Anti-Money Laundering and Counter-Terrorism Financing (Class Exemptions and Other Matters) Rules 2007

The instrument repeatedly operates through a small set of legal mechanisms and concepts that practitioners must track. Those core concepts are:

• Initial customer due diligence (section 28 of the AML/CTF Act): The instrument repeatedly states that “section 28 does not apply” for the purposes of subsection 39(3) where specified factual conditions are met (see Chapters 3.1, 4.1, 5.1). That is the central compliance obligation being varied: whether, when and to what extent an entity must identify and verify customers before providing a designated service.
• Designated services and items in tables: The instrument ties exemptions to items in the AML/CTF Act tables. Chapters 3 and 4 refer to item 30 of table 1 in s 6 (the service category to which ATM withdrawals and certain transfers belong), Chapter 5 refers to item 29 of table 1 (gift card related), Chapters 6 and 9 reference items in table 6 of s 6 (legal and real estate related), and Chapter 21 deals with item 35 of table 1 (issuing or selling a security or derivative). The instrument therefore works by subject‑matching: an exemption applies only if the service is covered by the stated item (see e.g. 3.1(a), 5.1(a), 7.1(a)).
• Occasional transaction: Several exemptions require the provision of the service to be an “occasional transaction” (3.1(b), 4.1(b), 5.1(b)). The instrument does not define “occasional transaction” within the provided text. That term acts as a gating concept that will be applied operationally by reporting entities, regulators and potentially courts or rule makers.
• Linkage and aggregation: For thresholds, the text requires consideration of “linked or appear to be linked” services when aggregating value to determine whether thresholds are exceeded (3.1(f), 4.1(e)). The instrument therefore imports an anti‑structuring/aggregation principle: multiple transactions that are linked must be aggregated for threshold tests.
• Product design constraints for exemptions: The gift card exemptions (Chapters 5 and 6) condition relief on product features: the stored monetary value cannot be increased (non‑reloadable except for reversals/corrections) and no part of the stored value may be withdrawn in cash (5.1(f)-(g); 6.1(d)-(e)). These are objective constraints that reporting entities and non‑reporting merchants must document.
• Ordering institution and beneficiary institution roles: The instrument clarifies when a person is not an ordering institution or beneficiary institution for certain gift card flows (6.1-6.2) and cross‑references the Anti‑Money Laundering and Counter‑Terrorism Financing Rules 2025 for rules determining such roles (note under Chapter 6). That creates a two‑tier structure for responsibility allocation depending on which party issues the card and whether the card issuer provides designated services.
• MIS service and second reporting entity confirmation: Chapter 21 introduces MIS service mechanics where a first reporting entity issuing an interest in a registered managed investment scheme can rely on confirmation from a second reporting entity (a participant) that initial CDD has been completed. The MIS service must, for an issue of a new interest, require initial CDD by the second reporting entity and provide confirmation to the first reporting entity before issue (21.3(4)(a)-(e), 21.4(6)). This creates an operational confirmation flow and permits reliance on another reporting entity’s CDD.
• Market definitions and proprietary systems: The instrument distinguishes declared financial markets (per Corporations Act s 9) and specified financial markets (defined at 21.4(12) to include ASX and FEX Global). It also provides an exemption where a transaction occurs on a foreign financial market that uses a “proprietary system” that makes it not reasonably practicable to conduct initial CDD in that jurisdiction (21.3(1)(b)). The concept of “proprietary system” is defined (21.4(10)).
• Temporal staging and sunset provisions: Many chapters include explicit repeal dates (Chapters 3, 4, 5, 6, 7, 8, 9). The instrument thus sets time‑limited exemptions which must be monitored for expiry.

These concepts interact to allocate initial CDD duties, create permissible reliance models (MIS confirmations), and define when design or operational features (non‑reloadable gift cards, use of proprietary market systems, duty lawyer contexts) allow a reporting entity to be relieved from initial CDD obligations. The instrument cross‑references the Corporations Act and the AML/CTF Rules 2025 for further detail on market status and ordering/beneficiary institution definitions, so those regimes are part of the operational concept set.

The instrument affects several discrete groups of actors and shifts who bears or is relieved of compliance responsibilities:

• Reporting entities under the AML/CTF Act: Entities that provide designated services listed in table 1 or table 6 of s 6 of the AML/CTF Act are directly affected because the instrument modifies when section 28 initial CDD applies to those services. For example, financial institutions that operate ATMs and provide the designated service covered by item 30 will be able to treat certain cash withdrawals as exempt from initial CDD when the conditions in Chapter 3 are met (3.1(a)-(f). Similarly, reporting entities issuing virtual assets and holding them for payers may have relief in Chapter 4 (4.1).
• Providers and issuers of gift cards: Two cohorts are affected. First, reporting entities that issue gift cards and provide the designated service covered by item 29 (Chapter 5) may be exempt from initial CDD when gift cards meet the design and transactional conditions in 5.1. Second, businesses that issue gift cards but do not otherwise provide designated services fall under Chapter 6; the instrument says they are not ordering institutions or beneficiary institutions if the listed conditions are satisfied (6.1-6.2). That affects merchants, retailers and other issuers that use gift cards as part of their ordinary business and do not want to be treated as banking or payments businesses under the AML/CTF Act.
• Operators and participants in financial markets: Chapter 21 affects market participants involved in issuing or selling securities or derivatives (item 35). Issuers on declared or specified financial markets (including ASX and FEX Global as “specified financial market”, 21.4(12)) are within the scope. The Chapter is structured so that issuers and market operators can rely on market mechanisms or MIS services to manage initial CDD - affecting operators, participants, registrars and MIS service providers.
• Providers of legal services and duty lawyers: Chapter 9 excludes the application of the AML/CTF Act to designated services that are incidental to provision of professional legal services by accredited community legal centres, certain Aboriginal and Torres Strait Islander Legal Services and Family Violence Prevention and Legal Services funded under specified agreements, and services provided by or paid for by legal aid commissions (9.1(b)-(c)). It also excludes services provided by duty lawyers or advocates at courts or tribunals on referral (9.2). Those legal actors therefore are relieved from the AML/CTF Act’s application for incidental services that meet the listed criteria.
• Barristers providing services to Australian government bodies: Chapter 7 specifies that designated services covered by an item of table 6 do not fall within the AML/CTF Act when provided by a barrister in the course of legal practice to an Australian government body (7.1). Practising barristers and the government bodies they serve will be directly affected by this carve‑out.
• Clearing and settlement facility operators and their business groups: Chapter 8 exempts designated services provided by operators of clearing and settlement facilities or by members of their business group, where those services are incidental to operation of the facility in the jurisdiction (8.1). That affects facility operators recognised under the Corporations Act 2001 and members of their business groups.
• Customers and payees: Although not the primary regulated party, customers and payees are affected indirectly. Where an exemption removes initial CDD, those customers may be subject to fewer identity checks before receiving funds (for ATM withdrawals, transfers to self‑hosted wallets, or gift card redemptions). The instrument quantifies value thresholds that determine when reduced checks apply and thus affects the degree of identity verification a customer can expect.
• Second reporting entities and MIS service operators: For managed investment scheme issues routed through an MIS service, the second reporting entity is specified as the party to carry out initial CDD and confirm completion to the first reporting entity via the MIS service (21.3(4)(c)-(e), 21.4(6)). That creates operational duties and liability exposure for the second reporting entity and for the MIS service to support confirmation functionality.
• Non‑Australian market participants and proprietary system operators: Where transactions occur on foreign financial markets using proprietary systems, the instrument recognises operational constraints for initial CDD and allocates treatment accordingly (21.3(1)(b)(i)-(ii)).

The instrument also creates time‑sensitive obligations that will affect organisations differently depending on the date of issuance of products (gift cards issued on or after 30 September 2027 or 31 March 2029, see 5.1(i)-(j) and 6.1(f)-(g)), and it imposes “reasonable grounds” standards on ordering institutions in some contexts (5.1(j)). Overall, the effect is to shift where initial CDD is required and, in several contexts, allow reliance on other parties or product design to avoid triggering s 28.

The instrument allocates duties and rights by specifying when initial customer due diligence is not required and by outlining confirmation and product‑design conditions that create duties for particular parties. The key duties and rights can be grouped as follows:

Duties removed (rights created to proceed without initial CDD)

• ATM withdrawals: Where the service is covered by item 30 of table 1, is an occasional transaction, the instruction for transfer of value was a withdrawal from an account held with a financial institution using an ATM, the value is paid as physical currency, and aggregated linked services are below $10,000, section 28 initial CDD does not apply (Chapter 3.1(a)-(f)). The right created is the ability to provide the designated service without conducting initial CDD in those circumstances.
• Withdrawals to self‑hosted virtual asset wallets: For item 30 designated services, where an occasional transaction is a withdrawal of virtual assets held by the reporting entity to a self‑hosted wallet controlled by the payee, and aggregated linked services are below $1,000, section 28 does not apply (Chapter 4.1(a)-(e)). The right created is the ability to perform the service without initial CDD.
• Gift card transfers where card is issued by a reporting entity: If a gift card (item 29 designated service) is an occasional transaction, the card was issued by a reporting entity, the stored value is non‑reloadable (except reversals/corrections), cannot be withdrawn in cash, and other temporal and domestic constraints are met, initial CDD under s 28 does not apply (Chapter 5.1(a)-(j)). The instrument also requires an ordering institution (in certain issuance dates) to have reasonable grounds to believe the person administering the scheme has taken reasonable steps to mitigate money laundering and terrorism financing risk (5.1(j)). That creates a duty of assessment for ordering institutions in those cases.
• Gift cards issued by persons not providing designated services: Persons who accept instructions via a gift card that they issued in the course of non‑designated business and meet the product constraints are not ordering institutions or beneficiary institutions for paragraphs 63A(4)(b) and 63A(8)(b) (6.1-6.2). That is effectively a right not to be treated as a regulated ordering/beneficiary institution in the specified circumstances.

Duties imposed or shifted

• MIS confirmation flow: For certain issues of interests in (registered) managed investment schemes, the rules require the first reporting entity to receive confirmation, through an MIS service, from a second reporting entity that initial customer due diligence has been carried out before issue (21.3(4)(c)-(e)). The duty falls on the second reporting entity to carry out initial CDD and on the MIS service to transmit confirmation; the first reporting entity has the duty to receive and rely on that confirmation before issue. The MIS service itself has functional requirements (21.4(6)(a)-(c)).
• Reasonable‑grounds assessment for gift card administrators and ordering institutions: For gift cards issued on or after the specified dates, an ordering institution must have reasonable grounds to believe that the person administering the card scheme has taken reasonable steps to mitigate ML/TF risk (5.1(j); 6.1(g)-6.2(g)). This is a subjective standard that creates an evidentiary and compliance duty.
• Incidental service carve‑outs: Legal aid, community legal centres and other specified legal services are permitted to provide incidental designated services without AML/CTF Act application where the service is incidental to non‑designated professional legal services (9.1(a)-(c)). The duty on those providers is to ensure the service is incidental and meet the accreditation or funding conditions specified.
• Barristers and government bodies: Barristers providing services in the course of legal practice to Australian government bodies are not subject to the AML/CTF Act for designated services covered by table 6 where the other conditions are met (7.1). The right is that such services fall outside the AML/CTF Act; the duty is implicit: ensure the service is of the specified type and to the specified bodies.

Operational obligations

• Aggregation and linkage: Reporting entities retain an ongoing obligation to consider whether services are “linked or appear to be linked” for the purpose of threshold calculations (3.1(f), 4.1(e)). That imposes an evidential and monitoring duty.
• Product features documentation: Where exemptions rely on product design (non‑reloadable, no cash withdrawal), issuers must be able to demonstrate and document that the product satisfies the constraints (5.1(f)-(g); 6.1(d)-(e)). That creates a duty of record keeping and product governance.
• Cross‑statute compliance: The instrument reminds reporting entities of their obligations under the Privacy Act 1988 when they undertake activities to comply with the AML/CTF Act (final paragraph). This is an explicit duty to comply with privacy law even where an entity might be otherwise exempt from the Privacy Act.

Rights to rely on other parties

• Reliance on second reporting entity and MIS confirmations: A first reporting entity has the right to rely on confirmation that initial CDD was carried out by a second reporting entity, transmitted via an MIS service, prior to issuing interests (21.3(4)(c)-(e)). That creates a compliance pathway to allocate CDD duties across market participants.
• Non‑treatment as ordering or beneficiary institution: Persons that meet the conditions in Chapter 6 have a legal right not to be treated as ordering or beneficiary institutions under the referenced paragraphs of s 63A.

Collectively, the instrument reallocates initial CDD duties, permits reliance on other participants or product features to avoid initial CDD in limited circumstances, and imposes specific evidential, recording and reasonable‑grounds duties on those who wish to rely on the exemptions.

The instrument itself does not specify new penalties. Instead, it operates by excluding or specifying the application of provisions of the AML/CTF Act, which contains the Act’s enforcement and penalty regime. The practical enforcement implications for regulated parties therefore derive from three structural features of the instrument:

• Reliance and compliance risk exposure: Where a reporting entity chooses to rely on the exemptions (for example, not to carry out initial CDD under s 28 because the Chapter 3 or 4 criteria are met), the entity remains subject to the AML/CTF Act in other respects and to the Act’s civil and criminal penalties if it incorrectly claims the exemption. The instrument sets out objective conditions (e.g. thresholds, product features, confirmation flows) that an entity must be able to demonstrate to justify reliance. Failure to satisfy those conditions but representing compliance with the exemption could expose the entity to enforcement action under the AML/CTF Act. The instrument therefore creates verification and record keeping points that enforcement bodies will use to test compliance.
• Subjective “reasonable grounds” obligations: The instrument imposes duties based on “reasonable grounds to believe” in relation to ordering institutions and gift card scheme administrators for cards issued on or after certain dates (5.1(j), 6.1(g), 6.2(g)). That phrasing is a standard legal benchmark that enforcement agencies can scrutinise. A regulator will assess whether the ordering institution had reasonable grounds at the relevant time, including the sufficiency of steps taken to mitigate risk. Misjudgement of “reasonable grounds” is a compliance vulnerability; the instrument does not quantify what suffices, and therefore enforcement will be fact‑sensitive.
• Confirmation reliance and attribution of responsibility: For MIS service based processes, the instrument allows a first reporting entity to rely on confirmation that a second reporting entity has carried out initial CDD (21.3(4)(c)-(e)). Enforcement will therefore examine whether the first reporting entity received valid confirmation through the MIS service prior to issue, and whether the second reporting entity in fact carried out initial CDD to standards required by section 28. If the confirmation is inaccurate or the second reporting entity’s CDD deficient, enforcement actions could be directed at either or both reporting entities depending on the facts and the Act’s provisions.

Because the instrument does not introduce bespoke penalty provisions, the relevant enforcement mechanisms remain those in the AML/CTF Act, including civil pecuniary penalties and criminal offences for serious breaches. The instrument’s repeals and sunset dates also create potential compliance traps: a reporting entity that relies on an exemption must track the repeal dates (for example Chapter 5 repealed 31 March 2031) to avoid non‑compliance once the chapter expires.

In addition, civil and regulatory scrutiny will likely validate the requirement to aggregate “linked or appear to be linked” services when testing thresholds (3.1(f), 4.1(e)). Enforcement agencies can treat structuring and deliberate splitting of transactions as evidence against an exemption claim if aggregation would have taken the total over the threshold.

Finally, the instrument’s cross‑reference to the Privacy Act 1988 imposes a separate compliance axis: misuse or incorrect handling of personal information gathered in AML/CTF compliance activities can trigger separate enforcement under the Privacy Act. The instrument expressly notifies reporting entities of that obligation (final paragraph), signalling that AML/CTF compliance cannot be considered free of privacy law constraints.

The instrument expressly cross‑references several statutory regimes and subordinate rules, and the exemptions it creates interact with other laws both directly and operationally. The main intersections are:

• Corporations Act 2001: Chapter 21’s market and MIS service rules rely on definitions in the Corporations Act. The instrument defines “declared financial market”, “participant” and “registered managed investment scheme” by reference to the Corporations Act (21.4(1A), (7), (9)). It also references the concept of an Australian market licence exemption granted under section 791C of the Corporations Act (21.4(1)). The MIS service arrangements and the ability to rely on market mechanisms therefore depend on market statuses and licencing positions determined under the Corporations Act.
• Anti‑Money Laundering and Counter‑Terrorism Financing Rules 2025: Chapter 6 notes that rules determining whether a person is an ordering institution (section 8‑1) or a beneficiary institution (section 8‑2) are in the AML/CTF Rules 2025. The instrument’s treatment of persons who issue gift cards but do not provide designated services depends on those Rules for further definition and operationalisation (note under Chapter 6). Practitioners must consult the Rules 2025 for the procedural and definitional details that determine ordering/beneficiary institution status.
• Privacy Act 1988: The instrument explicitly states that reporting entities, in relation to activities undertaken to comply with the AML/CTF Act, continue to have obligations under the Privacy Act 1988 and the Australian Privacy Principles. This preserves privacy obligations even where an entity would otherwise be exempt from the Privacy Act (final paragraph). Therefore, collecting or using personal information as part of CDD, MIS confirmations or product administration must comply with privacy law.
• Corporations Act and ASX Listing Rules (external market instruments): Chapter 21 references Chapter 19 of the ASX Listing Rules in defining “dividend or distribution plan” (21.4(2)), and the term “initial public offering” in the managed investment scheme context is defined in the text (21.4(3)). These connections mean that compliance with market disclosure, listing and corporate law regimes will affect whether the instrument’s exemptions can be used.
• AML/CTF Act sections and tables: The instrument repeatedly modifies the operation of specific AML/CTF Act provisions, notably section 28 (initial CDD), subsection 39(3) (which the instrument uses as its gateway to exclude s 28), paragraph 63A(4) and paragraph 63A(8) (ordering/beneficiary institution definitions), subsection 6(5C) (in Chapter 2.1), subsection 6(2) table items, subsection 247(3) (exemptions), and section 229 (rule‑making power used for Chapter 21). The instrument therefore operates as a formal specification under the AML/CTF Act and must be interpreted in the context of the Act’s existing scheme.
• Funding agreements and accreditation schemes: Chapter 9 relies on accreditation and funding conditions for community legal centres and specified Aboriginal and Torres Strait Islander services, including the National Accreditation Scheme of Community Legal Centres Australia and the National Access to Justice Partnership funding arrangements (9.1(b)-(c)). The instrument’s carve‑out for legal assistance thus interacts with administrative law and funding instruments that determine whether a provider qualifies.
• Foreign law and market operational constraints: Chapter 21 recognises transactions occurring “on a financial market in a foreign jurisdiction” where the market uses a proprietary system and where it is “not reasonably practicable to conduct initial customer due diligence on the customer in that jurisdiction” (21.3(1)(b)(i)-(ii)). This provision expressly accommodates practical conflicts between the AML/CTF Act’s CDD expectations and operational realities of foreign markets. It raises issues of cross‑border evidence gathering, privacy and conflicts of law.

Operationally, these interactions create both compliance pathways and coordination obligations. For example, a managed investment scheme issuer that intends to rely on an MIS service confirmation must ensure the MIS service and the participant conform to Corporations Act participant and MIS service rules, and must document the confirmation flow to satisfy the AML/CTF Act obligations. Similarly, a business issuing gift cards must consider both the AML/CTF Rules 2025 ordering institution definitions and privacy law obligations when determining whether it can fall within Chapter 6.

The instrument does not modify the operation of those other statutes beyond the specified carve‑outs and cross‑references. Practitioners will therefore need to consider the instrument in conjunction with the AML/CTF Act, the Corporations Act, the AML/CTF Rules 2025 and the Privacy Act to form a complete compliance picture.

The instrument itself contains internal temporal amendments in the form of sunset or repeal provisions for multiple chapters and establishes rule‑making authority for Chapter 21 under section 229 of the AML/CTF Act. The textual amendment history visible within the instrument is therefore limited to those repeal dates and the sections authorising the rules. The key time‑line elements are:

• Repeal dates inserted for specific Chapters: The instrument specifies repeal dates for several Chapters. Chapter 3 (ATM withdrawals) and Chapter 4 (self‑hosted virtual asset wallet withdrawals) are each repealed on 31 March 2036 (3.2; 4.2). Chapter 5 (gift cards issued by reporting entities) and Chapter 6 (gift cards issued by persons not providing designated services) are each repealed on 31 March 2031 (5.2; 6.3). Chapter 7 (barristers to Australian government bodies) is repealed on 31 March 2036 (7.2). Chapter 8 (clearing and settlement facilities) is repealed on 31 March 2031 (8.2). Chapter 9 (legal assistance) is repealed on 31 March 2033 (9.3). These are explicit statutory sunset clauses within the instrument.
• Rule‑making authority: Chapter 21 notes that the Anti‑Money Laundering and Counter‑Terrorism Financing Rules made in that Chapter are made under section 229 of the AML/CTF Act for paragraph (d) of item 35 of table 1 in subsection 6(2) and subsection 247(3) of that Act (21.1). That indicates the formal delegation and legislative basis for the Rules contained in Chapter 21.
• No other amendment history or prior versions are included in the provided text. The instrument itself does not attach an explanatory memorandum or second reading speech in the provided text that sets out previous iterations or prior‑in‑time amendments. The instrument does, however, cross‑reference external instruments (AML/CTF Rules 2025 and Corporations Act materials), which may themselves change and thus affect the operation of the instrument.
• Staged operational commencement implied by issuance dates for gift cards: The instrument stages particular obligations according to the date a gift card was issued (for example, obligations that apply to gift cards issued on or after 30 September 2027 and 31 March 2029 , see 5.1(i)-(j), 6.1(f)). Those dates create phased application of duties rather than administrative amendments per se, but they are functionally amendment‑like in that they set the regime’s future state for newer gift cards.

Because the instrument contains expiry provisions for numerous chapters, the practical amendment history for regulated entities will involve monitoring when those sunset clauses expire and whether the legislature or regulator extends, replaces or makes permanent the measures. The instrument itself does not narrate prior amendments, nor does it list commencement dates for the instrument as a whole in the text provided here. Practitioners will need to refer to the instrument’s Federal Register or legislative enactment details to record commencement and any subsequent legislative amendments.

The provided instrument text does not cite, mention or record any judicial decisions or litigation concerning its provisions. No cases are named in the source material. Therefore, there is no litigation history contained in the instrument itself that can be reported.

That absence has practical implications and risks worth noting for readers assessing litigation exposure:

• Novelty of exemptions and untested standards: Several provisions create subjective standards or novel reliance models (for example, the “reasonable grounds to believe” test for ordering institutions in relation to gift cards issued on or after certain dates, 5.1(j); and the MIS confirmation reliance model in 21.3(4)). Where the instrument establishes standards that are novel or fact‑sensitive, litigation risk arises from the absence of judicial interpretations clarifying the scope or evidentiary thresholds for those standards. Courts have not, in this instrument, provided interpretive guidance.
• Unlitigated MIS reliance: The MIS service confirmation mechanism in Chapter 21 allocates responsibility between a first reporting entity and a second reporting entity in a way that could produce disputes about attribution of negligence or breach if illicit funds pass through an interest issuance despite confirmations having been given. Because there are no cases in the instrument, outcomes on attribution, adequacy of confirmation and how regulators apply the Act in such scenarios remain untested in the courts.
• Defining “occasional transaction” and “linked or appear to be linked”: The instrument uses those terms as gating concepts for several exemptions (for example “occasional transaction” in 3.1(b), 4.1(b), 5.1(b); and the aggregation test “linked or appear to be linked” in 3.1(f), 4.1(e)). Litigation could arise over how courts interpret these standards in the absence of regulatory guidance or precedent. Without case law, businesses must rely on their own legal advice and risk assessment.
• Enforcement proceedings rather than test litigation: In practice, the first encounters with the boundaries of these exemptions may arise in regulatory enforcement or administrative proceedings rather than contested litigation between private parties. Regulatory enforcement decisions and administrative reviews could generate jurisprudence or procedural clarifications. The instrument itself does not contain such decisions.

In short, the instrument contains no litigation history within its text. Practitioners should anticipate that the provisions which introduce subjective standards, reliance on third‑party confirmations, product‑design tests and aggregation requirements are likely candidates for regulatory scrutiny and eventual judicial or administrative clarification. Until case law develops, compliance will require conservative documentation, reliance on contemporaneous evidence, and possibly consultation with regulators or legal counsel where ambiguity about interpretation arises.

The instrument contains a number of detail‑sensitive traps and operational pitfalls that can catch an unwary practitioner, compliance officer or issuer. These include definitional ambiguities, threshold effects, timing dependencies and reliance allocation risks. Key gotchas to note are:

• “Occasional transaction” is not defined in the text: Chapters 3, 4 and 5 make the exemptions conditional on the service “being an occasional transaction” (3.1(b), 4.1(b), 5.1(b)). The instrument does not define “occasional transaction” in the provided text. Practitioners cannot assume a universal meaning; whether a transaction qualifies as “occasional” will depend on facts and possibly regulator guidance. Treating repeated but superficially small transactions as “occasional” could be challenged.
• Aggregation of linked transactions: The thresholds for ATM withdrawals ($10,000) and virtual asset wallet withdrawals ($1,000) apply to “the total value transferred as a result of the designated service, and any other services covered by item 30 of table 1 … that are linked or appear to be linked” (3.1(f), 4.1(e)). This non‑technical phrasing invites scrutiny and may capture structured attempts to evade thresholds. Entities should implement systems to detect linkages and to document why a set of transactions is not linked where they elect to treat them separately.
• Timing and issuance date thresholds for gift cards: The instrument treats gift cards differently depending on the date they were issued. For example, for gift cards issued on or after 31 March 2029 the transfer must be a domestic transfer of value (5.1(i)); for cards issued on or after 30 September 2027 an ordering institution must have reasonable grounds to believe the scheme administrator has taken reasonable steps (5.1(j)). The chronology matters: gift cards issued before those dates are subject to different rules. Issuers and purchasers must track issuance dates and associated compliance regimes.
• Restricted product design conditions for exemptions: Gift card exemptions require the stored monetary value cannot be increased (other than as reversal or correction) and that no part can be withdrawn in cash (5.1(f)-(g), 6.1(d)-(e)). Product changes, firmware updates or business model changes that introduce reloadability or cash‑out will eliminate the exemption. Entities should document product features and change control processes.
• “Reasonable steps to mitigate and manage the risk” is an evidentiary standard: The instrument requires ordering institutions to have “reasonable grounds to believe” scheme administrators have taken reasonable steps to mitigate ML/TF risk for certain gift cards (5.1(j), 6.1(g), 6.2(g)). That standard is fact‑specific and enforceable. Simple representations by scheme administrators without documentary evidence may be insufficient. Entities should maintain records and evidence of the steps taken by administrators and their own assessment.
• MIS confirmation requires functional integration and timing discipline: Under 21.3(4)(e) the first reporting entity must have received confirmation from the second reporting entity, through the MIS service, that initial CDD has been carried out before issuing the interest. The requirement is a sequencing and evidence rule. If confirmations are delayed, absent or incorrectly transmitted, the first reporting entity may not be able to proceed with issuance. Operationally, this requires robust MIS service capabilities and clear workflows between participants.
• Foreign proprietary systems and practical CDD limits: Chapter 21 allows exemptions where a foreign financial market uses a proprietary system and it is “not reasonably practicable” to conduct initial CDD in that jurisdiction (21.3(1)(b)). The test of “not reasonably practicable” is fact‑sensitive and may vary by market; entities should document the operational impediments and attempt alternative verification channels where possible to reduce regulatory challenge.
• Repeal dates create lapsing compliance duties: Many Chapters contain sunset clauses (see respective Repeal provisions). Entities that rely on relief must track expiry dates and institute transition plans to reintroduce initial CDD or alternative controls when a chapter is repealed.
• Interaction with Privacy Act: The reminder that privacy obligations remain even where an entity is exempt from the Privacy Act (final paragraph) is a practical gotcha. Entities that decide not to carry out initial CDD must still handle personal data in accordance with privacy law where they collect or receive it in other compliance processes.
• No blanket immunity: The instrument does not provide blanket immunity from all AML/CTF obligations. The exemptions are specific and conditional. Mistakenly extrapolating one exemption to another activity can lead to enforcement exposure.
• Ordering institution/beneficiary institution rules lie partly in separate Rules: Chapter 6 refers to sections in the AML/CTF Rules 2025 for the detailed tests of ordering and beneficiary institution status (note under Chapter 6). Failure to consult those Rules could lead entities to misclassify themselves.

Each of these points is grounded in the text. Practitioners should therefore perform a fine‑grained factual mapping when considering reliance on an exemption and implement record keeping, automated aggregation checks, dated product documentation, MIS confirmation logs and privacy impact assessments to mitigate these gotchas.

To rely safely on the instrument’s exemptions and to avoid enforcement risk, regulated parties should implement a compliance programme that documents factual predicates, maintains evidence trails, and establishes operational safeguards. The following steps are practical and directly traceable to the provisions of the instrument:

1. Map services to AML/CTF table items and record legal basis

   • For each service the entity provides, document whether it is covered by the relevant item in s 6 (for example item 30 for ATM and certain transfers, item 29 for gift cards, item 35 for issuing/selling securities/derivatives). The instrument’s exemptions are conditional on that coverage (see 3.1(a), 4.1(a), 5.1(a), 21.3). Maintain a legal basis memorandum that attaches the relevant provision from the Act and references the applicable Chapter in this instrument.

2. Implement threshold and linkage detection for ATM and virtual asset withdrawals

   • For Chapter 3 (ATM): implement systems to block or flag transactions that would cause the total value of linked services to reach or exceed $10,000 (3.1(f)). Include business rules to detect “linked or appear to be linked” transactions and retain evidence of linkage assessments (time, accounts, payees).
   • For Chapter 4 (self‑hosted wallets): implement similar detection for the $1,000 threshold (4.1(e)). For virtual assets, ensure wallets are self‑hosted and demonstrably controlled by the payee before treating the transaction as within the exemption (4.1(d)).

3. Verify “occasional transaction” status and adopt a conservative definition

   • Because “occasional transaction” is not defined in the text, adopt and document a conservative operational definition in policy, with escalation triggers to legal or compliance when frequency or pattern leads to uncertainty. Record rationale for treating a transaction as occasional.

4. Product governance and documentation for gift cards

   • For gift cards (Chapters 5 and 6), implement product control processes to ensure the card meets the non‑reloadable requirement and that cash withdrawal is impossible. Retain documentation and system logs showing stored value rules, source code or configuration management entries, and any updates.
   • Maintain records of the gift card issuance date because treatment differs depending on issuance dates (5.1(i)-(j); 6.1(f)). Prepare migration or remediation plans for cards issued before/after the relevant dates.

5. Reasonable‑grounds assessments and evidence

   • Where the instrument requires an ordering institution to have reasonable grounds to believe that a scheme administrator has taken reasonable steps to mitigate ML/TF risk (5.1(j)), document the steps taken to verify that assessment. Obtain statements, policies, audit reports or certifications from scheme administrators and retain those as contemporaneous evidence of the ordering institution’s basis for reliance.

6. MIS service integration and confirmation flows for managed investment scheme issuance

   • For Chapter 21 MIS requirements, build or procure MIS services that meet the functional requirements in 21.4(6) (receiving, processing and settling; requiring initial CDD by the second reporting entity; confirming via the MIS service to the first reporting entity before issue).
   • Create standard operating procedures that prevent issuance until the MIS service transmits confirmation that the second reporting entity has carried out initial CDD, and retain system logs of those confirmations for audit purposes.

7. Maintain robust record keeping and audit trails

   • Across all exemptions, maintain contemporaneous records demonstrating that conditions were met: logs for ATM/ATM network usage, wallet deposit/withdrawal records, gift card product documentation, confirmations from second reporting entities via MIS, reasonable‑grounds memoranda. These records will support reliance in any regulatory review, particularly because the instrument does not alter enforcement standards.

8. Monitor repeal dates and plan transitions

   • Implement a compliance calendar that tracks the repeal dates applicable to relevant Chapters (for example 31 March 2031 for Chapters 5 and 6, 31 March 2036 for Chapters 3, 4 and 7). Plan for reinstating section 28 CDD processes and adjusting product and operational flows ahead of sunset dates.

9. Coordinate privacy compliance

   • Ensure AML/CTF activities that involve personal information comply with the Privacy Act 1988 and the Australian Privacy Principles. Prepare privacy impact assessments and data handling policies for any personal data collected, including via MIS confirmations, gift card registration, or virtual asset withdrawals.

10. Engage with AML/CTF Rules 2025 and the Corporations Act dependencies

    • For ordering/beneficiary institution status and other role definitions referenced to the AML/CTF Rules 2025 (note under Chapter 6), ensure procedures reflect the Rules’ tests. For market and MIS interactions, ensure compliance with Corporations Act definitions and any market licence conditions referenced in 21.4.

11. Escalation and exception handling

    • Define clear escalation paths where a transaction potentially falls outside an exemption (for example, linked transactions that aggregate above the threshold, reloadable gift cards, or where a MIS confirmation is delayed). Require manual CDD or refusal to proceed where uncertainty exists.

12. Training and vendor contracts

    • Train front line and operations staff on the specific exemptions and the evidentiary requirements. Include contractual obligations for third parties (MIS service providers, scheme administrators, card processors) to provide required confirmations, attestations and audit support.

13. Document policy positions and legal advice

    • Where subjective standards must be applied (reasonable grounds; “not reasonably practicable”), obtain and retain internal legal memos and compliance committee minutes describing the rationale for reliance. That documentation will be important for demonstrating good faith compliance.

14. Periodic review and supervisory engagement

    • Conduct periodic reviews of reliance on the exemptions, sample transactions to test whether conditions continue to be met, and consider engaging proactively with the regulator if systemic issues arise or if interpretive uncertainty is affecting material business lines.

By mapping each practical step to the relevant clauses in the instrument (for example Chapter 3.1(f) for the $10,000 ATM aggregation rule; Chapter 4.1(e) for the $1,000 virtual asset aggregation rule; Chapter 5.1(f)-(g) for gift card product constraints; Chapter 21.3(4) and 21.4(6) for MIS confirmations), entities can build an auditable compliance framework that documents reliance, evidences reasonable‑grounds assessments and ensures operational readiness for sunset clauses and cross‑statutory obligations such as the Privacy Act.