I think it will depend on how much NAB have improved their...

I think it will depend on how much NAB have improved their systems since previously self reporting.
This action is not surprising although why it has taken this long is.
It is, however, hard to know what will happen until the actual issues are identified. Anything that has not been corrected since self reporting could be a concern and bring penalties.  
Ross McEwans own words suggest not all has been fixed:-
"...We have been working to improve and clearly have more to do,” Mr McEwan said.
Doubt very much it will involve concerns in general retail and/or small business protocols.
Much more likely to be poor systems which allow loopholes on a much larger scale such as we saw with WBC and CBA.
A couple of Casinos also ann'd investigations and hopefully they are not linked.
I would hope NAB would have (by now) closed any potential loopholes linked with such obvious AML hot spots.........................