AML/CTF Tranche 2: What Your Firm Must Do
What changed on 1 July 2026
Australia extended its AML/CTF regime to "Tranche 2" businesses — roughly 90,000 firms that were previously outside AUSTRAC's scope. If you provide a designated service, you must enrol with AUSTRAC, maintain an AML/CTF program, conduct customer due diligence, and report suspicious matters. Australia had been one of the last OECD jurisdictions without "gatekeeper" coverage of lawyers, accountants, real estate agents and trust/company service providers — Tranche 2 closes that gap and puts Australian practice alongside the EU, UK and US regimes.
The practical shift: work you already do — handling client money, forming companies, settling property — now carries formal detection obligations. You are not being asked to police your clients; you are being asked to have a documented system that notices and reports when something is seriously wrong.
Who is captured — and what triggers it
Triggers: Handling client money, trust account transactions, conveyancing, drafting financial agreements.
Triggers: Providing trust account services, company formation, acting as a nominee director.
Triggers: Accepting deposits/rent for clients, facilitating property transactions.
Triggers: Handling client funds and property transfer services.
Triggers: Company formation, registered office services, nominee arrangements.
The trigger is the service you provide, not your job title. A lawyer who never handles client money and avoids the listed services may be out of scope, while a bookkeeper running client trust accounts is squarely in. Full list of designated services: AUSTRAC's professional designated services guidance.
Key dates
- 1 July 2026 — Tranche 2 reforms commence.
- 29 July 2026 — enrolment deadline for newly regulated legal practitioners (and equivalent entities).
- 30 September 2026 — transitional arrangements window for further Tranche 2 profession cohorts (lawyers, accountants, real estate agents); confirm your cohort's date on AUSTRAC's Tranche 2 timeline before relying on any grace period.
- 1 July 2029 — first possible extensions under AUSTRAC transitional rules for Tranche 2 entities.
Transitional relief is about how fast obligations phase in — not whether they apply. Treat every deadline as live for your firm unless AUSTRAC says otherwise in writing.
Your core obligations
- Enrol with AUSTRAC (free, mandatory).
- AML/CTF program — Part A (risk-based) and Part B (customer identification).
- Customer due diligence — identify and verify customers, beneficial owners; ongoing monitoring.
- Reporting — suspicious matter reports (SMRs) and international funds transfer instructions (ITRs).
- Record-keeping + training + independent review of your program.
Reporting timelines you must not miss
| Report | Deadline | Trigger |
|---|---|---|
| Suspicious matter report (SMR) | 24 hours | Suspicion of money laundering or terrorism financing |
| Suspicious matter report (SMR) | 3 business days | Other suspicions |
| ITR report | 10 business days | International funds transfer instruction received or sent |
Penalties: what non-compliance costs
AUSTRAC's post-2024 penalty regime makes non-compliance a board-level risk. For companies, civil penalties can reach the greater of $18.5 million, three times the benefit obtained from the contravention, or 10% of annual turnover for the period. Individuals face up to seven years imprisonment for criminal offences. Historical actions — CBA ($700m settlement), TABcorp, and the Star — all predate the harsher regime; AUSTRAC has since signalled it will litigate harder and faster.
The realistic exposure for a small Tranche 2 firm is not a nine-figure fine — it is remedial directions, enforceable undertakings, professional-body notification, and the time cost of an AUSTRAC engagement. Those alone typically exceed a decade of compliance spend. Use the cost calculator to see what compliance actually runs before deciding to defer.
What does it cost?
Government analysis estimated average ongoing costs of ~$23,250/year per business; firms with turnover under $200,000 face ~$4,040 upfront and ~$6,020/year. Your actual number depends on firm size and approach — a solo conveyancer running template-based DIY compliance sits near the bottom of the range; a 20-person law firm on a consultant-built program sits near the top.
Estimate your costs with the calculator →Frequently asked questions
What happens if I miss the AUSTRAC enrolment deadline?
Enrolment is free and mandatory. Operating an unenrolled reporting entity is a breach of the AML/CTF Act and exposes the firm to AUSTRAC remedial direction and civil penalties. If you missed the 29 July 2026 deadline, enrol immediately — self-identified late enrolment is treated far more favourably than AUSTRAC finding you first.
How quickly must I report a suspicious matter under Tranche 2?
A suspicious matter report (SMR) must be lodged with AUSTRAC within 24 hours of forming a suspicion relating to money laundering or terrorism financing, and within 3 business days for other suspicions. International funds transfer instructions (ITRs) are reported within 10 business days.
What are the penalties for non-compliance?
AUSTRAC can pursue civil penalties that, for companies, run up to the greater of $18.5 million, three times the benefit obtained, or 10% of annual turnover for the relevant period. Individuals face seven years imprisonment for criminal offences under the Act. In practice, AUSTRAC typically escalates through remedial directions and enforceable undertakings before litigation — but the post-2024 penalty regime is far harsher than the one that produced the TABcorp and CBA cases.
Are small firms exempt from Tranche 2?
No general exemption by size. Government impact analysis recognised micro firms (turnover under ~$200,000) face lower costs — roughly $4,040 upfront and $6,020 per year — but the obligations still apply. Some limited low-risk carve-outs and simplified program arrangements exist; check AUSTRAC's guidance for your designated services before assuming you qualify.
Can I use my existing client verification (100-point check) to satisfy KYC?
Partly. AML/CTF customer identification is risk-based rather than a strict 100-point regime, but existing identity documents can be reused. The gap most firms face is not the ID check itself — it is beneficial-owner identification, ongoing monitoring, and the documented risk assessment behind the program.