What Changed on 1 July 2026
For almost twenty years Australia's anti-money laundering and counter-terrorism financing (AML/CTF) laws mostly reached banks, remitters, casinos, pubs and clubs and bullion dealers. The professions that sit next to the money in a property sale or a company restructure were largely outside it. That gap is what people mean by "Tranche 2".
Parliament passed the AML/CTF Amendment Bill 2024 on 29 November 2024, and it became the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Act No. 110 of 2024, on the Federal Register of Legislation). According to AUSTRAC's summary of the reforms, businesses providing the newly regulated services have been regulated from 1 July 2026. When AUSTRAC opened enrolment on 31 March 2026, it said the number of regulated businesses would grow from around 19,000 to close to 100,000.
~100k
businesses AUSTRAC expected to regulate from 1 July 2026, up from around 19,000.
28
days after you first provide a designated service to apply to enrol.
62,710
businesses enrolled across all sectors as at 20 October 2026, per AUSTRAC.
Are You Covered? The Designated Service Test
AUSTRAC is clear that you are regulated because of what you do, not what you call yourself. If you provide a "designated service" with a geographical link to Australia, you have obligations. A suburban accountant who only does tax returns may be outside the regime while a two person firm that sets up family trusts is inside it. AUSTRAC's check if you may be regulated tool walks through it sector by sector.
| Sector | What usually brings you in | Worth knowing |
|---|---|---|
| Real estate | Working as a buyer's or seller's agent, or a developer selling house and land, off the plan apartments or new lots without engaging an independent agent. | Leases of 30 years or less sit outside the Act's definition of real estate, so ordinary residential leasing is not a real estate designated service. See AUSTRAC's real estate guidance. |
| Lawyers and conveyancers | Assisting in the planning or execution of a transaction to buy, sell or transfer real estate, a company or a trust; holding or managing a client's property as part of a transaction. | General advice or ancillary work is not enough. The service has to take active steps that move a transaction forward. |
| Accountants | Creating or restructuring a company or trust, assisting with equity or debt financing, handling client funds as part of a transaction. | The same "active steps" principle applies. AUSTRAC's professional services guidance has worked examples. |
| Trust and company service providers | Selling shelf companies, acting or arranging for someone to act as a director, secretary or trustee, providing a registered office address. | These items apply whoever provides them, including accountants and lawyers. |
| Dealers in precious metals, stones and products | Buying or selling for $10,000 or more in physical cash or virtual assets, in one transaction or linked ones. | Sales paid only by card or bank transfer are not a designated service, per AUSTRAC's precious metals guidance. |
If you are reading this from an agency, a practice or a jewellery counter, our pages for real estate, accountants and legal practices cover the day to day phone side of those businesses.
The Key Dates
| Date | What happened |
|---|---|
| 29 November 2024 | Parliament passed the amending Bill. |
| 31 March 2026 | Enrolment opened for the new sectors in AUSTRAC Online. |
| 1 July 2026 | Obligations started: AML/CTF programs, customer due diligence, suspicious matter reporting and record keeping. |
| 29 July 2026 | 28 days after 1 July: the latest a business already providing a designated service on day one could apply to enrol. |
| 28 August 2026 | AUSTRAC began issuing section 167 notices asking apparently unenrolled businesses for information. |
| 30 September 2026 | AUSTRAC announced its first infringement notices for failing to enrol. |
The 28 day rule is ongoing. A firm that takes on its first trust establishment next March has 28 days from that day, not from 1 July.
The Eight Things the Law Asks of You
AUSTRAC's summary of obligations is the authoritative list. In plain terms:
- Enrol. Create an AUSTRAC Online account and apply within 28 days of starting a designated service. Keep your details current: changes must be updated within 14 days, per AUSTRAC's enrolment guidance.
- Name your governance roles. A governing body, a senior manager who approves the program, and an AML/CTF compliance officer. In a sole practice one person can hold all three, but they still carry every duty.
- Write an AML/CTF program. A risk assessment of how your services could be misused, and policies, procedures and controls to manage those risks.
- Do initial customer due diligence before you act. Establish who the customer is, anyone acting for them and their authority, beneficial owners, whether anyone is a politically exposed person or sanctioned, and the purpose of the work. If you cannot establish these on reasonable grounds, you must not start.
- Keep monitoring. Ongoing due diligence means watching for unusual transactions and behaviour, and updating and reverifying what you know about the customer.
- Report. A suspicious matter report within 3 business days of forming a suspicion, or within 24 hours if it relates to terrorism financing. A threshold transaction report for physical cash of $10,000 or more. An annual compliance report.
- Keep records for 7 years. Program records, due diligence records and transaction records.
- Train your people and get evaluated. Training when someone starts and on an ongoing basis, tailored to their role, plus an independent evaluation of your program at least once every 3 years.
Start with the starter kit
AUSTRAC publishes free program starter kits for accountants, conveyancers, legal practices, real estate agents and jewellers. For a small firm, customising the kit is a far better first step than buying software.
Penalties and the First Infringement Notices
On 30 September 2026 AUSTRAC said it had begun issuing infringement notices to businesses in the real estate, accounting and jewellery sectors that it believes failed to enrol within 28 days of providing a designated service. The notices were issued at $21,840 for corporate entities and $4,368 for individuals, and AUSTRAC says they can accrue daily. It did not name the businesses. CEO Brendan Thomas said around 90 per cent of the businesses it first had concerns about had since enrolled or tried to, and that AUSTRAC "will issue more infringement notices where necessary".
SmartCompany reported the fines on 14 October 2026, quoting AUSTRAC Deputy CEO Katie Miller: "The law applies when a business provides a designated service. It doesn't matter if the business is big or small."
Infringement notices are the smallest tool. AUSTRAC's page on the consequences of not complying lists civil penalty orders from the Federal Court of up to 100,000 penalty units for a company and 20,000 for anyone else. At the $364 penalty unit that applies from 1 July 2026, that is up to $36.4 million and $7.28 million. Separately, tipping off, disclosing information about a suspicious matter report in a way that could prejudice an investigation, is a criminal offence carrying up to 2 years' imprisonment, 120 penalty units, or both.
The Small Firm Reality
Nobody pretends this is light. In the same SmartCompany report, COSBOA chair Matthew Addison called it "absolutely an administrative burden for a small firm" and said some advisers are already narrowing the services they offer. Jewellers that refuse cash or virtual asset payments of $10,000 or more can avoid the regime, provided they offer no other designated service.
AUSTRAC's message to small operators is effort, not perfection. Miller told SmartCompany: "We do not expect perfection but we do expect effort from businesses to understand and manage their risks and report if they see suspicious matters." Its guidance for sole traders and micro businesses confirms you can outsource roles such as compliance officer, but you remain responsible for the result.
"The small number that continue to ignore their obligations should not expect AUSTRAC to ignore them."
Brendan Thomas, AUSTRAC CEO, 30 September 2026
Where the Phone Fits, and Where It Does Not
Most of your program is paperwork and judgement. But a good share of a small firm's client contact still happens by phone, and three parts of the law touch it directly.
1. Caller ID is not identity
The ACMA warns that the number on your screen may not be the caller's real number, and that scammers spoof Australian numbers to impersonate banks, government agencies and telcos. A client's name popping up on the handset proves nothing. When AUSTRAC's guidance on verifying individuals lists ways to confirm someone is who they claim to be, the examples are comparing them to their photo ID in person, a video call, or biometric technology. A voice call cannot match a face to a licence photo.
2. Call back on a number you already hold
In September 2026 AAP reported a Melbourne conveyancer stopping a settlement about two hours out, after someone posing as the seller had emailed fake bank details to the agency. The scammer had also phoned agency staff that morning, chatting about the parties and the property. Around $200,000 was saved because the real client rang the agent directly. The conveyancer's advice: confirm details by ringing "a number you saved on your phone". If a caller asks to change bank details, contact details or who can instruct you, hang up and call back on the number already on file. Our article on AI voice cloning and vishing explains why a familiar voice is no longer proof either.
3. A doubt about identity can be a reporting trigger
Under AUSTRAC's suspicious matter report guidance, you must report if you suspect on reasonable grounds that a customer, future customer or their agent is not who they claim to be, even if you never provide the service. That makes whoever answers your phones part of the system. They need to know what to escalate, and they must not tell the caller a report is being considered.
Do not collect ID over channels you cannot control
Asking a client to read a passport number into voicemail, or text a photo of their licence to a staff member's personal mobile, scatters sensitive records where you cannot secure them. Use the verification method your program specifies, and keep the result in your client file.
What a phone system does not do. No phone system, ours included, enrols you, writes your risk assessment, verifies a client's identity or makes you compliant. It helps you keep good habits: calling back on saved numbers, recording calls with notice, and keeping notes where they can be found. Our own customer identity authentication page shows how we verify identity before changing anything on a phone account.
Calls as Records: Recording, Notes and Storage
AUSTRAC's record keeping guidance lists audio files, emails and correspondence among the records you may keep, and gives "emails, call notes or signed declarations from the customer confirming changes to their details" as an example of a due diligence record. Due diligence records must be kept for 7 years after the business relationship ends, or 7 years after a one off transaction is complete.
- Note the call, not just the outcome. Who rang, on which number, what they asked, how you checked, and who approved a change. A note made at the time is worth more than a memory.
- Record with notice. Recording consent is set by state and territory law and the rules differ, so tell every caller at the start, on every recorded line. Our guide to call recording laws in Australia sets out the detail.
- Lock it down. AUSTRAC expects sensitive records to be stored securely with access limited to authorised staff, and warns insecure storage raises your tipping off risk. Not everyone in the office needs every recording.
- Remember privacy. AUSTRAC notes that a reporting entity has Privacy Act obligations even as a small business.
Uniden Voice includes call recording on the phone, PC or cloud, with the business number on desk phones and apps for every user, so a call taken on a mobile is logged like one taken at the desk. If your team writes call notes, AI call transcription and summaries can draft them, but a person should still check what goes on a client file.
If You Have Not Started: The Next Four Weeks
| Week | Do this |
|---|---|
| 1 | Run AUSTRAC's regulation check for every service you offer. If you are in, enrol in AUSTRAC Online now. Every day unenrolled is exposure. |
| 2 | Download your sector's starter kit. Decide who holds the three governance roles, and draft the risk assessment. |
| 3 | Write the client onboarding steps: what you collect, how you verify, and what you do when something does not add up. Add the phone rules: no changes on an inbound call, call back on file numbers, no ID over voicemail or text. |
| 4 | Train everyone who deals with clients, including reception, on suspicious activity, escalation and tipping off. Record who was trained and when. Set up a register for records and recordings. |
Not Legal Advice: Where to Get Proper Help
This article is general information, not legal advice. Whether a particular service is designated, and what your program needs, depends on your circumstances. AUSTRAC's own pages say the same about their guidance. Start with AUSTRAC: its Contact Centre is on 1300 021 037, and it has said that contacting it "isn't a red flag". Your professional body and a lawyer who works in AML/CTF can take it from there.
Want to see the full system first? Our business phone system page sets out what is included, and agencies can read our guide to phone systems for real estate agencies.