AUSTRAC Tranche 2 Explained: Who's Covered, Key Dates and Obligations

What changed, and why Australia moved

Australia's Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (the AML/CTF Act) has long applied to banks, remitters, casinos, bookmakers and similar businesses. It did not apply to the professionals who sit at key points in property and company transactions: agents, lawyers, conveyancers and accountants. International standards set by the Financial Action Task Force (FATF) expect those "gatekeepers" to carry AML/CTF obligations, and for years Australia was an outlier. "Tranche 2" is the name given to the second stage of reform that closes that gap.

The changes come from the AML/CTF Amendment Act 2024, which did two things at once. It extended the regime to the new sectors, and it rewrote the framework for everyone: the program, customer due diligence and governance rules were restructured around a risk-based model. AUSTRAC, the regulator, has described the reforms as the most significant overhaul of Australia's AML/CTF framework in more than 20 years, and says the number of businesses it regulates will grow from around 19,000 to close to 100,000 (AUSTRAC, 31 March 2026).

This page is general information drawn from AUSTRAC's published guidance. Requirements and guidance change, so confirm each point on austrac.gov.au or with legal counsel. It is not legal advice.

Key dates

The 1 July 2026 date has passed, so the practical question for any covered business is no longer "when" but "are we compliant today". A business that has been providing a designated service since commencement should already be enrolled and operating under a program.

Who is covered, sector by sector

The Act regulates designated services, not professions. A firm becomes a reporting entity only if it provides at least one designated service with a geographical link to Australia. The table gives the headline service for each sector; the exact wording is in the Act and in AUSTRAC's guidance on designated services for newly regulated entities, so check it before relying on an exclusion.

The most common scoping error is treating the reform as "all accountants" or "all lawyers". Routine work such as tax returns, general legal advice or audit may fall outside the regime, while a conveyancing matter or a company set-up in the same firm falls inside it. Map each service line to the Act's definitions, record the result, and build your program around the services you actually provide. AUSTRAC's check if you may be regulated tool is the starting point.

The core obligations, explained once

These apply to every covered sector. AUSTRAC's summary of obligations is the primary reference; the points below follow it.

Enrol with AUSTRAC

Any business providing a designated service with a geographical link to Australia must enrol. Most businesses only need to enrol. Registration is a separate, additional step that applies mainly to remittance and virtual asset providers.

Governance and a compliance officer

Your governance structure must clearly identify three roles: a governing body with primary responsibility, one or more senior managers who approve the program and compliance decisions, and an AML/CTF compliance officer who manages day-to-day compliance. In a small firm one person may hold more than one of these roles.

An AML/CTF program

The program has two required parts: a risk assessment that identifies and assesses your money laundering, terrorism financing and proliferation financing risks, and written policies, procedures, systems and controls to manage those risks and meet your obligations. It must be reviewed and updated, and subject to an independent evaluation.

Personnel due diligence and training

You must check that the people performing AML/CTF functions have the skills, knowledge and integrity for the role, and train them to understand your obligations and follow your policies.

Customer due diligence

Customer due diligence (CDD) means knowing who your customer is and the risk they present, before you provide the service. It has an initial stage and an ongoing stage, and the depth scales with risk: enhanced CDD applies in high-risk situations, and simplified CDD may be available for low-risk ones. It includes identifying beneficial owners where the customer is a company or trust, screening for politically exposed persons (PEPs) and persons subject to targeted financial sanctions, and understanding source of funds or source of wealth where risk calls for it.

Reporting to AUSTRAC

Depending on your business, you may need to submit suspicious matter reports (SMRs), threshold transaction reports for physical cash of A$10,000 or more, international funds transfer instruction reports, cross-border movement reports, and an annual compliance report covering how you met your obligations in the previous calendar year. AUSTRAC's suspicious matter report guidance explains when a suspicion must be reported and the deadlines that apply.

Record keeping

You must create and securely keep AML/CTF program records, CDD records and transaction records for a specified period, which AUSTRAC says is usually seven years.

Legal professional privilege

The Act contains protections for information subject to legal professional privilege, and it does not affect a person's right to refuse to give privileged information. The reform guidance sets out how that interacts with reporting for the legal profession.

Penalties and how AUSTRAC enforces

Failing to meet the Act's obligations can lead to civil penalties imposed by the Federal Court. AUSTRAC's enforcement tools also include infringement notices, remedial directions, enforceable undertakings and formal written notices; the full list is on AUSTRAC's page on the consequences of not complying.

Failing to enrol is the simplest breach to detect and AUSTRAC has treated it that way: it has said publicly that it is looking for businesses that provide designated services without being enrolled, and it uses infringement notices for non-enrolment. The sensible reading for a newly regulated firm is that enrolment, a documented program and a named compliance officer are the baseline AUSTRAC will look for first, and the quality of your customer checks is what it will look at next. The courts, not AUSTRAC, ultimately interpret the law.

How to work out whether the reform applies to you

Because the trigger is the service, scoping is a short analysis you should do once, write down, and revisit when your services change.

1. List every service line the business provides, including the minor ones (acting as a company's registered office, holding a deposit, setting up a trust for a client).
2. Compare each to the designated services for your sector in the Act and AUSTRAC's guidance, using the check tool as a first pass.
3. Record the outcome per service: in scope, out of scope, or unclear, and the reasoning. Take advice on the unclear ones.
4. Decide how to organise compliance. A mixed firm, for example one that does tax returns and also forms companies for clients, needs to decide whether to apply the program to the whole firm or only to the in-scope work. Applying consistent customer checks across the firm is often simpler than policing a boundary.
5. Review when services change. A new service line can quietly bring you into scope.

Risk-based does not mean optional

The reformed Act is built on a risk-based approach: the effort you put into each customer should match the risk they present. That is a flexibility, not an exemption, and it puts the burden on you to show how you decided. A defensible risk assessment looks at four things in combination:

• Who the customer is: an individual, a company, a trust or a government body, and any features that raise risk, such as a foreign PEP or a complex ownership structure.
• What service they want: some services are easier to misuse for moving or hiding funds than others.
• How you deal with them: a customer you never meet and who only interacts remotely is harder to verify than one in the room.
• Where the money and people are: links to high-risk countries or regions.

The output is a risk rating that sets the depth of checks. A low-risk customer may only need a few steps, and a high-risk one triggers enhanced due diligence, such as source of funds and source of wealth checks and senior manager approval. AUSTRAC's sector program starter kits show worked examples of this scaling for accountants, conveyancers, jewellers, the legal profession and real estate.

Common misunderstandings

• "We already check ID, so we are covered." Identifying a customer is one step of customer due diligence. The Act also requires a risk assessment, written policies, governance, reporting, training and record keeping.
• "Small firms are exempt." The obligations follow the service, not the firm size. AUSTRAC provides guidance on governance for sole traders and micro businesses, which recognises that one person may hold several roles, but it does not remove the obligations.
• "We outsource compliance, so it is the provider's problem." You can use outsourcing and technology to help meet your obligations, but the reporting entity remains responsible for the outcome.
• "We will report suspicious matters when we see them." Reporting only works if staff know what to look for and have a clear escalation route, which is why training and personnel due diligence are obligations in their own right.
• "A checklist is a program." A checklist helps you track tasks, but AUSTRAC expects a risk assessment and policies tailored to your business.

Sharing the load: reporting groups and starter kits

Two features of the regime are aimed at smaller businesses. Reporting groups let businesses that fit the Act's framework share some or all risk management and compliance arrangements under a group program set up by a lead entity. And AUSTRAC publishes program starter kits for the accounting, conveyancing, jewellery, legal and real estate sectors, designed for businesses that are regulated for the first time. They are practical, but AUSTRAC is clear that they are suited to businesses that meet the suitability criteria in each kit and are not a substitute for legal advice.

Where to go from here

This overview is deliberately general. For the sector with the most practical detail on onboarding, see our guide to AML for real estate agents. If you want a short action list to work through, use the Tranche 2 compliance checklist. For the customer-checking part of your program, see how AML screening and identity verification can be automated, and browse the wider anti-money laundering hub.

Most of what Tranche 2 asks for in day-to-day operation comes down to doing customer due diligence consistently and being able to show your work. That is where software helps: identity and beneficial-owner checks that run the same way every time, screening against sanctions and PEP data, and an audit trail of what was checked and when.