AUSTRAC Tranche 2 Is Now in Force: What Accounting Practices Need to Know

# AUSTRAC Tranche 2 Is Now in Force: What Accounting Practices Need to Know Australia's expanded AML/CTF regime has been in force since **1 July 2026**. Accounting practices are within scope when they provide covered professional designated services with an Australian geographic link. Being an accountant, or performing ordinary accounting work, does not by itself make every engagement subject to the regime. **Source review: 25 August 2026.** Reviewed against AUSTRAC's [new reporting regime update](https://www.austrac.gov.au/new-reporting-regime-now-force), [professional designated-services guidance](https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/professional-designated-services) and [existing-customer transition guidance](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/transitioning-existing-customers). This is general information only, not legal advice. Check your services and circumstances with AUSTRAC or your adviser. ## What is Tranche 2? Australia's original AML/CTF Act 2006 (Tranche 1) regulated financial institutions, banks, casinos, and remittance providers. Tranche 2 extends these obligations to "gatekeeper" professions -- those who facilitate transactions that can be exploited for money laundering and terrorism financing. The Financial Action Task Force (FATF) has recommended these reforms for over a decade, and Australia was one of the last developed nations to implement them. The 2024 amendment finally closes the gap. ### Which professions may be affected? - **Accounting practices** (including some work by tax agents, BAS agents, and auditors) - Lawyers and conveyancers - Real estate agents - Trust and company service providers - Dealers in precious stones and metals Coverage turns on the statutory definition and the Australian geographic link, not the profession label alone. Examples of professional services that may be designated include: - Managing client money, securities, or other assets - Managing bank, savings, or securities accounts - Organising contributions for company creation or management - Creating, operating, or managing legal persons or arrangements - Buying and selling business entities - Acting as a registered agent or nominee ## Current Position and Timing The current position can be summarised without turning conditional rules into universal dates: | Date | Obligation | |------|-----------| | **Since 1 July 2026** | The expanded regime is in force for entities providing covered services with the required Australian geographic link | | **New customers** | Apply the initial CDD timing rules that fit the covered service and circumstances, including any permitted exception or deferred timing | | **Existing customers** | Transition rules are conditional; risk and specified trigger events can affect when initial CDD is required | Do not turn these rules into one practice-wide date. Use AUSTRAC's current guidance for each customer cohort. ## What an In-Scope Practice Needs to Address ### 1. Enrol with AUSTRAC If your practice is a reporting entity, check AUSTRAC's current enrolment and registration requirements before providing a covered service. The required steps depend on your status and services. ### 2. Develop an AML/CTF Program Your AML/CTF program should reflect the current Act, Rules and AUSTRAC guidance and be tailored to your risks. Organise the work around: **Risk assessment and customer controls:** - Designated business group identification - ML/TF risk assessment for your practice - Customer identification and verification procedures - Ongoing customer due diligence procedures - Correspondent relationships policy (if applicable) **Governance and people controls:** - Employee due diligence (screening before hiring) - AML/CTF training program (initial and ongoing) - Whistleblower protections ### 3. Perform Customer Due Diligence (CDD) For each customer and covered service in scope, determine which initial CDD measures the Act and your program require. Those measures may include: - **Identify the customer** -- collect full name, date of birth, address - **Verify their identity** -- use reliable, independent documents (photo ID, utility bills) - **Identify beneficial owners** -- for companies and trusts, identify anyone who owns 25% or more or exercises significant control - **Understand the purpose and nature of the business relationship** - **Assess the ML/TF risk** -- categorise each client as low, medium, or high risk Enhanced measures

may be required in higher-risk circumstances. Use the triggers and procedures in the current Rules and your program rather than assuming a label alone resolves the question. ### 4. Ongoing Monitoring For relationships and services in scope, ongoing CDD controls may require you to: - Monitor transactions and activities for consistency with client profile - Keep customer information current on the risk-based cycle and trigger events set by your program - Watch for changes in ownership, control, or risk profile - Screen against sanctions lists (DFAT Consolidated List) regularly ### 5. Reporting Obligations Where the relevant reporting obligation applies, a reporting entity may need to submit: - **Suspicious Matter Reports (SMRs)** -- within 24 hours for terrorism financing, 3 business days for all other suspicious matters - **Threshold Transaction Reports (TTRs)** -- for cash transactions of $10,000 or more - **International Funds Transfer Instructions (IFTIs)** -- if applicable to your services - **Annual compliance reports** -- to AUSTRAC summarising your compliance activities ### 6. Record Keeping Different AML/CTF records can have different retention triggers. Many relevant records are subject to a seven-year period; confirm the record type, start point and current rule before setting disposal dates. ## Penalties for Non-Compliance The Act provides civil and criminal consequences for contraventions. The applicable provision, penalty units and circumstances must be checked at the time: - Failure to maintain or follow a required AML/CTF program - Failure to carry out applicable customer due diligence - Failure to make a required report - Tipping off or record-keeping contraventions Penalty units are indexed. Confirm the current legislation and obtain legal advice rather than relying on a marketing article for a dollar figure. AUSTRAC has enforcement powers, but the consequences in any matter depend on the entity, obligation and contravention. Obtain advice for your own risk rather than treating a large-institution case as a forecast for an accounting practice. ## How to Prepare Now Because the regime is now in force, use this as a current-state review checklist: ### Scope and governance 1. **Appoint a compliance officer** within your practice 2. **Conduct an ML/TF risk assessment** of your client base and services 3. **Review or update your AML/CTF program** against current AUSTRAC guidance 4. **Review your existing client base** to identify high-risk clients who need priority CDD ### Procedures and implementation 5. **Apply CDD procedures** to covered services and customer relationships under the current timing rules 6. **Choose proportionate tooling** for identity checks, DFAT sanctions screening and record keeping; software is not itself a legal requirement 7. **Train all staff** on AML/CTF obligations, red flags, and reporting procedures 8. **Register with AUSTRAC** (do not leave this to the last week) ### Testing and ongoing review 9. **Run your CDD process** on several test clients to identify gaps 10. **Review your AML/CTF program** with legal counsel or a compliance consultant 11. **Ensure your record-keeping systems** can meet the 7-year retention requirement ## How Fedix Assists Your Workflow The Fedix KYC/AML module is purpose-built for Australian accounting practices facing Tranche 2 obligations: - **Automated identity verification** -- verify individuals, companies, and trusts against government databases - **Sanctions screening and political-exposure indicators** -- screening against the DFAT Consolidated Sanctions List, plus political-exposure indicators (not a licensed PEP database); additional international list coverage via licensed data partners is on the roadmap - **Risk-assessment drafts** -- produce a starting point for the practice to review, change and approve - **Ongoing monitoring** -- continuous screening with alerts when client risk profiles change - **Exportable workflow records** -- retain the evidence created in Fedix; your practice remains responsible for completeness and retention settings - **Pay-per-verification pricing** -- your first 10 verifications are free, then $2.90+gst per verification (volume tiers down to $1.50), no monthly minimums, so you only pay when you verify If your practice provides covered services, the statutory obligations remain yours. Fedix assists with parts of the workflow and does not provide legal advice or make your compliance decisions. [Learn more about Fedix KYC/AML](/features/kyc-aml) or [request a demo](/contact).