Australia’s anti-money laundering and counter-terrorism financing (AML/CTF) reforms — known as Tranche 2 — brought new sectors under AUSTRAC regulation from 1 July 2026. Existing reporting entities also saw changes to customer due diligence from 31 March 2026.
Who is now covered
Obligations attach to the services a business provides, not just its profession. The newly regulated groups include:
- Lawyers, accountants and conveyancers — for example helping clients buy or sell real estate or businesses, managing client money for a transaction, setting up or restructuring companies and trusts, or acting as a nominee director or trustee
- Trust and company service providers, including providing a registered office address or selling shelf companies
- Real estate professionals — brokering sales and purchases, and developers selling directly
- Dealers in precious metals, stones and products — transactions of $10,000 or more paid in cash or virtual assets
Core obligations
- Enrol with AUSTRAC within 28 days of first providing a designated service
- Maintain an AML/CTF program: a risk assessment and policies proportionate to your size and risk
- Appoint an AML/CTF compliance officer and train staff
- Customer due diligence: identify and verify customers and beneficial owners, and check for politically exposed persons and sanctions
- Report suspicious matters, cash transactions of $10,000 or more, and relevant cross-border movements
- Keep records for 7 years, and arrange periodic independent evaluations
AUSTRAC’s approach in the first year
AUSTRAC has said it does not expect newly regulated businesses to be perfect, but it does expect honest efforts. Its early enforcement priorities are businesses that have not enrolled, or that are reckless about or complicit in criminal activity. Starter kits and sector guides are available on the AUSTRAC website. Penalties for serious non-compliance are substantial, so it is worth getting the basics in place now.
Where systems help
Much of the day-to-day work — recording CDD, rating customer risk, screening against sanctions lists and keeping an audit trail — can be built into the systems you already use rather than managed in spreadsheets.
Need help? Core365 ShieldLink brings KYC, risk rating, sanctions and PEP screening and reporting into the Business Central customer card. Book a free strategy call or email info@core365.com.au.