"Locked by policy" is a status you may see on ongoing monitoring in EngageAML. It means your firm's AUSTRAC compliance policy is set to require ongoing monitoring for this engagement's risk band, so EngageAML applies that setting automatically on this engagement. It reflects a default setting, and your Compliance Officer can review or adjust it at any time.
Where you'll see "Locked by policy"
"Locked by policy" appears on the Verification checks table in EngageAML. To find it:
Open an engagement and go to Step 6 (AML) — Verification checks.
In the Monitoring ($1.00 / year) column, the toggle is on and greyed out, so it cannot be clicked.
In the Status column, a blue Locked by policy badge appears.
You may see this for companies, individuals, trusts, and beneficial owners whenever their risk band requires ongoing monitoring and there is enough identity data to enrol them.
Why EngageAML locks monitoring on
EngageAML locks ongoing monitoring on for an engagement when your firm's AUSTRAC policy requires it for that engagement's risk band. The logic works like this:
Your firm has an AUSTRAC policy configured in EngageAML application settings.
Each risk band (Low, Medium, or High) has its own Ongoing monitoring required setting.
The engagement's group risk rating maps to one of these three bands.
If Ongoing monitoring required is switched on for that band, Step 6 forces monitoring on for the engagement and shows Locked by policy.
The default policy values are:
Engagement risk (approximate) | Policy band | Ongoing monitoring required (default) |
Simple | Low | Off — you can choose whether to enable monitoring |
Standard | Medium | On — locked |
Enhanced | High | On — locked |
Because of these defaults, a Standard engagement often shows locked monitoring even though nothing unusual has happened on that engagement — the default Medium band requires it.
How to adjust the policy setting
A ChangeGPS Administrator can review and adjust it at any time. To adjust it:
Open Application settings, then go to AUSTRAC policy.
Open the policy for the relevant risk band (Low, Medium, or High).
Find the Ongoing monitoring required checkbox.
Save the policy.
If Ongoing monitoring required is checked, Step 6 locks monitoring on for every engagement in that band. If it is unchecked, accountants can turn monitoring on or off on Step 6 for engagements in that band. Because the setting applies to every engagement in the band, it's a firm-wide compliance decision your Compliance Officer can revisit whenever your firm's risk approach changes, rather than something to change for a single client.
If your firm monitors AML outside ChangeGPS
EngageAML currently enforces monitoring in-product whenever the Ongoing monitoring required checkbox is on for a band, even if your firm also monitors clients through another system. There is not yet a separate option to mark monitoring as handled externally. Your options today are to leave monitoring on in EngageAML, or to have your Compliance Officer review whether Ongoing monitoring required should be switched off for that band, with appropriate compliance advice.
If the same person appears more than once with monitoring locked
If the same individual appears on more than one row of the Verification checks table with monitoring locked on both — for example, as a trust beneficial owner and again as a trustee company contact — this is a known separate issue related to duplicate monitoring targets, and is not related to "Locked by policy" itself. Contact our support team so this can be reviewed; a single person should only need one monitoring enrolment.
Charges for ongoing monitoring
When monitoring is on, including when it is locked by policy, enrolling a person or entity in ongoing monitoring typically costs $1.00 per year. For example, if three individuals on an engagement are enrolled in ongoing monitoring, that is $3.00 per year in total.