Tranche 2 AML/CTF obligations have commenced: what affected businesses need to do now
Australia’s expanded anti-money laundering and counter-terrorism financing regime is now in force.
From 1 July 2026, thousands of real estate businesses, lawyers, conveyancers, accountants, trust and company service providers, and certain dealers in precious metals and stones became subject to AML/CTF obligations for the first time.
For affected businesses, this is no longer a future readiness exercise.
The immediate question is: Can your business demonstrate that it understands its money laundering and terrorism financing risks and has working controls in place to manage them?
AUSTRAC has stated that newly regulated businesses should already have an AML/CTF program, an appointed compliance officer, staff training and the capability to identify and report suspicious matters. Businesses providing newly regulated designated services must also apply to enrol with AUSTRAC by 29 July 2026.
Having a policy document saved on a shared drive will not, by itself, make a business compliant.
Compliance must be built into the way customers are accepted, transactions are assessed, staff escalate concerns and records are maintained.
First, determine whether your activities are regulated
The AML/CTF regime is based on the services a business provides, not simply its profession or industry classification.
A business becomes a reporting entity when it provides a regulated designated service with the required connection to Australia.
This means two businesses operating in the same profession may have different obligations depending on the work they perform.
The newly regulated sectors include:
real estate professionals involved in brokering or directly selling certain real estate
lawyers, conveyancers, accountants and other professional advisers providing specified transactional services
trust and company service providers
dealers accepting physical currency or virtual assets for qualifying transactions involving precious metals, stones or related products
businesses providing certain newly regulated virtual asset services.
Businesses should document which services are:
clearly regulated
clearly outside the regime
dependent on the circumstances of the matter
subject to internal escalation before work commences.
This service-scoping exercise is one of the most important steps in implementation. Without it, staff may conduct unnecessary checks on unregulated work while failing to apply controls to activities that are actually captured.
Where AUSTRAC guidance does not clearly address a particular business model, the business should form a reasonable position, document how it reached that position and retain any supporting professional advice.
Enrol with AUSTRAC
Businesses providing newly regulated designated services must apply to enrol through AUSTRAC Online by 29 July 2026.
For most Tranche 2 businesses, enrolment is the relevant requirement. Separate registration generally applies only to certain higher-risk services, including remittance and regulated virtual asset services.
The enrolment process requires information about:
the business and its ownership
the services it provides
its structure and operating locations
relevant individuals associated with the application
beneficial ownership and control.
Businesses should not wait until the final days before the deadline. Information about ownership structures, related entities or service categories may take time to confirm.
Failing to enrol does not remove the underlying obligations. AUSTRAC has indicated that non-enrolment is an area in which it may take early enforcement action.
Appoint an AML/CTF compliance officer
Every reporting entity must appoint an AML/CTF compliance officer with sufficient authority, knowledge and access to the business.
The officer is responsible for overseeing the operation of the AML/CTF program, escalating compliance issues and helping ensure that the business meets its regulatory obligations.
For a small business, the compliance officer may be an owner, director or senior practitioner. One person may perform several governance roles where this is appropriate for the size and complexity of the organisation.
Larger businesses will generally need clearer separation between:
governing body oversight
senior management accountability
day-to-day compliance management
operational execution by customer-facing staff.
Newly regulated businesses must notify AUSTRAC of their compliance officer by the later of 29 July 2026 or 14 days after enrolment.
The appointment should not be treated as a title-only exercise. The compliance officer must have sufficient time, information, resources and support to perform the role effectively.
Complete an ML/TF risk assessment
The foundation of the AML/CTF program is the business’s money laundering, terrorism financing and proliferation financing risk assessment.
The assessment should consider the risks arising from:
the designated services the business provides
its customer types
customer ownership and control structures
the countries and jurisdictions involved
how services are delivered
the payment methods accepted
the size, complexity and purpose of transactions
the use of agents, introducers or third-party providers.
A generic risk assessment copied from another organisation is unlikely to reflect the business’s actual exposure.
For example, a suburban real estate agency primarily handling local residential sales may face a different risk profile from a developer selling high-value property to overseas-controlled companies.
Similarly, a small accounting practice assisting local businesses with tax returns will have a different exposure from a firm establishing companies, managing client funds or restructuring trusts.
The assessment must drive the controls adopted by the business. Higher-risk activities should result in stronger verification, approval, monitoring and escalation measures.
Develop and approve an AML/CTF program
An AML/CTF program explains how the business identifies, assesses, manages and mitigates its financial crime risks.
At a minimum, the program should address:
governance and accountability
customer identification and verification
beneficial ownership
customer risk assessment
enhanced customer due diligence
ongoing customer monitoring
suspicious matter reporting
threshold transaction reporting, where applicable
personnel due diligence
staff training
recordkeeping and privacy
outsourcing and third-party providers
program review and independent evaluation.
The program should be tailored to the nature, size and complexity of the business.
A small business may operate controlled manual processes using checklists, secure records and clearly documented approvals. A larger organisation may require integrated onboarding systems, automated screening, case management and formal compliance reporting.
The important issue is not whether the process is manual or automated.
It is whether the process is understood, followed, evidenced and capable of identifying higher-risk activity.
Introduce customer due diligence before providing regulated services
Customer due diligence is broader than checking a driver licence.
Before providing a designated service, the business will generally need to:
identify the customer
verify the customer’s identity
identify and verify relevant beneficial owners
establish whether another person is acting on the customer’s behalf
understand the nature and purpose of the relationship
assess the customer’s ML/TF risk.
The information required will depend on whether the customer is:
an individual
a company
a partnership
an association
a trust
another legal arrangement.
Company and trust customers often require additional work because the business must understand who ultimately owns or controls the entity.
The onboarding process should also include relevant checks for:
politically exposed persons
sanctions exposure
high-risk jurisdictions
unusual or unnecessarily complex ownership structures
inconsistencies between the customer’s explanation and available information.
AUSTRAC states that customer due diligence applies throughout the business relationship, not only at the point of onboarding.
Establish enhanced due diligence procedures
Higher-risk customers and transactions require stronger controls.
Enhanced customer due diligence may be necessary where:
a customer or beneficial owner is a foreign politically exposed person
the matter involves a high-risk jurisdiction
the transaction is unusually large or complex
the structure has no clear commercial or legal purpose
the source of funds is unclear
the source of wealth is inconsistent with the transaction
the customer is reluctant to provide information
the business intends to continue dealing with a customer after forming a suspicion.
Enhanced measures may include:
obtaining additional identification information
independently verifying ownership and control
establishing the source of funds
establishing the source of wealth
obtaining further information about the transaction’s purpose
requiring senior management approval
applying more frequent monitoring
declining or restricting the service.
The business should clearly define who can approve a higher-risk customer and what evidence must support that decision.
Train staff to recognise and escalate suspicious activity
Staff training must be relevant to the work employees actually perform.
A generic annual presentation is not enough where customer-facing staff are expected to identify suspicious behaviour, conduct due diligence or escalate unusual transactions.
Training should help employees understand:
which services are regulated
when customer checks must be completed
what information must be collected
how to identify beneficial owners
common warning signs for their sector
when enhanced due diligence is required
how to escalate a concern internally
why they must not disclose that an SMR is being considered or submitted
how compliance records must be stored.
AUSTRAC expects training to be provided when personnel commence relevant AML/CTF duties and on an ongoing, risk-based basis.
Businesses should retain records showing who completed the training, when it occurred, what it covered and whether the person demonstrated an adequate understanding.
Be ready to submit regulatory reports
Businesses must have an internal process for identifying, escalating, assessing and reporting suspicious matters.
A suspicious matter report may be required where the business forms reasonable grounds to suspect that a customer, transaction or service is connected with criminal activity, money laundering, terrorism financing, tax evasion or another relevant offence.
The general reporting timeframes are:
24 hours for suspicions relating to terrorism financing
three business days for most other suspicious matters.
The business should also have strong controls preventing staff from “tipping off” a customer that a report has been, or may be, submitted.
Threshold transaction reports may also be required when the business is involved in a transaction of $10,000 or more in physical currency. These reports must generally be submitted within 10 business days.
New SMR and TTR forms became available through AUSTRAC Online on 1 July 2026.
A reporting procedure should identify:
who receives internal escalations
who decides whether a report is required
who prepares and submits the report
how deadlines are monitored
how supporting information is retained
who can access sensitive reporting records.
Protect customer information and retain evidence
AML/CTF compliance requires businesses to collect sensitive personal, ownership and financial information.
That information must be stored securely and made available only to authorised personnel.
The business should establish rules covering:
where identity documents are stored
who can access customer due diligence records
how screening results are retained
how suspicious matter information is protected
how records are transferred to service providers
how long records must be retained
how information is securely destroyed when retention periods expire.
Reporting entities have privacy obligations even where they may previously have qualified for a small-business exemption under the Privacy Act.
AML/CTF compliance should therefore not be implemented through uncontrolled email inboxes, personal devices or unsecured shared folders.
Monitor customers after onboarding
Completing customer checks at the beginning of a matter does not end the business’s obligations.
Reporting entities must monitor customers for unusual transactions, behavioural changes and new information that may affect the customer’s risk rating or trigger a reporting obligation.
Events that may require a review include:
a change in ownership or control
the introduction of an unexpected third party
a change in the source of funds
unusual payment arrangements
unexplained urgency or complexity
activity inconsistent with the original purpose of the relationship
new sanctions, PEP or adverse information
reluctance to provide updated information.
The business should document when customer information must be refreshed and when the compliance officer must be consulted.
Review whether outsourced providers are suitable
Businesses may use external providers for identity verification, sanctions screening, training, policy support or transaction monitoring.
However, outsourcing an activity does not outsource regulatory accountability. Before appointing a provider, the business should assess:
what information the provider collects
where customer information is stored
whether information is processed offshore
the reliability of the provider’s data sources
how failed or uncertain results are handled
whether evidence can be retrieved for AUSTRAC
the provider’s security and privacy controls
incident notification requirements
audit and termination rights.
The AML/CTF program should explain how third-party services are selected, monitored and reviewed.
What affected businesses should prioritise now
Businesses that are not yet compliant should prioritise the following actions:
Confirm which services are regulated.
Apply to enrol with AUSTRAC before 29 July 2026.
Appoint and notify an AML/CTF compliance officer.
Complete a business-specific ML/TF risk assessment.
Approve an operational AML/CTF program.
Implement customer due diligence and beneficial ownership processes.
Introduce enhanced due diligence and escalation procedures.
Train all relevant staff.
Establish suspicious matter and threshold transaction reporting processes.
Securely retain the evidence required to demonstrate compliance.
AUSTRAC has acknowledged that implementation will continue to mature during the 2026–27 financial year. Its position has been described as expecting genuine effort rather than immediate perfection.
That should not be interpreted as permission to delay.
The difference between an organisation that is still improving and one that is failing to comply will often be the evidence of action: documented decisions, approved controls, trained staff, completed customer checks and a clear remediation plan.
Compliance must operate in the business, not only in the policy
Tranche 2 compliance is not achieved when a policy is written.
It is achieved when:
staff know when a service is regulated
customers are checked before work proceeds
beneficial ownership is understood
higher-risk matters receive additional scrutiny
suspicious activity is escalated
reports are submitted on time
sensitive information is protected
management can demonstrate that the controls are working.
For newly regulated businesses, the immediate priority should be to establish a defensible and operational compliance framework.
The strongest evidence of compliance is not the size of the AML/CTF manual. It is the quality of the decisions the business can demonstrate.
Branova assists newly regulated businesses to understand their obligations, assess their exposure and implement practical AML/CTF controls appropriate to their operations.
This article provides general information and should not be relied upon as legal advice. The application of the AML/CTF regime depends on the services provided and the circumstances of each business.
Comments