KYC for Accountants Under Tranche 2: A Step-by-Step Guide

Why accounting firms need a service-by-service view

Tranche 2 extends Australia's AML/CTF regime to professions outside banking and finance, including accountants. We keep the background short here: the full explanation of what changed and when is in AUSTRAC Tranche 2 Explained.

What matters for an accounting practice is that the obligations attach to services, not to the title on the door. A firm that only prepares tax returns, runs audits and does bookkeeping may have little or no designated activity. A firm that also incorporates companies, acts as trustee, holds client funds or helps clients buy a business may have a lot. Most mid-sized practices sit in between, with some service lines in scope and others out. That makes the first compliance job a scoping exercise, and it shapes everything after it: your risk assessment, who you verify, and when.

This guide follows the order a practice would work in. Treat it as operational information, not legal advice. The AML/CTF Act, the AML/CTF Rules and AUSTRAC guidance are the authority, and they change, so check the current position on the AUSTRAC website or with legal counsel.

Which accounting services are likely to be designated

The list below is a working summary of the kinds of activity Tranche 2 targets for accountants. The exact wording of each designated service is set out in the legislation. Confirm every line against AUSTRAC's published list before you finalise your scope.

Services that are generally not the target include compliance-only work such as tax returns, BAS, statutory accounts and audit, where you are not also doing one of the activities above. Still, record the reasoning. A short scoping memo that says "we assessed X and concluded it is not designated because Y" is useful evidence if AUSTRAC asks. The Tranche 2 scope check can help you start that exercise.

Step 1: Map your service lines and client base

Build a simple matrix with service lines down the side and client types across the top: individuals, sole traders, partnerships, private companies, discretionary and unit trusts, SMSFs, not-for-profits and foreign-owned entities. Mark each cell as designated, not designated or unsure. Resolve the unsure cells with AUSTRAC guidance or counsel.

Two points that tend to surprise practices:

• Scope creep through engagement letters. A long-standing tax client can become a designated-services client the day you agree to set up a trust or hold funds for them. Your onboarding trigger should be the new service, not just a new client file.
• Partners and teams who sell different things. A business advisory team may be doing designated work that the compliance team never sees. Ask each team, in writing, what they actually do.

Step 2: Enrol with AUSTRAC and set up governance

Practices providing designated services need to enrol with AUSTRAC as reporting entities. Check AUSTRAC for current enrolment dates and process, as they are published there and may be updated. Enrolment is a firm-level step, so decide early who completes it and which legal entity or entities in your group are providing designated services.

Governance matters as much as paperwork. Expect to appoint an AML/CTF compliance officer and to have senior management or the governing body take responsibility for the program. In a partnership, decide whether that sits with a managing partner, a risk partner or a head of operations. Make sure that person has enough authority and time to do the job.

Step 3: Write the risk assessment and AML/CTF program

The program rests on a documented money laundering and terrorism financing risk assessment. For an accounting practice, the risk factors worth assessing include:

• Service risk: structure creation and client-money handling generally carry more risk than compliance work, because they can help someone move or hide value.
• Client risk: complex ownership, trusts with unclear purposes, politically exposed persons, cash-intensive businesses.
• Channel risk: clients you never meet, introduced by third parties, or onboarded entirely online.
• Geographic risk: foreign beneficial owners, overseas funding sources, and links to higher-risk jurisdictions.

The program then sets out how you will act on those risks: onboarding rules, escalation, monitoring, reporting, training, record keeping and independent review. Write it around the way your firm really works. A generic template that references systems you do not have will not stand up well when tested.

Step 4: Onboard clients by entity type

Customer due diligence (CDD) means identifying the customer, verifying that identity from reliable and independent sources, understanding the purpose of the relationship, and establishing who ultimately owns or controls the customer. The workflow differs by client type.

Individuals and sole traders

Collect name, date of birth and address, then verify against an identity document and, where appropriate, electronic data sources. Remote clients are common in accounting, so a method that combines document authentication with a biometric match to the document photo is useful for people you never meet. See how identity verification and electronic ID verification work in practice, and our overview of eKYC.

Companies

Confirm the entity exists and is in good standing using official registry data. Record the directors, shareholders and officeholders. Then verify the person instructing you and establish who the individuals behind the company are. Ask for the constitution or share register where ownership is not obvious from registry extracts.

Trusts

Obtain the trust deed and any variations. Identify the trustee, and, depending on the trust type, the settlor, appointor or protector and the beneficiaries or classes of beneficiaries. A corporate trustee adds a second layer: you then need the company's directors and owners too. Trusts are where accounting practices often need more evidence than the document pack first suggests, so allow time for it in your engagement process.

Partnerships, SMSFs and not-for-profits

Partnerships need the partners identified. SMSFs involve trustees, who may be individuals or a corporate trustee, and members. Not-for-profits need the governing body and the people who control the organisation. Define in your program what evidence you accept for each.

Step 5: Identify and verify beneficial owners

The beneficial owner is the individual who ultimately owns or controls the customer, not the nominee or the holding company in the middle. Ownership percentages are only part of the picture: control through voting rights, appointment powers or informal arrangements counts too. The AML/CTF Rules set the detail, including thresholds, so work from the current text.

A practical routine for layered structures:

1. Draw the ownership chart from the client's own documents and registry data.
2. Follow each corporate or trust holder upward until you reach natural persons.
3. Identify any individual with significant ownership or control, and, if there is none, apply the fallback your program sets, for example identifying senior managing officials.
4. Verify the identity of those individuals to the standard your program requires.
5. Keep the chart, the sources and the date, and note anything you could not resolve.

If a client cannot or will not explain who owns a structure, treat that as a risk signal in its own right, not an administrative delay.

Step 6: Screen for sanctions and PEP exposure

Run the customer and the beneficial owners through sanctions and PEP screening at onboarding, and again when something changes. Screening only the client entity and skipping the individuals behind it is a common gap. Screening results need a documented decision: who reviewed the match, what they concluded and why. AML screening via API lets you run the same checks on every party in the ownership chart without extra manual work.

Step 7: Monitor, escalate and report

Ongoing due diligence means keeping client information current and watching for activity that does not fit what you know. For accountants this is less about transaction streams and more about changes in behaviour: a sudden request to route funds through your account with no clear commercial reason, instructions to change a structure after a regulator query, or a business sale at a price that makes no sense.

If you form a suspicion, you will need to submit a suspicious matter report to AUSTRAC within the deadlines set out in the Act. Those deadlines are short, and shorter again where terrorism financing is suspected, so confirm the current timeframes and the reporting process in AUSTRAC's guidance. Also take care not to tip off the client. Train fee earners to escalate to the compliance officer rather than question the client themselves. Reporting obligations also include threshold transaction reports for large physical currency transactions; check the current threshold with AUSTRAC.

Keep records of identification, verification, risk assessments, program documents and reports for the periods the Act requires. Check the retention period in the current legislation rather than relying on a memo from the transition period.

Practice software and workflow integration

Most accountants already have a practice management system, a client portal and an e-signature tool. The aim is to add KYC without creating a second, disconnected process. A reasonable design looks like this:

• Trigger: a designated service is added to an engagement, which creates a KYC task on the client record.
• Collection: the client receives a secure link to submit identity documents and a selfie or liveness check, or to supply entity details.
• Verification: documents and electronic data sources are checked, and screening runs on every identified party.
• Decision: low-risk results are recorded automatically, and exceptions go to a named reviewer.
• Record: the outcome, evidence and timestamp are stored against the client file, so you can produce them on request.
• Gate: work on the designated service does not start until the status is cleared.

ScreenlyyID provides remote identity verification, AML/sanctions/PEP screening, and address, email and phone validation through an API with self-serve sign-up, so a practice or its software provider can build this flow. Whether it connects directly to your practice system depends on what that system supports, so confirm the integration route before you commit to a design. If you are weighing tools, a separate comparison of tools for Tranche 2 sectors is planned; this page deliberately covers the obligations rather than vendor choice.

Professional body guidance

CPA Australia and Chartered Accountants Australia and New Zealand (CA ANZ) are the professional bodies most accountants will turn to for sector guidance, templates and training. Look at the AML/CTF resources on CPA Australia and CA ANZ for member material, and treat that material as a complement to AUSTRAC's guidance, not a replacement. Where professional body material and AUSTRAC guidance differ, AUSTRAC and the legislation prevail.

Where practices get caught out

• Treating enrolment as the finish line. The program, training and evidence trail are what AUSTRAC will examine.
• Verifying the signatory but not the owner. The person who emails you the documents is often an adviser or bookkeeper, not the beneficial owner.
• Relying on a trust deed alone. Deeds can be out of date, and variations may not be in the pack.
• No exceptions process. If the only options are "pass" or "refuse", staff will find workarounds. Define what happens when verification fails and who can approve a documented alternative.
• Informal client-money handling. If your firm quietly pays bills on a client's behalf, check whether that is a designated service.

If you work with property transactions, the client and workflow questions differ from those for accountants. We cover those in AML for real estate agents. For a quick action list, use the Tranche 2 compliance checklist. More background is available in our blog hub and on the Tranche 2 solution for accountants.

A sensible timeline to work from

With obligations starting on 1 July 2026, work backwards. Scope service lines first, then assign ownership, then draft the risk assessment and program, then choose and test your verification process on real client scenarios, then train staff. Run a few live trust and company onboardings through the process before the start date. They will expose the gaps that a policy document will not.

Last checked: 3 Nov 2026