Money moves through screens now, not counters. That shift has changed what security means for a bank, a remittance provider, or a fintech. You cannot protect a financial system only with a lock, a guard, and a vault anymore. You protect it with data, monitoring, and verification built into the transaction itself.
This matters because financial security is really about trust. People need to trust that the system will not be used to hide stolen money, fund terrorism, or exploit vulnerable people. In Australia, AUSTRAC’s 2024 national risk assessment estimates that criminal proceeds generated each year could reach $43.7 billion. Around 17,000 reporting entities are enrolled with AUSTRAC to help stop that money moving. None of that system works without digital security holding it together.[1]
The Legal Backbone: The AML/CTF Act
Australia’s financial security regime sits inside the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Section 3 sets out the Act’s purpose. It aims to detect, deter, and disrupt money laundering, terrorism financing, and other serious financial crimes. It also aims to promote public confidence in the financial system.[2]
Who the Act Applies To
The Act works through “reporting entities”. In simple terms, the Act applies to businesses that provide regulated financial services, such as banks, remittance providers, and digital currency service providers. These businesses cannot just open an account and hope for the best. They must have an AML/CTF program, understand their money laundering and terrorism financing risks, and check customers before providing services. These are legal duties, not suggestions. If they fail, they can face civil penalties and enforcement action. In more serious cases, such as false documents, fake customer names, or structuring, criminal liability can also arise.[3]
Financial Security Is a Continuous Process
Here is the part people often miss. Opening the account is only the front door. AUSTRAC expects reporting entities to keep monitoring customers after that, because risk can appear later through unusual transactions, changed behaviour, or suspicious patterns.[4]
How Ongoing Monitoring Catches Structuring
Structuring is a simple example. Instead of depositing $20,000 in one go, someone might split it into several deposits under $10,000 to avoid triggering a threshold transaction report.[5] AUSTRAC gives a practical example. A bank’s system notices one customer made 12 cash deposits in a month. Each deposit was between $7,000 and $9,900. That stood out because the customer did not normally deposit cash. After checking the customer’s source of funds and source of wealth, the bank saw signs of possible structuring and money mule activity. It formed reasonable grounds for suspicion and submitted a suspicious matter report within three business days.[6]
This shows why ongoing monitoring matters. A bank does not catch structuring because someone checked an onboarding form months earlier. It catches structuring because its systems keep watching transactions over time. AUSTRAC has also warned that criminals now use AI to fake identities and forge documents. That helps explain AUSTRAC’s 2025–26 focus on sector-wide risk, rather than narrow box-ticking compliance.[7]
A Case in Point: Digital Onboarding and SOTER
The EU-funded SOTER project shows how digital onboarding can secure the first step of a financial relationship. It uses facial biometric checks, NFC-based identity document capture, and electronic signatures to move customer verification online. In simple terms, it tries to replace the branch visit with a digital process that still gives financial institutions confidence about who the customer is.[8]
Where SOTER Would Sit Under an AUSTRAC-Style Regime
SOTER was built for the European regulatory environment, under eIDAS and the EU’s anti-money laundering directives, not the Australian AML/CTF Act. But the comparison still helps. SOTER focuses on the onboarding moment. It verifies that the person opening an account is who they claim to be, using biometric liveness checks and device intelligence to reduce spoofing risks. But that confidence has limits. SOTER’s own peer reviewers asked how its device fingerprinting actually detects fraud. The project team’s answer was that the method was confidential.[9]
That matters. A security control that cannot be examined is hard to audit. It also sits awkwardly with an AML/CTF regime built on reporting entities keeping records that AUSTRAC can review.[10]
Automated verification only strengthens financial security if someone other than the vendor can check how the tool reaches its conclusion. Initial due diligence gets a person through the door, but ongoing due diligence and reporting obligations carry the system after that.[11] A platform like SOTER could secure that entry point, but its confidential components would still need to satisfy an auditor, not just a marketing brief.
Conclusion
Financial security in Australia rests on three layers. First, the AML/CTF Act creates the legal duty. Second, AUSTRAC’s reporting system turns that duty into ongoing monitoring, not just one identity check when the account is opened. Third, tools like SOTER show how the front door of finance can be made safer through biometric technology.
But digital security cannot support financial security if part of the system sits behind a non-disclosure agreement. A digital onboarding platform can only build trust if its own methods can be checked. Ongoing monitoring also only works if the systems that create alerts are accountable to someone beyond the vendor that built them.
The real question for regulators is not whether identity checks and monitoring should become more automated. They probably will. The harder question is whether audit rules designed for people checking paperwork are strong enough for digital systems that even regulators may not be able to fully inspect.
[1] Australian Transaction Reports and Analysis Centre, Money Laundering in Australia: National Risk Assessment 2024 (Report, July 2024) 15.
[2] Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) s 3(1)(aa), (ad) (‘AML/CTF Act’).
[3] AML/CTF Act (n 2) ss 4, 6, 26B–26H, 28, 30, 135–143.
[4] Australian Transaction Reports and Analysis Centre, ‘Ongoing Customer Due Diligence’ (Guidance, 1 July 2026); AML/CTF Act (n 2) s 30.
[5] Australian Transaction Reports and Analysis Centre, ‘Threshold Transaction Reports’ (Guidance, 1 July 2026); AML/CTF Act (n 2) ss 43, 142.
[6] Australian Transaction Reports and Analysis Centre, ‘Suspicious Matter Reports’ (Guidance, 1 July 2026); AML/CTF Act (n 2) s 41(2)(a).
[7] AML/CTF Act (n 2) s 30; Australian Transaction Reports and Analysis Centre, ‘Suspicious Matter Reports’ (Guidance, 1 July 2026); Australian Transaction Reports and Analysis Centre, ‘AUSTRAC Releases Updated Risk Snapshot of Australia’s Financial Crime Landscape’ (Media Release, 12 May 2026); Australian Transaction Reports and Analysis Centre, ‘AUSTRAC Unveils 2025–26 Priorities to Crack Down on Financial Crime’ (Media Release, 17 July 2025).
[8] Miren Karmele García et al, ‘Digital Onboarding in Finance: A Novel Model and Related Cybersecurity Risks’ (2022) 1 Open Research Europe 149, 3–7.
[9] Pietro Tedeschi, ‘Reviewer Report’ on Miren Karmele García et al, ‘Digital Onboarding in Finance: A Novel Model and Related Cybersecurity Risks’ (2022) 1 Open Research Europe 149, 16; Esther Aguilera, ‘Author Response’ to Pietro Tedeschi, ‘Reviewer Report’ on Miren Karmele García et al, ‘Digital Onboarding in Finance: A Novel Model and Related Cybersecurity Risks’ (2022) 1 Open Research Europe 149, 18.
[10] Tedeschi (n 9) 16; Aguilera (n 9) 18; AML/CTF Act (n 2) ss 104, 107, 116, 147–150.
[11] AML/CTF Act (n 2) ss 28, 30, 41, 43, 46, 47.
Leave a comment