AML Tranche 2 goes live 1 July 2026: the final readiness countdown

Australia's AML/CTF "Tranche 2" obligations commenced on 1 July 2026 and are in force now. Since that date, a large group of newly regulated businesses, broadly professional service providers and high-value dealers, has had to comply with the *Anti-Money Laundering and Counter-Terrorism Financing Act 2006* in the same way banks and remitters already do. AUSTRAC says the regime "expanded on 1 July 2026 to cover tens of thousands of businesses".

This explainer was first published as a pre-commencement countdown. It has been updated (October 2026) to set out who is captured, what AUSTRAC expects during FY26/27, where enrolment stands, and what to do now. Primary sources: AUSTRAC's reform guidance and the AML/CTF Act.

What happened on 1 July 2026

On 1 July 2026, the AML/CTF regime extended to additional "designated services" delivered by professions and dealers that were previously outside the framework. The core obligations that now apply mirror those of existing reporting entities:

• an AML/CTF program: an ML/TF risk assessment plus AML/CTF policies, approved by a senior manager and overseen by the governing body (this replaced the former Part A / Part B structure);
• customer due diligence, identifying and verifying customers and, where relevant, beneficial owners;
• ongoing monitoring of customers and transactions;
• reporting to AUSTRAC: suspicious matter reports (SMRs) within 3 business days of forming a suspicion (24 hours for terrorism financing), and threshold transaction reports within 10 business days;
• record-keeping to evidence the above; and
• independent evaluation of the whole program at least once every 3 years. For newly regulated entities the first evaluation is due between 30 June 2029 and 31 December 2030, depending on the AUSTRAC account number (AUSTRAC Step 5).

A program that exists only on paper, or a risk assessment that has not shaped your customer onboarding, does not meet the standard.

Who is a reporting entity

Whether you are captured depends on the services you provide, not your industry label. The Tranche 2 groups are:

• legal practitioners and conveyancers (for certain transactional services, such as acting in property transfers or managing client money);
• accountants and other professional service providers (for specified financial and transactional services);
• real estate professionals (for buying and selling real estate);
• trust and company service providers; and
• dealers in precious metals and precious stones (above the relevant value threshold).

The dividing line is whether you provide a designated service as defined in the Act. Work through your service lines with the AML Tranche 2 scope tool, then confirm the boundaries against AUSTRAC's guidance for your sector. If you provide even one designated service, you are a reporting entity for that service and the full obligation set follows.

Tranche 2 small businesses are also covered by the Privacy Act for their AML/CTF activities: under s 6E(1A) of the Privacy Act 1988, a small business operator that is an AML/CTF reporting entity is treated as an organisation for those activities.

What AUSTRAC expects in FY26/27

AUSTRAC's May 2026 statement of expectations says it expects "effort, not perfection" from newly regulated businesses during FY26/27. It also says it "will take early enforcement action against businesses who fail to enrol" and against regulated businesses it suspects have been complicit in money laundering.

In practice, AUSTRAC expects newly regulated businesses to:

1. be enrolled on the Reporting Entities Roll;
2. have an AML/CTF program: a documented ML/TF risk assessment and AML/CTF policies. See the AML/CTF program obligation;
3. have designated an AML/CTF compliance officer at management level and notified AUSTRAC. See the AML compliance officer obligation;
4. have trained staff who can recognise red flags and know how to escalate; and
5. be ready to report, including lodging SMRs on time.

AUSTRAC publishes free program starter kits for legal, accounting, conveyancing, real estate and jewellery businesses. They are a starting structure; you still need to tailor the program to your own risk profile.

Enrolment: if you missed 29 July 2026

Enrolment opened on 31 March 2026. A reporting entity must enrol within 28 days of first providing a designated service, which for most Tranche 2 businesses meant 29 July 2026. Enrolment does not "close": a business that starts providing a designated service later must enrol within 28 days of starting.

AUSTRAC began issuing information notices to apparently unenrolled real estate agents, accountants, lawyers and jewellers on 28 August 2026. Its CEO said: "The time for preparation has passed." AUSTRAC media release.

Each day you provide a designated service while unenrolled can be a separate contravention. AUSTRAC can issue an infringement notice of 60 penalty units ($21,840) for a company or 12 penalty units ($4,368) for an individual per contravention, or seek a civil penalty of up to $36.4M for a body corporate or $7.28M for an individual (maximum per contravention). If you have not enrolled, do it now. See the AML/CTF enrolment obligation.

What to do now

• Confirm your scoping. Check exactly which of your services are designated services.
• Enrol if you have not, and notify AUSTRAC of your compliance officer.
• Complete the risk assessment. It must be specific to your customers, services, delivery channels and jurisdictions, not generic.
• Operationalise your AML/CTF policies. Make sure onboarding, verification and monitoring are embedded in how staff work.
• Train staff and schedule the refresh cycle.
• Test customer due diligence end to end on a sample of real onboarding files.
• Set up SMR and threshold reporting so you can report within the deadlines.
• Set your independent evaluation frequency in your policies and diarise your first evaluation date.

For broader context, see the AML/CTF topic hub.

Common pitfalls

• Treating enrolment as compliance. Registering with AUSTRAC is administrative; it does not satisfy your program, due diligence or reporting duties.
• Generic, off-the-shelf programs. Adopting a template without tailoring it to your risk profile is a frequent weakness.
• Legacy structure. A program still written as "Part A / Part B" often misses reformed requirements rather than just using old labels.
• Under-scoping or over-scoping services. Misjudging which services are captured leads to gaps or wasted effort.
• Leaving the compliance officer role nominal. The role needs genuine authority, time and seniority.
• Forgetting beneficial ownership. For many Tranche 2 services, identifying the people behind a customer entity is central.
• Reading "effort, not perfection" as a grace period. It is not one for enrolment: AUSTRAC has said it will act early against businesses that fail to enrol.

Where a specific date, threshold or category affects your business, confirm it directly with AUSTRAC before acting.