Risk, Compliance & Financial Integrity in Australia

Essentials guide · Source-checked research48% of statements checked against a source30 checked against an official source0 checked against a secondary sourceChecked 2026-10-1913 held back until checked against an official source10 topics include AI-written statements, not source-checkedNot yet professionally reviewed

• Company directors must apply for a director identification number (director ID) before they are appointed.

  Federal.Australian Securities and Investments Commission (ASIC) · checked 2026-10-19

• Banks and other reporting entities must identify and verify customers, including beneficial owners, before providing designated services under the federal Anti-Money Laundering and Counter-Terrorism Financing Act 2006, supervised by AUSTRAC.

  Federal; applies to account opening for companies and foreign-controlled entities.AI-written, not source-checked

• Reporting entities must report to AUSTRAC transactions involving physical currency of AUD 10,000 or more (or the foreign currency equivalent) and suspicious matters.

  Federal; threshold transaction reports are due within 10 business days, and suspicious matter reports within 3 business days, or 24 hours where terrorism financing is suspected.Australian Transaction Reports and Analysis Centre (AUSTRAC) · checked 2026-10-19

• Imports of plants, animals, food and many other goods are subject to strict controls under the federal Biosecurity Act 2015, administered by the Department of Agriculture, Fisheries and Forestry.

  Import permits, treatment or inspection may be required.AI-written, not source-checked

• Entities covered by the Privacy Act must notify the OAIC and affected individuals of an eligible data breach that is likely to result in serious harm.

  Federal Notifiable Data Breaches scheme.Office of the Australian Information Commissioner (OAIC) · checked 2026-10-19

• Under Part 3 of the Cyber Security Act 2024, businesses with annual turnover above AUD 3 million, and responsible entities for critical infrastructure assets, must report ransomware or cyber extortion payments to the Australian Signals Directorate within 72 hours.

  Federal; reporting has applied since 30 May 2025, with an education-first approach to compliance until 31 December 2025. Critical infrastructure responsible entities are those under Part 2B of the Security of Critical Infrastructure Act 2018.Department of Home Affairs · checked 2026-10-19

• The federal Competition and Consumer Act 2010 prohibits cartel conduct, misuse of market power and other anti-competitive conduct, and contains the Australian Consumer Law.

  Enforced by the ACCC; cartel conduct can be a criminal offence.AI-written, not source-checked

• Legislation passed in 2024 created a corporate offence of failing to prevent foreign bribery by an associate (section 70.5A of the Criminal Code), with a defence for corporations that had adequate procedures in place.

  Federal Criminal Code; covers Australian corporations for associates' conduct abroad and foreign corporations for associates' conduct in Australia. The corporation bears the burden of proving adequate procedures on the balance of probabilities.Attorney-General's Department · checked 2026-10-19

Read the full guide: Banking, payments and capital · Trade, customs and export controls · Data protection and cyber · Compliance, sanctions and governance