Anti-money laundering (AML) and counter-terrorism financing (CTF) obligations are expanding in Australia.

From 1 July 2026, new reforms (known as Tranche 2 reforms) will expand the AML/CTF regime to cover a broader group of businesses and advisers. That expansion will bring more professional service providers directly into scope.

For many businesses, this will mean a shift from general awareness to active compliance.

That includes understanding whether your business falls within the regime, enrolling with AUSTRAC where required, preparing a written AML/CTF program, training your people, updating client onboarding procedures, and reporting certain matters in the required way.

This article sets out the key points business owners should be aware of and the practical steps they can take now to protect themselves.

Who is affected?

An entity will be affected if it provides one or more designated services under section 6 of the AML/CTF Act.

Depending on the services provided, it is highly likely that affected professions will include accountants, lawyers, conveyancers, and real estate agents.

For business owners, the key question is not whether your industry appears on a broad list. The key question is whether your business provides a designated service that brings it within the regime.

What the business must do

Businesses (no matter what size) must review their operations to ascertain whether they provide designated services.

Enrolment

If a business provides one or more designated services, it must enrol with AUSTRAC and comply with the obligations that apply under the applicable legislation.

Trance 2 entities may enrol from 31 March 2026 but must enrol no later than 28 days from the date a designated service is provided - this practically means by 29 July 2026.

Risk assessment

Businesses need an AML/CTF program that identifies, mitigates, and manages the money laundering and terrorism financing risks relevant to the business. That program should reflect the business’s actual operations. A generic document will not do much to protect the business if AUSTRAC asks how risks were assessed and managed in practice.

Carry out customer due diligence

Businesses must verify customer identities before providing designated services. In practice, that means having a clear client onboarding process and understanding who sits behind the customer, including beneficial owners where required. This is often where businesses first discover gaps in their systems, especially if they have grown quickly or rely on inconsistent manual processes. Due diligence must be conducted initially as well on an ongoing basis.

Report certain matters

Reporting entities may need to report to AUSTRAC:

• Suspicious matters.
• Cash transactions over AUD $10,000.
• International funds transfer instructions.

Reporting obligations need clear internal pathways. Staff need to know what to look for, when to escalate concerns, and who is responsible for deciding whether a report is required.

Practical warning signs

AML/CTF compliance depends on recognising when something does not fit the usual pattern.

Common warning signs/red flags may include:

• Unexplained urgency.
• Inconsistent identity or source-of-funds information.
• Unusual transaction patterns.
• Activities involving certain countries.
• Smaller transactions structured to avoid reporting thresholds.
• Complex ownership arrangements without a clear commercial reason.
• Instructions that do not align with the client’s profile or business activity.
• Reluctance to provide documents or answer basic verification questions.

The above items do not necessarily mean wrongdoing. They do mean the matter may need closer review and require enhanced CDD.

Critical questions that should be asked (and answered) are:

• Who is your client?
• Who is the beneficial owner?
• What is the source of wealth and funds?
• Is there something unusual about this transaction?
• What is the relevant jurisdiction?
• Is a Politically Exposed Person involved?

Train your people

Boards, directors, principals, managers, and frontline staff all need training that matches their role. Training should not stop at the legislation. Staff need to understand what suspicious activity can look like in your actual business, who they escalate concerns to, and how to communicate with clients appropriately.

Appointment of an AML/CTF Compliant Officer

Businesses must appoint a compliant officer who has specific duties under the legislation.

Keep records

Businesses must keep customer identification and transaction records for at least seven years. Record keeping is not just an administrative task. Good records help demonstrate compliance, support internal reviews, and reduce the risk of confusion if AUSTRAC asks questions later.

Business owner compliance

For business owners, AML/CTF obligations create operational, legal, and reputational issues that need active management.

That can increase cost and complexity, particularly for growing businesses that have not previously had formal compliance infrastructure.

Greater legal and financial risk

Non-compliance can expose a business to significant penalties, regulatory scrutiny, and serious disruption. Directors and senior decision-makers should treat AML/CTF as a governance issue, not just a back-office process.

AUSTRAC has indicated that they require businesses to unconditionally prepare and be ready for compliance of the Trance 2 obligations by 1 July 2026. However, there is a recognition that given this a new regime for some professions, business’ systems, processes, and policies may not be perfect on that date and that further updating and monitoring maybe required. Such recognition should not be used for business as an excuse to ‘take the foot off the pedal ‘in their preparation.

Pressure on client experience

Verification checks, information requests, and delays in onboarding can frustrate clients if they are handled poorly. Clear communication matters. Businesses need processes that meet compliance obligations without creating unnecessary confusion or friction.

Privacy and data security concerns

AML/CTF compliance often requires businesses to collect and hold sensitive personal information and, in the case of lawyers, face legal professional privilege issues. That creates another layer of risk. Businesses need to store that information securely, limit access appropriately, and avoid conduct that could amount to tipping off.

Key takeaways

AML/CTF reform will affect how many businesses onboard clients, verify information, assess risk, and document decisions. The businesses that handle the transition best will not be the ones with the longest policy manuals. They will be the ones with clear scope, practical processes, trained people, and a consistent approach to escalation and communication.

For business owners, that helps protect the business from unnecessary disruption and regulatory risk.

For professional advisers it also helps protect client relationships. Clear processes, well-managed communication, and defined boundaries make it easier to complement their client service without getting caught out by avoidable compliance gaps.