Australia Tranche 2: AML Hits Professional Services

Australian lawyers, accountants, and real estate agents spent decades outside the perimeter. Banks ran KYC. Crypto exchanges ran KYC. The practice that helped a client structure a property buy, shift money into a trust, or dispose of a commercial building worth tens of millions of dollars? None.

1 July 2026 ends that arrangement.

Tranche 2, as AUSTRAC frames the reforms, pulls Australia's professional services sector under the Anti-Money Laundering and Counter-Terrorism Financing Act for the first time. Some 100,000 entities — about six times the population already regulated — will become reporting entities. The majority have never drafted an AML/CTF program, never trained staff on suspicious matter reporting, and never put a customer through a formal identity-verification workflow.

Twenty-seven days from now, that gap counts.

Who Is Caught by Tranche 2?

Designated non-financial businesses and professions (DNFBPs) are the target — the group FATF has, for a long time, treated as the main hole in global anti-money laundering regimes. Across Australia's large cities, real estate deals, trust formation, and professional fund management have been the favoured channel for criminal proceeds for years. Tranche 2 shuts that hole.

Sector	Designated Services	Monetary Threshold
Real estate agents & conveyancers	Sale, purchase, transfer of real property	None
Lawyers & barristers	Holding client property; equity/debt financing; entity management	None
Accountants	Trust/company creation, administration, fund handling	None
Precious metals & stones dealers	Buying or selling covered goods	None
Trust and company service providers	Formation, administration, directorship services	None

Leaving out a monetary threshold was a choice, not an oversight. Identity verification for a $90,000 apartment buy is the same duty as for a $90 million commercial portfolio. The designated service is the trigger. Deal size is not.

The EU's parallel move — the AMLR, which extends similar obligations to real estate and professional services from July 2027 — is not the Australian model. Tranche 2 covers professional services as a class, with no sector-by-sector thresholds. The bar is the same for everyone, and it sits high.

The Five Core Obligations

1. Enrolment with AUSTRAC

Enrolment with AUSTRAC opened on 31 March 2026 and has to be finished by 29 July 2026. Supplying a designated service before enrolment is itself a breach of the AML/CTF Act — not a paperwork slip, a standalone offence that carries its own penalty risk.

Enrolment starts the compliance process. It does not finish it. A practice that enrols on 1 July with no program, no KYC workflow, and no trained staff has cleared the administrative gate and remains substantively non-compliant.

2. A Written AML/CTF Program

A written AML/CTF program, approved by the firm's principal or board, has to exist before any designated service is provided. Every reporting entity is under that duty. The program has to set out how the firm:

• Identifies and assesses money laundering and terrorism financing risks specific to its client base and service profile
• Verifies customer identity before providing any designated service
• Conducts ongoing customer due diligence throughout the client relationship
• Manages and reports suspicious activity

Substance is what AUSTRAC will test. A law-society template pulled off a website and lightly rewritten is not a program a firm can defend. Geographic exposure, client concentration, and transaction channels as they actually exist at the firm are what the regulator expects the risk assessment to reflect.

3. Customer Identification and Verification

Prescribed identification information has to be collected and verified before a designated service is supplied. Individuals: full name, date of birth, and residential address, checked against reliable, independent sources. Entities: ABN or ACN, registered address, and — this is the hard part — identification of the beneficial owners sitting behind any company or trust.

Most firms will hit their steepest operational wall here. Fifteen years of administering a family trust does not excuse an accountant from formally mapping and verifying the beneficial-ownership chain in a format that satisfies AUSTRAC. Informal professional familiarity, the texture of these relationships for years, is not a substitute for documented identity verification.

Any practice building from nothing should treat a complete KYC process — document collection through risk-based ongoing monitoring — as the baseline specification for the program it has to construct.

4. Suspicious Matter Reporting

A suspicion that a transaction involves proceeds of crime or is tied to terrorism financing forces the reporting entity to file a suspicious matter report (SMR) with AUSTRAC inside three business days. The duty attaches at the moment suspicion is formed. Closing the transaction is not the clock.

A real estate agent who, during due diligence, grows concerned about a buyer's source of funds has to report that suspicion even if the sale never completes. The suspicion is what the reporting duty follows, not the deal.

5. Seven-Year Record Retention

Identification records, transaction records, and AML/CTF program documentation all have to be kept for seven years. Files on deals that never completed sit under the same rule as files on deals that did.

What Changes for Each Sector

Real Estate

Property has, for a long time, been treated as the main vehicle for washing criminal proceeds in Australia. Layered ownership, large cash-adjacent deals, and almost no formal identity checks produced a setting in which due diligence was, in practice, optional. The Australian Criminal Intelligence Commission has, more than once, named real estate as a principal vulnerability.

From July 2026, agents and conveyancers acting on a sale, purchase, or transfer of real property have to verify every party to the deal — including the people behind corporate buyers, trust vehicles, and multi-entity structures. How identification and beneficial-ownership checks work on property transactions in practice is set out in the real estate KYC guide.

Law Firms

"Legal advice" as a heading is not what the regulation catches. Specific designated services are: receiving, holding, controlling, or managing property while helping clients plan or execute a transaction; helping clients with equity or debt financing; creating, managing, or administering companies, trusts, or other legal structures; and acting as, or arranging for someone to act as, a director, secretary, or equivalent officer.

Conveyancing, corporate deals, estate administration, and trust formation sit inside the perimeter. Court representation and pure legal opinion sit outside it. Firms will need an intake framework that flags, at the start, whether a new matter or a continuing client relationship involves a designated service — and fires the KYC workflow then, not after the fact.

Accounting Firms

The same logic governs designated services for accountants: creating and administering legal structures, handling or directing client money, and work that puts the firm in a position of control over client assets. A family-trust restructure, administration of a corporate holding company, or settlement of a deceased estate each switches the duties on.

Accountants carry a further burden past the first KYC pass: ongoing due diligence attaches to continuing relationships. A practice with hundreds of long-standing trust clients has to apply Tranche 2 not only to new work, but to existing relationships in which the designated service is still being supplied.

Penalties Are Not Theoretical

Civil-penalty powers and criminal enforcement powers both sit with AUSTRAC. For body corporates, maximum civil penalties reach into the tens of millions of dollars per contravention. Enforcement outcomes are published. A finding against a legal or accounting firm brings professional consequences with the Law Society, CPA Australia, or CA ANZ on top of whatever AUSTRAC itself imposes.

Anyone counting on a gentle first year should look at the record. The Commonwealth Bank settlement in 2018 (AUD 700 million) and the Westpac case in 2020 (AUD 1.3 billion) showed that AUSTRAC uses the powers it has and that scale is not a shield. The approximately 100,000 entities joining the reporting population in July 2026 should not assume that being new to regulation will buy them patience.

Building Compliance Infrastructure That Scales

A sole-practitioner solicitor and a national accounting network with 500 staff share the same core problem: none of this has been done before. The program, the KYC workflow, the reporting stack, and the training all have to be stood up from nothing.

Bespoke compliance consulting, manual document collection, physical identity checks, and spreadsheet record-keeping — the inherited model — will not hold at the volume Tranche 2 creates. Firms that try to run KYC across large client books entirely by hand will get inconsistency between offices, operational drag they cannot sustain, and no credible way to show AUSTRAC that the program works if enforcement arrives.

Automated identity-verification platforms shorten the build and cut the error rate sharply. Electronic checks against government data sources, automated capture of beneficial ownership, continuous customer monitoring, and AI-driven risk-flag escalation lower both cost and exposure. Joinble's AI-powered compliance agents are built for ongoing, autonomous identity management — not one-off checks that meet the letter of the duty and then leave the firm blind until the next verification event.

FAQ

When does Tranche 2 start?

1 July 2026 is the start date for the Tranche 2 AML/CTF duties. Enrolment with AUSTRAC opened on 31 March 2026 and has to be completed by 29 July 2026.

What if my firm misses the enrolment deadline?

Supplying a designated service without enrolment is a standalone breach of the AML/CTF Act. Civil penalties are available to AUSTRAC, and a failure to enrol can be treated as an aggravating factor in later enforcement.

Do existing client relationships need to be re-verified?

Yes. Where designated services continue to be supplied to an existing client, Tranche 2 KYC duties attach to that continuing relationship. Complex structures will require a formal mapping of beneficial ownership.

Is pure legal advice or standard tax return preparation in scope?

No. Specific designated services are what the regime catches, not whole professional categories. Pure legal advice, unaccompanied tax-return filing, and court representation generally sit outside the perimeter. The particular transaction or structural service is the trigger, not the professional relationship itself.

What is a suspicious matter report and when must it be filed?

A suspicious matter report (SMR) is a formal filing with AUSTRAC, due within three business days of forming a suspicion that a transaction involves proceeds of crime or is tied to terrorism financing. The duty follows the suspicion, not completion of the deal.

How long must KYC records be kept?

Identification records, transaction records, and AML/CTF program documentation have to be retained for seven years, including files on transactions that never completed.