMLCO can help a firm move from deadline-driven compliance to confident, defensible practice.

If your firm wants practical support to implement AML in a way that is proportionate, defensible and workable, speak to AML Sorted.Reach out to us at hello@amlsorted.com and let's have a chat.