Privacy policy

About this policy

We’re Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) regulator and financial intelligence unit (FIU). Our objectives are to detect, deter and disrupt the threats and risks of money laundering, terrorism financing, proliferation financing (we refer to these as ML/TF) and serious crimes. To achieve this, we:

• regulate reporting entities to deliver best practice AML/CTF outcomes
• share actionable financial intelligence to support domestic and international efforts to combat such threats and risks.

The Privacy Act 1988 (Privacy Act) requires agencies and entities bound by the Australian Privacy Principles (APPs) to have a privacy policy concerning the handling and management of personal information. We’re an agency bound by the APPs. Therefore, this privacy policy outlines our practices for the collection, storage, use and disclosure of personal information to carry out its functions under:

• the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act)
• the repealed Financial Transaction Reports Act 1988 (FTR Act)
• any other legislation that confers powers or functions on our CEO, such as the:
  • Privacy Act 
  • Freedom of Information Act 1982 (FOI Act)
  • Public Service Act 1999. 

This privacy policy covers all aspects of our functions. This includes AUSTRAC Online and the Fintel Alliance, a public/private AML/CTF partnership established and led by us. The alliance facilitates the sharing of information and financial intelligence among trusted public and private sector partners to combat ML/TF and other serious crimes.

In addition to outlining our practices for the handling and management of personal information, it also provides information on how you can:

• access and correct your personal information held by us
• contact us to make a complaint if you believe your personal information has not been appropriately dealt with.  

This privacy policy also includes the handling and management of, where relevant, any sensitive information – which is defined in the Privacy Act and refers to specific kinds of personal information such as criminal records or health information.

Collection of personal information

At all times, we’ll only collect personal information we need to perform our functions, whether under the AML/CTF Act or any other legislation. 

Our functions under the AML/CTF Act include:

• providing access to, and sharing, our information to support domestic and international efforts to combat ML/TF and other serious crimes
• providing advice and assistance in relation to our information to persons and agencies who are entitled, or authorised, to access our information
• advising and assisting reporting entities in relation to their obligations under the AML/CTF Act, the regulations and the AML/CTF Rules
• when you access and use our website, AUSTRAC Online and web-based channels
• facilitating gaining timely access to the financial, administrative and law enforcement information that our Chief Executive Officer (CEO) requires to properly undertake their financial intelligence functions.

Our information is defined in section 5 of the AML/CTF Act. In very general terms, it refers to information – whether or not it’s also personal information – which we’ve lawfully obtained under legislation or from another government body. This includes information we’ve generated, such as a compilation or analysis of the information we obtained.

Functions under other legislation for which we collect personal information include, for example:

• responding to requests for information under the FOI Act
• procuring services from contractors and service providers under the Public Governance, Performance and Accountability Act 2013. 

When we collect personal information

We collect this personal information directly and indirectly to fulfil these functions. Examples of how we may collect information directly from you include when you: 

• access and use our website and web-based channels
• call AUSTRAC Central to speak with one of our staff
• write to us about a query you have
• complete an application, such as when you apply to be enrolled with us as a reporting entity or when you request access to your personal information under the FOI Act
• apply for a job with us
• submit a report to us about the cross-border movement of physical currency or bearer negotiable instruments into or out of Australia.

Collecting information indirectly

A large proportion of personal information we collect is collected indirectly. One of the many ways in which personal information is collected indirectly is from reporting entities. Reporting entities are entities that provide designated services that are listed in section 6 of the AML/CTF Act, such as:

• remittance and virtual asset service providers
• financial services providers
• the gambling industry
• bullion dealers
• real estate professionals
• dealers in precious stones, metals and products
• professional service providers such as lawyers, conveyancers, accountants, and trust and company service providers.

Reporting entities are subject to our regulatory supervision and have various obligations under the AML/CTF Act. This includes a requirement to report financial transactions (threshold transactions and international fund transfer instructions) and suspicious activities. ISO 20022 has been implemented by SWIFT as the global end-to-end messaging system for international fund transfers conducted between financial institutions. 

As ISO 20022 will include a greater amount of data aimed at increasing the transparency and security of international fund transfers this will result in the collection of a greater amount of personal information by us. This will occur via reports of international fund transfer instructions (IFTI) submitted by reporting entities. 

When financial transactions or suspicious activities relating to individual customers are reported to us, the personal information of those customers is submitted to us and may include:

• name
• date of birth
• residential address
• telephone or mobile numbers
• bank account details
• other details the reporting entity determines relevant to the financial transactions or suspicious activities of the customer. 

Reporting entities may also be required, under compulsory notice, to provide personal information to us during:

• our supervision of the reporting entities’ compliance with other AML/CTF obligations
• enforcement investigations of breaches of the AML/CTF Act.

We may also collect personal information indirectly when: 

• the information is lawfully obtained from other Commonwealth, state or territory government agencies or authorities, including law enforcement agencies, or a government of a foreign country or a foreign agency. For example, we may obtain personal information from:
  • another agency for the purpose of conducting a data-matching exercise to support and enhance the performance of our AML/CTF regulatory functions and financial intelligence functions
  • an international counterpart in relation to persons of interest suspected of engaging in money laundering or other illicit financial activities
• our service providers or suppliers provide information to us as a necessary or incidental part of the performance of their contract
• a nominated member of an entity that provides a ‘designated service’ (as defined by the AML/CTF Act) applies for enrolment and, where applicable, registration and provides the personal information of all key personnel associated with that entity for the purposes of enrolment and, where applicable, registration
• the information is given to us without being solicited, such as dob-in information from members of the public about suspected financial crime
• the information is obtained or originates from:
  • public sources such as news and media websites
  • other open sources such as social networking platforms
  • other publicly accessible sources operated by third party vendors (with or without payment/subscription).

Personal information lawfully collected by us becomes our information. This means that, in addition to the various requirements of the APPs, the use and disclosure of such personal information (as our information) is also subject to the controls and restrictions provided for by the secrecy and access provisions in the AML/CTF Act.

You can learn more about disclosure of information.

Where personal information has been lawfully obtained pursuant to a contract (and becomes our information), the disclosure of the personal information may also be subject to any relevant terms and conditions stipulated in the contract.

Collecting sensitive information

The circumstances in which we may collect sensitive information include, but aren’t limited to the following:

• Where an entity applies to be registered as a remittance service provider or a digital currency exchange (DCE) provider, we collect information about any criminal record/prior convictions of the entity’s key personnel to determine whether registration of the entity as a remittance service provider or DCE provider is appropriate. Such collection could be from the entity directly or could be from our domestic partner agencies.
• Where a nominated member of an entity that provides a ‘designated service’ (as defined by the AML/CTF Act) applies to us for enrolment and, where applicable, registration, and provides information about any criminal record/prior convictions of the entity’s key personnel to support the application.
• For security purposes, we collect personal, including sensitive, information from individuals applying for jobs with us or providing services to us under contract, to assess their suitability for employment or as a contracted service provider. Where required, we may also collect personal, including sensitive, information from its staff members during the course of their employment.
• When we receive information from other government agencies while collaborating on a law enforcement investigation.

Anonymity

Except where circumstances or legislation require it, we’ll allow you to interact with us anonymously or to use a pseudonym if you wish. For example, if you contact AUSTRAC Central to make a general enquiry and you don’t wish to provide your name, we won’t insist on asking for your name or other personal information if you indicate you don’t wish to provide these details.

However, for the most part we’ll usually need your personal information such as your name and contact details and any other relevant information to enable us to effectively and efficiently respond to the matter that you may be enquiring about. Withholding your personal information may mean that we’re not able to carry out our functions and provide the services you require. For example, if you seek access to your own personal information held by us but don’t provide your name, date of birth and other personal information reasonably necessary for us to identify information relating to you in our data holdings, then we wouldn’t be able to assist you with your access request.

Collection by Fintel Alliance

Fintel Alliance is an AUSTRAC initiative established and led public/private partnership to facilitate the timely and effective sharing of information amongst trusted public and private sector partners to combat and disrupt money laundering, terrorism financing and other serious crimes. Government agencies and private entities participating in the Fintel Alliance include:

• the Attorney General’s Department
• the Australian Criminal Intelligence Commission
• the Australian Federal Police
• some of the major banks
• various state police forces.  

As the Fintel Alliance is a conglomerate of international and domestic public and private sector partners, it doesn’t usually ‘collect’ information at its own initiative. Rather, information, including personal information, is collected by individual participants in the course of performing their daily functions and activities in accordance with their own governing legislation (for public partners) or business operation (for private partners). Information is then shared within Fintel Alliance in accordance with the information-sharing arrangement outlined in the Fintel Alliance Member Protocol and relevant schedule to the Member Protocol, which is agreed to by all Fintel Alliance participants. 

The Fintel Alliance Member Protocol requires all participants of Fintel Alliance to comply with:

• their privacy obligations under the applicable privacy legislation of the jurisdiction to which they’re subject (for example, the NSW Police Force would be bound by the NSW privacy legislation instead of the Privacy Act)
• any common law obligations of confidentiality. 

Public sector Fintel Alliance participants are also required to adhere to the secrecy provisions of any relevant legislation that govern their functions and activities. They must only disclose and share information (which may include personal information) in accordance with any restrictions imposed by their relevant governing legislation.

Learn how information is shared and used within Fintel Alliance under disclosure of information.

Collection through our website

When you visit our website and AUSTRAC Online, a record of your visit is logged and information is automatically recorded for statistical purposes to enable us to improve the site and our services. This information doesn’t identify you individually and we don’t otherwise track information about you and your visits. 

Your web browser supplies information that includes:

• IP address of your device
• type of web browser used
• your device’s operating system
• date and time you accessed our website
• pages you visited and any documents downloaded
• if you followed a link to our website from another website – the address of that website.

Cookies

Our website uses cookies to better serve you when you return to the website. A cookie is a piece of data that a site can send to your browser, which may then be stored on your computer as an anonymous tag that identifies your computer but not you.

In addition, we make use of third-party sites such as YouTube and others to deliver content. Such third-party sites may send their own cookies to your computer. We don’t control the settings of third-party cookies and suggest you check the third-party websites for more information about their cookies and how to manage them.

Most internet browsers are pre-set to accept cookies. If you prefer not to receive cookies, you can adjust your internet browser to refuse cookies or to warn you when cookies are being used.

Google Analytics

Our website and selected forms use Google Analytics, which collects and transmits website traffic data to servers located offshore. Google Analytics anonymises individual users without collecting personally identifiable information. We won’t use any data from Google Analytics to personally identify you. 

We use this Google Analytics data to help us improve the website and selected forms (such as the Enrolment and Registration form). The anonymised data collected via Google Analytics may include:

• your navigation patterns across specific pages and forms
• pages you visit
• device details
• language
• details of browser and operating system
• screen size and orientation
• mouse clicks and areas your mouse hovered over
• fields you’ve entered information into
• time to complete certain tasks
• movement through website pages. 

Google publishes further information about how Google Analytics collects and processes data on the Google Analytics data privacy and security page. 

Social networking services

We use social networking services such as X,  Facebook, LinkedIn and YouTube to communicate with the public about our work. When you directly engage with us using these services we may collect your information, but we only use it to communicate with you. The social networking service provider will also collect and handle your personal information for its own purposes. These services have their own privacy policies. You can access the privacy policies of these service providers on their websites. 

We also collect personal information from open sources such as social networking platforms or websites (among other sources) to strengthen our analysis of financial intelligence information and enhance the synthesis and development of intelligence products. These are then shared with other government agencies or entities in accordance with our functions. This supports domestic and international efforts to combat the threats of money laundering, terrorism financing and other serious crimes.

User sentiment tool

We use a user sentiment tool on our enrolment and registration forms that allows users to provide us with feedback about their experiences with the form. If you provide us with feedback, we may collect the following information:   

• a one-to-5-star rating
• feedback provided in the free-text field
• the completed enrolment and registration forms
• a unique identifier that doesn’t personally identify you. 

Any information collected is de-identified and destroyed in accordance with the Privacy Act, unless you’ve provided consent to be contacted for future feedback opportunities.

Disclosure of information

Information, including personal information, which we’ve lawfully collected under the AML/CTF Act or any other law of the Commonwealth, state or territory, or which we’ve obtained from another government body, is our information. The AML/CTF Act, together with other applicable legislation such as the Privacy Act, governs the use and disclosure of our information.     

Disclosure of our information is prohibited unless a relevant exception applies. These include disclosure:

• for the purposes of the AML/CTF Act or the repealed FTR Act
• for the purposes of the performance of our CEO’s functions
• to an official of a Commonwealth, state or territory agency for the purpose of the performance or exercise of the official’s functions, duties or powers in relation to the agency.

Put simply, disclosure of our information, such as financial transaction reports, suspicious matter reports, or financial intelligence products, will fall within one of the aforementioned exceptions if the disclosure relates to or supports our and other agencies’ law enforcement, regulatory or intelligence efforts to detect, deter and disrupt money laundering, terrorism financing and other serious crimes.

Examples of circumstances in which we may disclose our information containing personal information outside of AUSTRAC include disclosure:

• to other government agencies to support an investigation of a crime or other breaches of the law
• to a foreign government or a foreign agency to combat money laundering, terrorism financing or other serious crimes
• to courts or tribunals in proceedings where our information may be relevant
• to reporting entities to enable compliance with the AML/CTF Act
• within Fintel Alliance in accordance with the Fintel Alliance Member Protocol.

Disclosure to other government agencies

Under the AML/CTF Act, our CEO may authorise officials from specific Commonwealth, state or territory agencies to access our information. We may also, at our discretion, voluntarily disclose our information to an official of another Commonwealth, state or territory agency pursuant to one of the aforementioned exceptions.  

An authorised official of a Commonwealth, state or territory agency who has obtained our information is prohibited from further disclosing the information, unless the disclosure is:

• for the purpose of the performance of the official’s duties
• to another official of a Commonwealth, state or territory agency for the purpose of the performance of the other official’s duties.

Disclosure to foreign government agencies

We may also disclose our information containing personal information to the government of a foreign country or a foreign agency (for example, to our overseas counterpart) from time to time if the disclosure is appropriate in all the circumstances. 

Before we disclose information to a foreign government or a foreign agency, we’ll generally negotiate and sign an information-sharing Memorandum of Understanding (MoU) with the foreign government or foreign agency where we anticipate we’ll engage in frequent sharing of information with that foreign government or foreign agency. The MoU will clearly articulate the terms and conditions relating to the:

• confidential treatment of the information
• controls that will be applied to the use and distribution of the information.

They’ll also include an undertaking that the information will be used only for certain purposes specified in the MoU.  

Sharing information

In situations where information is being shared on an ad hoc basis such that the negotiation of an MoU may not be necessary or warranted, before we share the information we’ll still seek an undertaking from the relevant foreign government or foreign agency (usually in the form of a letter of agreement). This is to assure ourselves that the foreign government or foreign agency will only use the information for the purpose for which it’s shared and that they’ll handle and protect the information appropriately. This includes us engaging with foreign governments in the instances where we believe there is a criminal risk and need to seek more information.

In circumstances where there is an urgent need to share our information because of a critical incident or for public safety and we don’t have an MoU with the relevant foreign government or foreign agency, and there is no time to sign a letter of agreement (such as a terrorist attack), our CEO may disclose our information without seeking an undertaking. However, the disclosure of our information must still be appropriate in all of the circumstances.

Disclosure to courts or tribunals

Occasionally, court or tribunal proceedings may arise that require the disclosure of our information containing personal information.

The AML/CTF Act provides that except where it’s necessary to do so for the purpose of giving effect to that Act or the repealed FTR Act, we aren’t required to produce to a court or tribunal documents containing our information, or to disclose our information (the same applies to any other person who has obtained our information).

This ensures that we can determine, on a case-by-case basis, whether disclosure of our information containing personal information is necessary or appropriate, or whether the information should be withheld having regard to all the circumstances.

Disclosure to reporting entities

We may disclose personal information to reporting entities to obtain further information that we reasonably believe the reporting entity may have about the individual to whom the personal information relates, as permitted under the AML/CTF Act. 

For example, if following review of some financial transaction reports we suspect that a customer of a bank may be involved in money laundering or other criminal activities, we may disclose the personal information of that customer to the bank. This is for the purposes of enabling the bank to identify the customer in question and providing us with further information that will assist our or other law enforcement agencies’ investigations into that customer.

Disclosure of information within Fintel Alliance

Under the Fintel Alliance Member Protocol which all public and private participants of Fintel Alliance have agreed to, participants disclose and share personal information with each other in accordance with the respective legislation that applies to them.

Just as we’ll only disclose personal information constituting our information within Fintel Alliance in accordance with and subject to the restrictions in the AML/CTF Act, other public Fintel Alliance participants will only disclose personal information in their possession in accordance with their governing legislation (and the relevant privacy legislation that applies to them). 

Private Fintel Alliance participants that’re reporting entities disclose personal information to us pursuant to their reporting obligations under the AML/CTF Act. They may also disclose personal information to us in response to compulsory notices for production of information issued under the AML/CTF Act. 

Outside of their reporting obligations and requirement to respond to compulsory notices, private Fintel Alliance participants may also voluntarily disclose personal information to us and other public Fintel Alliance participants that are ‘enforcement bodies’ for the purposes of the Privacy Act. This may occur if the private Fintel Alliance participant reasonably believes that the disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, us and/or other public Fintel Alliance participants. 

Disclosure of personal information by private Fintel Alliance participants which aren’t reporting entities is subject to the relevant privacy legislation that applies to them.    

Security of information

When we receive your personal information, whether directly from you or indirectly from other sources, the information is stored in a secure environment. In addition to information classification and dissemination limitation markers, all information kept on our electronic databases is protected by security measures such as password protection or access restriction to only authorised personnel. 

We won’t use or disclose your personal information unless you’ve consented to that use or disclosure, or the use or disclosure is otherwise required or authorised by the AML/CTF Act or other relevant legislation.   

We take reasonable steps to ensure your personal information is protected from misuse, loss and unauthorised access, modification or disclosure. We may hold your information in either electronic or hard copy form. Personal information that’s no longer needed is destroyed in accordance with the requirements of the Archives Act 1983. 

As our website is linked to the internet, there are inherent risks associated with the transmission of information via the website. Although we have implemented security measures, it isn’t possible to provide absolute guarantees as to the security of information you communicate and provide to us. Any personal or other information which you send to us is transmitted at your own risk.

If you have concerns in this regard, we have alternative methods of obtaining and providing information. For example, we may communicate with you by postal mail or telephone instead.

Accessing personal information and privacy complaints

Find out how you can access your personal information or make a complaint.

Accessing and correcting personal information

You’re entitled to request access to your own personal information, including for the purpose of correcting your personal information. However, we may refuse to give access if the provisions of the FOI Act or another legislation requires or permits us to do so.

Requests for access to your own personal information are free.

A request for your own personal information may be made to our Privacy and Information Access Team (PIAT) by emailing privacy@austrac.gov.au

We’ll respond to requests to access (and, where relevant, correct) your own personal information within 30 days of receiving the request. If we’re required or permitted to refuse access, we’ll give you a written notice setting out the:

• reasons for refusing access
• mechanisms available to you to make a complaint about the refusal.

Making a complaint

If you wish to make a complaint about how we’ve handled your personal information, please do so in writing.

Complaints can be emailed to us at privacy@austrac.gov.au

If we receive a complaint from you, we’ll acknowledge your complaint within 3 business days of receiving the complaint.  

We’ll consider your complaint and decide what action (if any) we need to take to resolve the complaint. This may include, for example:

• referring your complaint to our Privacy Officer for investigation about the staff member(s) whose actions you’re complaining about
• reviewing the security of our databases 
• other action as the case may require.

We’ll respond to your complaint within 30 days (or another timeframe agreed with you) of receiving your complaint. We’ll also explain the actions we have taken or propose to take to address the issues or concerns raised in your complaint. 

If you’re not satisfied with our response to your complaint, you may ask for a review by a senior executive. You may also lodge a complaint to the Office of the Australian Information Commissioner.