Original article provided by BDO Australia
Author: Katie Bourne, Director, Forensic Services 

Having an Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) programme formally documented and approved is a regulatory requirement, but in isolation it does not equate to effective risk management. For reporting entities, meaningful impact is realised when AML obligations are embedded into everyday decision‑making, behaviours and organisational expectations. This is the distinction between compliance as a technical exercise and compliance as a lived culture.

This challenge is not confined to newly regulated entities. Whether an organisation has operated under the AML/CTF regime for decades or has only recently become regulated, the risk is the same: AML is too often treated as something activated for audits, regulatory visits or annual training, rather than a discipline that genuinely shapes day‑to‑day business decisions. Where AML is embedded into organisational culture, it becomes routine, sustainable and far more effective in identifying and managing real financial crime risk.

With the approach of upcoming regulatory deadlines, the release of new sector‑specific guidance provides timely clarity on regulatory expectations and practical implementation. While this guidance supports consistency and technical compliance, it also underscores a broader reality: effective AML/CTF frameworks are shaped not only by documented policies and procedures, but by how obligations are understood, prioritised and applied across an organisation. As regulatory scrutiny, enforcement activity and public accountability continue to intensify, entities with a strong AML culture are better positioned to adapt to emerging risks, protect their reputation and meet regulatory expectations. Culture is no longer a ‘soft’ concept, it is increasingly central to effective compliance.

Leadership sets the tone
If AML obligations are to move beyond technical compliance and become part of everyday practice, leadership is the critical catalyst. A strong AML culture is shaped first and foremost by boards, senior executives, partners and principals, whose actions signal how AML obligations, including those clarified through sector-specific guidance, are genuinely prioritised across the organisation. Staff quickly observe whether leaders treat AML as a core organisational value or as a box ticking exercise, and they adjust their behaviour accordingly. Those signals directly influence how diligently AML controls are applied in practice.

Tone at the top is reinforced through action
In practice, tone at the top is established through visible engagement with AML issues, not simply delegation to compliance teams. Regular discussion of AML matters at board or executive level, consideration of regulatory guidance when setting risk appetite, consistent adherence to procedures by senior staff and the allocation of adequate time and resources all send powerful signals. Equally important is how leadership responds when concerns are raised. When staff are supported for escalating unusual activity or asking difficult questions, confidence grows and issues are surfaced earlier. On the other hand, when concerns are minimised or discouraged, silence often follows.

Governance and escalation must work in practice
Effective governance, escalation and information flow in managing financial crime risk are vital. The role of senior executives and boards is central in ensuring that material risk information is appropriately identified, escalated and considered at the right level. The message is clear: directors and senior leaders must put in place governance arrangements that enable them to be properly informed, allow sufficient time to review and understand emerging risks, and support constructive challenge where issues arise. These expectations align closely with regulatory guidance and underscore that effective AML/CTF oversight depends not only on formal frameworks, but on how information moves through an organisation and how actively it is interrogated at senior levels.

Embedding AML into everyday work
Leadership intent only becomes a cultural reality when it is reflected in how work is done. AML obligations are far more likely to be applied consistently when they are embedded into existing workflows, rather than treated as additional or discretionary tasks. Integrating identity verification, beneficial ownership checks and risk assessments into onboarding systems, transaction processes and approval pathways reduces reliance on individual memory or judgement, and this is particularly important as sector‑specific guidance continues to clarify how obligations should be implemented across different operating environments.

Over time, these steps become routine. Staff complete them because they are part of the process, not because they have been reminded. Aligning AML obligations, including sector‑specific risk considerations, with other well‑understood professional duties, such as conflict checks, confidentiality obligations and financial controls, further reinforces AML as a normal aspect of good business practice, rather than an external compliance imposition.

Sustaining awareness through ongoing engagement
An effective AML culture cannot be built or sustained through one‑off training alone. Ongoing education, discussion and reinforcement are essential to keep awareness high and skills relevant as risks, typologies and regulatory expectations evolve. As AUSTRAC guidance continues to be refined and expanded across sectors, reporting entities that succeed are those that translate guidance into practical, role‑specific learning rather than relying solely on generic annual modules. Reporting entities that succeed move beyond generic annual modules, delivering regular, practical training tailored to specific roles and levels of risk exposure.

Making AML training practical and role-specific
Grounding learning in real‑world case studies, enforcement outcomes and internal experiences makes financial crime risk tangible and relevant, and creating space for open dialogue around grey areas and emerging risks reduces fear of getting things wrong and builds confidence in escalation. Scenario‑based discussions and tabletop exercises, informed by current guidance, further embed AML thinking into everyday problem‑solving, rather than reserving it for audits, investigations or regulatory engagement.

Crucially, training should empower rather than alarm. Recognising and sharing examples where staff diligence has prevented harm or identified risk reinforces positive behaviour and sends a clear message that AML vigilance is valued which, over time, can strengthen judgement, encourage early escalation and help embed AML awareness as a normal part of professional practice.

Ownership and accountability across the organisation
For AML culture to take hold, responsibility must extend well beyond the compliance function. While AML officers coordinate and oversee the framework, effective risk management depends on shared ownership across the organisation. Clearly defined responsibilities by role, informed by sector-specific guidance reinforced through consistent leadership messaging, can ensure accountability is understood, accepted and applied in practice across all parts of an organisation.

Consistency builds cultural credibility
Cultural credibility rests on consistency and where AML controls are applied rigorously in some situations but relaxed under pressure in others, confidence in the framework erodes quickly. By contrast, consistent application, even when inconvenient, establishes clear expectations, reinforces accountability and strengthens AML culture over time.

Continuous improvement as a cultural norm
Mature AML cultures treat compliance frameworks as living systems. Regular reviews of files, transactions and controls are approached as opportunities to learn and strengthen the framework, not to assign blame. Constructive sharing of findings, incorporation of regulatory feedback, sector-specific guidance and insights from frontline staff all contribute to more resilient, effective AML arrangements. How an organisation responds when a genuine issue arises sends a powerful cultural signal. Transparent, well‑managed responses handled in line with established procedures build confidence that the framework operates in practice, not just on paper, reinforcing trust and continuous improvement.

From obligation to identity
Over time, reporting entities with a strong AML culture move beyond viewing compliance as a regulatory burden and begin to recognise it as part of organisational identity. AML obligations align naturally with ethical standards, professional responsibility and sound governance, shaping how decisions are made and business is conducted. Organisations that reach this level of maturity are not only better protected against financial crime risk, but also earn greater trust from clients, regulators and stakeholders.

The shift from compliance to culture is not a single milestone, but an ongoing journey. For reporting entities willing to invest in leadership, integration, education and accountability, the result is an AML / CTF framework that genuinely works in practice, protecting the organisation, its customers and the integrity of the broader financial system.

How BDO can help organisations move from AML compliance to culture
BDO in Indonesia is a trusted adviser to clients and provides forensic services support, including preventative financial crime risk management, across a broad range of sectors. Our forensic services team conduct independent reviews and proactive financial crime risk assessments for highly regulated institutions to ensure they comply with their independent review requirements, according to regulatory requirements. If you would like to learn more about our services or need support embedding AML best practice across your organisation, please reach out to our partners in BDO in Indonesia for further information.