Tranche 2 has commenced. The enrolment deadline has passed. Here is what to do now.

← Back to Insights REGULATORY & COMPLIANCE

12 min read · 2 August 2026

On 1 July 2026, the biggest regulatory change to the Australian accounting profession in a generation took effect. Four weeks later, the enrolment window closed. If your firm provides even one designated service and has not enrolled with AUSTRAC, you are already late — and what you do in the next fortnight matters more than what you did in the last one.

For almost twenty years, Australia’s anti-money laundering and counter-terrorism financing regime applied to banks, casinos and financial services. Accountants sat outside it. That ended on 1 July 2026, when the Tranche 2 reforms under the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) extended the regime to roughly 80,000 to 100,000 businesses in the so-called gatekeeper professions — lawyers, conveyancers, real estate professionals, dealers in precious metals and stones, trust and company service providers, and accountants.

The reform is significant, but it is manageable. What it is not is optional, and it is no longer prospective.

First, the thing most firms get wrong

Tranche 2 does not capture accountants. It captures designated services.

That distinction decides everything that follows. The obligation attaches to the activity, not to the professional title, which means two firms of identical size can sit on opposite sides of the line — and a single engagement can pull a firm into the regime that was outside it the month before.

Preparing tax returns, compiling financial statements and conducting audits do not, on their own, trigger the regime. What does are the services set out in Table 6 of section 6 of the AML/CTF Act, including:

  • Assisting with the formation of companies or trusts
  • Acting as, or arranging for another person to act as, a nominee director, secretary or trustee
  • Providing a registered office or business address service
  • Managing client money, accounts or assets in defined circumstances
  • Buying or selling a business or body corporate on behalf of a client
  • Certain real property transaction services

Most general practices provide at least one of these. Company and trust formation alone captures a very large share of the profession.

The practical test: work through your services list — not your job titles — and ask whether each one appears in Table 6. AUSTRAC publishes a check if you are regulated tool, and it is worth using even if you are confident of the answer. Document the conclusion either way. A firm that assessed itself as out of scope and recorded why is in a far stronger position than one that simply never looked.

What was due, and when

31 March 2026 AUSTRAC enrolment opened for Tranche 2 entities.

1 July 2026 Obligations commenced. From this date, customer due diligence is required before providing a designated service.

29 July 2026 Enrolment deadline — 28 days after commencement — and the date by which AUSTRAC must be notified of your AML/CTF compliance officer (or 14 days after enrolment, whichever is later).

If those dates have passed and your firm has not acted, that is the position to address first. Failing to enrol is a civil penalty provision under the Act. It is also, unhelpfully, the single most visible thing about your compliance position: AUSTRAC does not have to investigate your firm to know whether you enrolled.

If you are behind, do these four things this week

Being late is a problem. Being late and doing nothing is a materially worse one. AUSTRAC has signalled that it expects newly regulated businesses to engage genuinely with their obligations, and a firm that has stood up a real, risk-based program and is visibly working through the gaps sits in a very different position from one that has taken no meaningful action at all.

1. Enrol with AUSTRAC. Late enrolment is better than no enrolment, and it stops the exposure growing.

2. Appoint your AML/CTF compliance officer and notify AUSTRAC. The role must sit at management level. In a sole practice or small firm this will be the principal, and that is acceptable — what is not acceptable is the role being unfilled or unnamed.

3. Start customer due diligence on new engagements immediately. CDD is required before the designated service is provided. Every new matter you open without it compounds the problem, so this cannot wait for the program documentation to be finished.

4. Document what you are doing and when. A dated remediation plan showing what has been completed, what is in progress and what is scheduled is the most useful single artefact you can hold. It converts “we are behind” into “we identified the gap and are closing it” — and that distinction matters both to a regulator and to a professional indemnity insurer.

What compliance actually requires

Once enrolled, five obligations do the work.

1. A documented AML/CTF program

Two components, and both are mandatory. A money laundering, terrorism financing and proliferation financing risk assessment covering your clients, services, delivery channels, jurisdictions and payment methods — with particular attention to trusts, complex ownership structures, cash and any crypto exposure. And AML/CTF policies setting out the controls, governance, responsibilities, monitoring and escalation that respond to those risks.

The program must be proportionate. A three-partner suburban practice does not need a bank’s framework, and AUSTRAC does not expect one. What it does expect is that your program reflects your risks rather than a downloaded template with the firm name changed — which is the failure mode most likely to be exposed on first contact with the regulator.

The program must be kept current, reviewed at appropriate intervals and in any event at least once every three years, and independently evaluated at least once every three years.

2. Customer due diligence before you act

The change in mindset is larger than the change in paperwork. You cannot simply accept a new client and begin work. Before providing a designated service, you must:

  • Identify the client — full legal name, date of birth, residential address for individuals; name, ACN, ABN, registered office and principal place of business for companies; deed, trustee, settlor, beneficiary and appointor details for trusts.
  • Verify identity from reliable and independent sources — documentary, electronic KYC, digital identity providers or government databases.
  • Identify beneficial owners — generally anyone owning or controlling 25% or more, or otherwise exercising effective control. For layered structures this means tracing to the ultimate owners, including offshore parents. This is the obligation firms consistently underestimate.
  • Understand the purpose of the engagement and the nature of the client relationship.
  • Understand source of funds and source of wealth — these are different questions. Source of funds is where the money for this transaction came from. Source of wealth is how the client’s wealth was accumulated overall.

Screening runs alongside: politically exposed persons (domestic, foreign and international organisation PEPs, together with immediate family and close associates), sanctions lists, and adverse media. Screening is not a one-off — it should occur at onboarding and periodically thereafter.

Where risk is higher — foreign PEPs, high-risk jurisdictions, cash-intensive or crypto businesses, opaque offshore structures, unexplained wealth — enhanced due diligence applies: additional verification, senior approval to proceed, more evidence on source of funds, and more frequent review. In defined low-risk circumstances, simplified due diligence is available.

And CDD does not stop at onboarding. Ongoing due diligence means monitoring for changes in ownership, directors, trustees, business activities, jurisdictions and transaction behaviour — and noticing when a long-standing client’s instructions stop making commercial sense.

3. Suspicious matter reporting — and the rule about not telling the client

If you form a suspicion, you may be required to lodge a suspicious matter report with AUSTRAC.

The critical rule is what you must not do. Do not tell the client. “Tipping off” — disclosing that an SMR has been or may be made — is itself an offence under the AML/CTF regime. This creates a genuinely uncomfortable professional situation, because the natural instinct of a good adviser is to raise the concern with the client and resolve it. Here, that instinct is wrong.

Investigate internally, escalate to your compliance officer, take advice if you need it, and document the decision either way — including a decision not to report.

4. Record keeping

Records of identification and verification, risk assessments, beneficial ownership determinations, AML decisions and the reasoning behind them, monitoring, reports lodged, staff training and independent reviews. The statutory retention period is generally seven years.

5. Staff training

Everyone who touches client onboarding or designated services needs training covering the law, KYC procedures, beneficial ownership, PEP identification, red flags, reporting obligations and internal escalation. Training must be recorded — an untrained team member is a control failure regardless of how good the written program is.

Red flags worth knowing

None of these means a client is laundering money. Each means slow down and document your thinking.

  • Reluctance to provide identification, or documents that arrive slowly and incomplete
  • Structures more complex than the commercial purpose requires — multiple trusts, layered entities, nominee shareholders
  • Offshore entities with no evident commercial rationale
  • Large or unusual cash dealings, or crypto activity the client cannot explain
  • Frequent, unexplained changes of directors or shareholders
  • Payments from or to third parties with no relationship to the engagement
  • Explanations that shift between conversations, or documents that do not reconcile with each other
  • Urgency without a reason, particularly around settlement or structure formation

The part nobody mentions: your clients are about to notice

The compliance burden is one thing. The client conversation is another, and firms are being caught unprepared by it.

From now on, long-standing clients — people you have acted for across decades — will be asked for identity documents, beneficial ownership charts and explanations of where their money came from. Some will find that offensive. A short, prepared explanation of why the request is being made, framed as a legal obligation applying to the whole profession rather than a judgement about them, will do more to protect those relationships than anything else you do this year.

It is also, incidentally, a differentiator. The firms that handle this conversation well will look organised. The firms that do it apologetically, late, and inconsistently will look like they were surprised by a reform announced in 2024.

Where this leaves you

Tranche 2 is not a documentation exercise. It is a shift in how client relationships begin, how work is accepted, and what a firm is expected to know about the people it acts for. The firms that treat it as a filing obligation will produce a program that fails on first contact with a regulator. The firms that treat it as a risk framework will find — as they generally do — that the discipline is useful well beyond the compliance question.

If your firm is enrolled, has a compliance officer, and is running CDD on new engagements, you are in reasonable shape and the work now is quality: is the risk assessment genuinely yours, is the training real, is the program going to survive its first independent evaluation.

If you are not, the priority order is enrolment, compliance officer, CDD on new matters, then documentation — in that sequence, starting today.

Liguory & Associates advises accounting firms and professional practices on AML/CTF program design, risk assessment, and independent evaluation, and provides the independent review required under the AML/CTF framework. We also conduct governance, risk and internal audit engagements across regulated and public sector environments.

Explore our Risk & Governance services, or read our Risk Framework for how we assess risk across six domains.

Discuss your AML/CTF position →

Important information

This information is general in nature and should not be relied on as advice. It does not take into account the objectives, financial situation or needs of any particular person. You should consider your own financial situation and needs, and seek professional advice, before making any decisions based on this information.

This article is current as at 2 August 2026. AUSTRAC guidance and the AML/CTF Rules continue to develop; confirm the current position before acting.