Australian payment firms' compliance teams can use AI agents to check that every reportable transfer reached the AML regulator, review scam and mistaken payment complaints, draft AML alert summaries and gather CPS 230 evidence. The agent never moves, holds or returns money. Reporting decisions, scam outcomes and anything said to ASIC, APRA or the OAIC stay with people.
What do payments compliance teams in Australia spend their time on?
Australian payment businesses range from remittance providers and card issuers to merchant acquirers and wallet providers. Most hold an Australian financial services licence supervised by ASIC; some are also supervised by APRA. All carry AML and counter-terrorism financing obligations to the national AML regulator.
AML reporting. Payment firms must report suspicious matters, cash transactions above a threshold and international funds transfer instructions. Missing reports are a serious failing, and reconciling every qualifying transfer to a submitted report is constant work.
Scams. Authorised push payment scams cause large losses, and firms are under pressure to detect, intervene and treat victims fairly. Scam complaints are complex: the customer authorised the payment, but may have been deceived.
Mistaken and unauthorised payments. A voluntary industry code sets processes for unauthorised transactions and for recovering payments sent to the wrong account. Firms that subscribe must follow its steps and timeframes.
Operational risk. APRA-regulated firms must meet CPS 230 for critical operations and material service providers. Others face ASIC's expectations on resources and risk management.
Personal data. Payer and payee data falls under the Privacy Act 1988.
Where can AI agents help?
Depth caps what an agent may do: 1 reads, 2 drafts for a person, 3 executes routine work within bounds. A compliance agent in payments should never hold depth 4, the level for moving money or taking hard-to-undo actions.
Report completeness reconciliation (depth 1). The agent compares every international transfer and qualifying cash transaction with the reports submitted, and lists any without a matching report. This is the most Australia-specific use, because the range of mandatory reports goes beyond suspicious matters alone.
Scam complaint review (depth 2). The agent reads the complaint, the payment history, warnings shown to the customer and any intervention by staff, and drafts a chronology and an assessment against the firm's scam policy. A person decides the outcome.
Mistaken payment tracking (depth 3). The agent tracks each mistaken payment request against the code's timeframes and sends internal reminders to owners. It does not contact the receiving institution or return funds.
AML alert summaries (depth 2). For each transaction monitoring alert, the agent drafts a summary of the customer, counterparties and pattern, for an analyst to decide.
CPS 230 evidence (depth 2). The agent maps controls, incidents and service provider reports to each critical operation and drafts the evidence summary.
What stays with people?
Moving or returning money. Real-time payments settle in seconds and are hard to reverse. Returning funds, freezing an account or blocking a payment is a decision with direct financial effect on someone. The article on irreversibility in payments explains why these points are held for people. Whether any agent should move money for a customer is covered in can an AI agent make payments on behalf of a customer.
Suspicious matter reports. Whether to report, and what to say, is decided by the AML compliance officer. Tipping off the customer must be avoided.
Scam reimbursement. Whether to refund a scam victim, in full or part, is a judgement about fairness and the firm's conduct.
Breach reports to ASIC and notifications to the OAIC. Both are decisions for responsible officers.
Which Australian rules apply?
Australia has no AI-specific law in force. The government has published a voluntary AI safety standard. Binding rules come from financial services, AML and privacy law. The broader view is in how AI agents are regulated in Australia.
ASIC supervises conduct for licensed payment providers, including disclosure, complaint handling and breach reporting. Communications an agent drafts are held to the same standard as any other.
APRA and CPS 230. Where a payment firm is APRA-regulated, CPS 230 requires operational risk management, continuity of critical operations and oversight of material service providers, which can include the provider of an agent.
Privacy Act 1988 and the OAIC. Transaction data, identity documents and scam reports are personal information. Use must fit the purpose of collection, and the firm must protect it. See Australia's Privacy Act and AI agents.
AML and counter-terrorism financing law, enforced by the national AML regulator, sets customer due diligence, monitoring and reporting duties consistent with FATF standards.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day starting plan
Month one. Begin with report completeness reconciliation. The agent needs read access to transfer records and the report submission log, and its output is a list for review rather than an action. Record the use under your privacy and CPS 230 frameworks.
Month two. Replay the agent against the past two quarters. Every gap your team already found should appear, and any new gap needs investigating, because it may be a real missed report.
Month three. Add scam complaint review, with every chronology checked by the complaint handler. Australian insurers face the same regulators with different risks; see compliance agents in Australian insurance.
Where Pryme fits
In Pryme, returning or reversing a payment is outside any compliance agent's role scope, so the request is refused, and reversing a settled payment on Pryme's own rail is withheld at the platform floor for every agent at every depth. Attest certifies the reconciliation and complaint capabilities on your own records. Every verdict is filed. The guide to AI compliance agents explains the wider model.
Questions people ask
Can an AI agent submit AML reports for a payment firm?
It should not submit them. It can find gaps and draft content. Submission is a regulatory act that the AML compliance officer owns.
Should a compliance agent contact scam victims?
No. Contact with a scam victim is sensitive, and what is said can affect the complaint outcome. The agent drafts; a trained person speaks to the customer.
Does CPS 230 apply to every payment firm?
CPS 230 applies to APRA-regulated entities. Payment firms outside APRA's remit still face ASIC's expectations on risk management and resources.