The Complete Guide to Tranche 2 AML/CTF Compliance for Australian Professionals

Tranche 2 is the most significant expansion of Australia's AML/CTF regime since the original Act was passed in 2006. From 1 July 2026, approximately 90,000 additional businesses — including accountants, lawyers, real estate agents, conveyancers, financial planners and precious metals dealers — became regulated under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.

This guide explains everything you need to know: what Tranche 2 is, who is captured, what your obligations are, and how to comply without drowning in complexity.

What is Tranche 2?

Australia's AML/CTF framework was originally introduced in 2006 and applied primarily to financial institutions — banks, credit unions, remittance providers, casinos and currency exchanges. These were known as Tranche 1 businesses.

Tranche 2 extends these same obligations to a new category of businesses: professional service providers who act as "gatekeepers" to the financial system. These are professionals who help their clients establish companies, move money, acquire assets and access financial markets — and whose services, if unregulated, could be exploited by criminals to launder money or finance terrorism.

Australia was one of the last FATF member countries to extend AML obligations to professional services. The UK, EU, Canada and most comparable economies have had equivalent laws in place for years.

Who is Captured by Tranche 2?

Tranche 2 captures businesses providing any of the following "designated services" under Table 6 of the AML/CTF Act:

• Accountants and tax agents — when assisting with company registrations via ASIC, buying or selling companies or trusts, creating or restructuring trusts, equity or debt financing, or acting as a trust and company service provider
• Lawyers and solicitors — when handling property transactions, managing client funds in trust, forming companies or trusts, or acting as nominee directors or trustees
• Conveyancers — when acting in the purchase, sale or transfer of real property
• Real estate agents — when acting on behalf of a buyer or seller in a real property transaction
• Financial planners — when establishing SMSFs, investment structures or managing client assets in certain circumstances
• Mortgage brokers — for certain lending arrangements above applicable thresholds
• Precious metals and jewellery dealers — for high-value transactions above applicable thresholds
• Trust and company service providers — when forming companies, providing nominee directors, registered office addresses or similar services

Important: not all services provided by these businesses are regulated. An accountant who only prepares tax returns and BAS lodgements has no Tranche 2 obligations from those services. The obligations only apply to the specific designated services listed above.

Your Five Core Obligations

1. Enrol with AUSTRAC

Every business providing a designated service must enrol with AUSTRAC via AUSTRAC Online. The enrolment deadline for businesses already providing designated services on 1 July 2026 was 29 July 2026. If you have not enrolled, do so immediately — operating while unenrolled is a breach of the Act.

2. Appoint an AML/CTF Compliance Officer

You must appoint an AML/CTF compliance officer who is responsible for overseeing your program. In a small practice, this will typically be the principal or owner. The compliance officer must be an Australian resident. You must notify AUSTRAC of the appointment within 14 days.

3. Complete Your Risk Assessment and Build Your Program

You must conduct a written ML/TF risk assessment and develop an AML/CTF program tailored to your specific services, clients, delivery channels and countries you deal with. AUSTRAC provides program starter kits for accountants, lawyers and real estate agents to use as a starting point. Your program must include a policy document covering your CDD, reporting, tipping off and offboarding procedures, and a process document with step-by-step procedures for staff to follow.

4. Verify Every Client Before Providing a Designated Service

This is the obligation most businesses will feel most directly in their day-to-day work. Before you provide any designated service, you must complete initial customer due diligence (CDD) on your client. For individuals, this means verifying their name, date of birth and address using reliable and independent sources — typically government database matching combined with document capture and biometric verification. For company and trust clients, you must also identify and verify the beneficial owners: the individuals who ultimately own or control the entity.

5. Report, Monitor and Keep Records

You must report suspicious matters to AUSTRAC within 24 hours (for terrorism financing suspicions) or 3 business days (for all other suspicions). Cash transactions of $10,000 or more must be reported as threshold transaction reports within 10 business days. All CDD records must be kept for a minimum of 7 years. Annual compliance reports must be submitted to AUSTRAC by 30 September each year.

What Happens If You Don't Comply?

The consequences of non-compliance with Tranche 2 obligations are serious. AUSTRAC has broad enforcement powers including civil penalties of up to $18.5 million per breach for corporations, criminal prosecution for serious or wilful non-compliance, enforceable undertakings, and public reporting of enforcement actions — which can cause significant reputational damage.

AUSTRAC has indicated it will take a risk-based approach to enforcement in the early stages of Tranche 2, focusing first on businesses that wilfully ignore their obligations. However, this does not mean low-risk businesses can safely delay. The obligations apply from 1 July 2026, and non-compliance begins from that date.

How to Get Compliant Quickly

For most small and medium professional practices, the compliance journey involves four practical steps. First, enrol with AUSTRAC if you have not already done so. Second, appoint yourself or a senior staff member as compliance officer and notify AUSTRAC. Third, download the relevant program starter kit from AUSTRAC's website and complete your risk assessment, policy and process documents. Fourth, set up your client identity verification process — this is where a platform like VerifyID Online handles the most operationally intensive part of compliance for you.

The identity verification piece — verifying who your client is, screening them for PEP status and sanctions, and storing the results for 7 years — is the daily operational reality of Tranche 2 compliance. With the right platform, it takes under 3 minutes per client and generates a complete, auditable record automatically.