AML legislation is generally based on several key principles.

• businesses must know who their customers are. This is commonly referred to as customer due diligence or "Know Your Customer" (KYC)
• businesses should understand the risks associated with their customers, transactions and services
• records should be maintained to demonstrate compliance
• staff should be trained to recognise warning signs of criminal activity
• businesses should report suspicious activity where required.

The legislation is largely risk-based. This means businesses are expected to focus more attention on situations presenting higher risks and less on lower-risk circumstances. The 2026 amendments reinforce this principle by providing greater clarity regarding when enhanced scrutiny should be applied, particularly in relation to complex transaction structures, higher-risk jurisdictions and other circumstances presenting elevated money laundering risks.