AUSTRAC enrolment for Tranche 2: step-by-step (and what to do if you missed 29 July)

Who needs to enrol

From 1 July 2026, AUSTRAC's reporting-entity register extends from financial services to five new "designated service" categories under Tranche 2:

1. Real estate agents — buying, selling, leasing or property-management services where you handle client funds or are involved in transactions of real estate
2. Lawyers + conveyancers — providing any of the 7 listed designated services (real estate, business or company-formation transactions, trust establishment, managing client trust accounts, etc.)
3. Accountants + tax advisers — managing client money or assets, company or trust formation, buying/selling business entities, providing registered office or nominee services
4. Trust + company service providers (TCSPs) — company formation + registration, trust establishment, registered agent services, nominee director/shareholder
5. Precious metals + stones dealers — transactions ≥ AUD $10,000 in physical currency for precious metals, stones, or related products

If you provide any of these services, you need to enrol with AUSTRAC during the enrolment window. The Tranche 2 scope checker confirms whether your specific services trigger the obligation.

Key dates

Enrolment is due 28 days after you first provide a designated service. Each day you provide a designated service while unenrolled can be a separate contravention: AUSTRAC can issue an infringement notice of $21,840 (company) or $4,368 (individual) per contravention, or seek a civil penalty of up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention (AUSTRAC).

What you need before you start

Enrolment is free and lodged through AUSTRAC Online. Have these ready:

• Entity details — ABN, ACN, business name, registered office, principal place of business
• Beneficial owner details — full name + DOB for every person with ≥25% ownership or control (≥5% for politically-exposed-person screening)
• AML/CTF Compliance Officer — full name + position + contact (must be a senior employee or external consultant with sufficient authority)
• Bank account details — for any AUSTRAC fees + transaction reporting linkage
• Service categories you provide — pick from AUSTRAC's designated-service list
• Estimated transaction volumes — rough monthly figures for cash transactions ≥$10K, international transfers, and customer onboarding
• Your AML/CTF program (ML/TF risk assessment + AML/CTF policies, the reformed structure that replaced the former Part A / Part B) — drafted, dated, approved

If you don't have a program drafted yet, start with the AUSTRAC starter program template for your sector (available from the AUSTRAC Tranche 2 reform page).

Step-by-step

1. Create your AUSTRAC Online account — register a primary user; multi-user access via "additional contact" roles
2. Lodge the enrolment form — entity, contact, services, estimated volumes
3. Nominate your Compliance Officer — they receive a separate AUSTRAC login linking to your entity
4. Have your AML/CTF program ready — ML/TF risk assessment and AML/CTF policies (including CDD procedures)
5. Confirm beneficial ownership — name + DOB for every ≥25% beneficial owner
6. Receive your AUSTRAC reporting-entity number (RE#) — typically same-day for complete applications
7. Test your reporting access — log into AUSTRAC Online, confirm you can submit a test SMR/TTR

After enrolment

From the day you enrol — or from 1 July 2026, whichever is later — you're a reporting entity. That means:

• Conduct CDD before providing a designated service to any new customer (collect + verify identity, beneficial ownership, PEP screening)
• Monitor transactions for suspicious activity
• File SMRs within 3 business days of forming a suspicion (24 hours for terrorism financing) — via AUSTRAC Online
• File TTRs within 10 business days for any cash transaction ≥ $10,000
• File IFTIs within 10 business days for international funds transfer instructions you handle
• Retain all CDD + transaction records for 7 years
• Provide ongoing training to all relevant staff
• Have your whole program independently evaluated at least once every 3 years (first evaluation due 30 June 2029 – 31 December 2030 for newly regulated entities)
• Privacy Act — as an AML/CTF reporting entity you are covered by the Privacy Act for your AML/CTF activities even under $3M turnover (Privacy Act 1988 s6E(1A))

Common mistakes

• Treating enrolment as the finish line — enrolment is the START. The Program, CDD, monitoring and reporting all need to operate from 1 July 2026.
• Missing the Compliance Officer authority requirement — the CO needs actual authority to escalate breaches and stop transactions. A junior staff member won't pass AUSTRAC review.
• Skipping beneficial ownership — AUSTRAC has signalled BO failures will be a key audit focus. Don't list only the directors when there are silent partners or trust beneficiaries.
• Confusing AML/CTF Program with a Privacy Policy — they're separate documents with different requirements. The AML Program is a risk-based compliance framework, not a customer notice.
• Tipping off — telling a customer you've filed an SMR about them is a separate criminal offence under s 123 of the AML/CTF Act. Penalties: up to 2 years imprisonment and/or 120 penalty units ($43,680) per offence.

For the full Tranche 2 picture — scope checker, program template guidance, sector-specific obligations, related enforcement actions — visit the AML Tranche 2 hub.