In short
From 1 July 2026, law practices, conveyancers, real estate agencies and accounting firms providing designated services became reporting entities under the AML/CTF Act. Enrolment with AUSTRAC was due within 28 days of first providing a designated service — 29 July 2026 for most. Every caught business needs a written AML/CTF program, a documented risk assessment, a named compliance officer, customer due diligence before services are provided, and seven years of records. AUSTRAC began issuing notices in August 2026 to businesses that appear caught but have not enrolled.
What actually changed
For two decades AML/CTF obligations in Australia sat with banks, remitters and gambling operators. From 1 July 2026 they extend to a much wider group — the professions that handle property settlements, company structures and client money. If your practice provides what the Act calls a designated service, you are now a reporting entity with the same statutory obligations as a bank, scaled to your size.
This is not a code of conduct or a professional standard. It is Commonwealth law administered by AUSTRAC, with civil penalties attached. It sits alongside your existing trust account and professional obligations rather than replacing any of them.
Who is caught
- Law practices providing conveyancing, company or trust formation, management of client money or property, and acting on sales of business or real estate
- Conveyancers performing the same services
- Real estate agencies acting for a buyer, seller, lessor or lessee in a property transaction
- Accountants and trust and company service providers assisting with company formation, trustee or director arrangements, or management of client assets
- Dealers in precious metals and stones above the relevant thresholds
The five things you need in place
- Enrolment with AUSTRAC through AUSTRAC Online, and details kept current — changes must be notified within 14 days.
- A money laundering, terrorism financing and proliferation financing risk assessment covering your client base, your services and your delivery channels.
- A written AML/CTF program with policies, procedures and controls proportionate to the size and complexity of your business. A downloaded template that has not been tailored will not satisfy AUSTRAC.
- An appointed AML/CTF compliance officer, with senior management approving the program and the governing body overseeing it. In a small practice one person can hold these roles.
- Customer due diligence before a designated service is provided, ongoing monitoring afterwards, and enhanced measures where risk is higher.
Key dates and timeframes
| Obligation | Timeframe |
|---|---|
| Obligations commenced | 1 July 2026 |
| Enrolment with AUSTRAC | Within 28 days of first providing a designated service — 29 July 2026 for most |
| Notify AUSTRAC of changed enrolment details | Within 14 days |
| Suspicious matter report — terrorism financing | Within 24 hours of forming the suspicion |
| Suspicious matter report — all other matters | Within 3 business days |
| Threshold transaction report — cash of A$10,000 or more | Within 10 business days |
| Program review | At least every 3 years |
| Record retention | 7 years |
If you have not enrolled yet
You are not alone, and it is not a reason to keep your head down. AUSTRAC began issuing notices in August 2026 to businesses that appear to be providing designated services without having enrolled. A business that enrols late of its own accord is in a materially better position than one that waits to be contacted.
The practical order is: work out whether you provide a designated service, enrol if you do, then build the program. Enrolment is the quick part. The risk assessment and program are the work, and they are what an AUSTRAC reviewer will actually read.
How this overlaps with your trust account obligations
For law practices and agencies there is useful overlap. The client identification you already perform, the trust records you already keep and the reconciliations you already produce are evidence you can point to. But they are not a substitute. Trust account rules ask whether money was handled correctly; AML/CTF asks whether you knew who your client really was and whether the transaction made sense. Different questions, different records.
If we audit your trust account, we are not your AML/CTF adviser — those are separate engagements and independence rules keep them that way. But a well-run trust account and a well-run AML/CTF program tend to be found in the same practices, for the same reasons.
Where to get the detail
- AUSTRAC — AML/CTF reform and new industries
The regulator's own guidance. Start here — it is the authoritative source and it is free.
- AUSTRAC Online — enrolment
Where enrolment is actually lodged.
- CompliDesk — Tranche 2 guide
An Australian compliance platform built for Tranche 2 entities. Their guide sets out the obligations in practical terms, and the platform handles risk assessments, customer due diligence and record keeping in one place.
This article is general information about a new and complex regime, not advice on your circumstances. Whether you are caught, and what your program needs to contain, depends on the services you actually provide. Confirm your position before you rely on anything here.
About the author
Owen Houston CA is the principal of Houston & Co, an ASIC Registered Company Auditor since 1990 and an ASIC Approved SMSF Auditor. This article is general information, not advice for your circumstances — confirm your position before you rely on it.