AUSTRAC Investigates Western Union: What It Means for You

The short answer: On 1 September 2026 AUSTRAC opened an enforcement investigation into Western Union Financial Services Australia and its US parent over how it manages the risk of criminals moving money. Whatever the outcome, a payment provider’s controls protect the provider. They are not a check on whether the account your business pays belongs to your supplier.

Key takeaways

• The investigation covers Western Union’s Australian arm and The Western Union Company, not its affiliates.
• AUSTRAC describes payment service providers as high-risk for criminal exploitation.
• Regulated does not mean verified: the payer still owns the check on who it pays.
• For the fundamentals, see our guide to AUSTRAC compliance for payments.

On 1 September 2026, AUSTRAC opened an enforcement investigation into Western Union’s Australian arm and its US parent. It is the kind of announcement that gets filed under “someone else’s problem” by most finance teams. It shouldn’t be.

AUSTRAC is looking at how a major payment service provider manages the risk of criminals using it to move money. Whatever the outcome, those are the provider’s controls. They are not a check on who you are paying.

What did AUSTRAC announce?

The investigation covers Western Union Financial Services Australia and The Western Union Company. Its affiliates are not part of it. AUSTRAC said it drew on its own data and intelligence, Western Union’s earlier engagement with the regulator, and an external audit AUSTRAC ordered in 2025. (Electronic Payments International)

AUSTRAC will examine three areas.

• Whether Western Union’s AML/CTF program lets it identify, assess and mitigate money laundering and terrorism financing risks.
• Whether its transaction monitoring can detect known money laundering typologies, including those linked to child sexual exploitation and terrorism financing.
• The role of the global head office in decisions that affect the Australian entity’s compliance.

AUSTRAC CEO Brendan Thomas said “payment service providers are internationally recognised as high-risk for criminal exploitation” and that “we have serious concerns that Western Union has failed to adequately manage those risks.”

It is worth being clear about what this is and is not. It is an investigation, not a finding. AUSTRAC has not decided on any action, and has not set a timeline. According to AUSTRAC, Western Union has committed to addressing the issues identified in the 2025 audit.

Why does it matter to a business that pays suppliers?

Most Australian businesses do not send money through Western Union to pay suppliers. The lesson is wider than one company.

Payment providers, banks and networks each run controls on their own side of the transaction. They check their customers. They monitor patterns. They report suspicious matters. What they cannot do is tell you whether the account you are about to pay really belongs to the supplier you think you are paying.

That gap sits with the sender. It is where payment redirection fraud lives. A criminal does not need to defeat a bank’s anti-money laundering program. They only need you to type their account number into a payment you were going to make anyway.

Confirmation of Payee helps, because it checks that the name you enter matches the account holder’s name at the receiving bank. It still depends on the name you were given being the right one. If a supplier’s email has been compromised, the criminal can supply a name that matches the account perfectly.

Before your next payment run, try our free payment process audit. It takes a few minutes and shows where your process is exposed.

Related reading: HSBC’s $35M Scam Penalty: What It Means for Business, AUSTRAC Tranche 2: Verify the Client and the Bank Account.

Does regulated mean verified?

AUSTRAC’s own framing is useful here. It describes payment service providers as high-risk for criminal exploitation, and it has opened an investigation into how one of them manages that risk. As Tranche 2 pulls lawyers, accountants and real estate agents into the same regime, more businesses are now on the other side of those obligations. We covered what that means in our post on the Tranche 2 payment verification gap.

The practical response for a finance team does not depend on how the investigation ends.

• Verify the person or business you are paying, using their ABN and registered details.
• Verify that the BSB and account number belong to that business, not only that a name looks right.
• Re-verify when bank details change, because that is the moment a criminal steps in.
• Keep a record of what you checked and when, so you can show your process if something goes wrong.

Verifying a supplier’s bank account before the first payment, and again after any change, puts a check in the one place your provider cannot reach. That check is yours to run.

Frequently Asked Questions

Why is AUSTRAC investigating Western Union?

AUSTRAC is examining how Western Union manages the risk of criminals using its services to move money, drawing on its own data and intelligence.

Which Western Union entities are covered?

Western Union Financial Services Australia and The Western Union Company. Its affiliates are not part of the investigation.

Does a regulated payment provider verify who I am paying?

No. Providers run controls on their own side of the payment. Confirming that an account belongs to your supplier is still your check.