Skip to main content
Rules Mate
PlaybooksBottom-funnel persona playbook

AML/CTF playbook for registered tax agents and accounting firms

Everything a registered tax agent, BAS agent or accounting practice has to do under AML/CTF Tranche 2 from 1 July 2026 — enrolment, AMLCO, the AML/CTF program (ML/TF risk assessment + AML/CTF policies, formerly Part A / Part B), customer due diligence, suspicious matter reports, threshold transaction reports, the annual ACR, tipping-off, record-keeping and training.

19 obligations3 deadlines10 cross-linked articles

Key deadlines — next 12 months

  • 29 July 2026AUSTRAC enrolment deadline (Tranche 2)
  • 31 March 2027First AUSTRAC Compliance Report (ACR)
  • Within 3 business daysLodge any SMR after suspicion formed
  • Within 10 business daysLodge any TTR (cash ≥$10,000) or IFTI

Does this apply to me?

Answer yes to any of the below and the obligations in this playbook are likely relevant.

  • 1Are you a registered tax agent, BAS agent, accountant or bookkeeper providing services in or from Australia?
  • 2Do you provide any designated service under table 6 in section 6(5B) of the AML/CTF Act 2006 — for example: business or trust formation, assisting with the sale or transfer of a business, acting as a nominee director, managing client money, acting as a registered office, or providing trust and company service provider (TCSP) services?
  • 3Do you handle client trust money or directors' loan accounts?
  • 4Do you provide bookkeeping plus payments, or BAS lodgement that involves moving funds on behalf of the client?

Plain English summary

Tranche 2 of the AML/CTF Act commenced on 1 July 2026. Accountants are now reporting entities in the same regulatory regime that has applied to banks and casinos since 2006. Tax-only and BAS-only services are not designated services — but the moment a firm sets up a company, helps sell a business, manages client money, acts as a nominee director or trustee, or does TCSP work, it is captured.

The compliance load is real but proportionate. The AML/CTF Act is principles-based and risk-based: a sole-practitioner doing one business formation a month and a Top-100 firm doing thousands face the same rules but very different programs. AUSTRAC has said it expects "effort, not perfection" from newly regulated businesses during FY26/27 — but it will take early enforcement action against businesses that fail to enrol or are complicit in money laundering, and it began issuing information notices to apparently unenrolled accountants, lawyers, real estate agents and jewellers on 28 August 2026. Enrolment, AMLCO designation, a documented program, staff training and SMR reporting are expected now.

This playbook lists every obligation that applies to a Tranche 2 accounting firm, the section of the AML/CTF Act it sits under, who in the firm is accountable, the frequency, the maximum penalty, and a regulator-direct source. It assumes the standard tax-and-business-services firm — not financial planning (separately AFSL-regulated), not custodial services. Cross-link to the AML Tranche 2 scope checker and beneficial owner identifier for the practical pieces.

The cost of getting this wrong is not just the penalty (civil penalties of up to $36.4M for a body corporate or $7.28M for an individual, maximum per contravention). It is loss of registration with the Tax Practitioners Board (TPB) — a Tranche 2 contravention is a "Code of Professional Conduct" breach that the TPB can act on independently of AUSTRAC.

Obligation checklist

Every obligation cites the Act and section. Source URLs link to the regulator's portal — Rules Mate does not republish statutory text.

  1. 1

    AML/CTF Act 2006, s 51B (enrolment)

    Enrol the firm with AUSTRAC as a reporting entity within 28 days of first providing a designated service. For firms providing designated services from 1 July 2026 that deadline was 29 July 2026 — if you missed it, enrol now.

    Who's responsible
    Managing partner / sole practitioner
    Frequency
    One-off (plus updates within 14 days of material change)
    Penalty
    Each day unenrolled can be a separate contravention. Infringement notice of 60 penalty units ($21,840) for a company or 12 penalty units ($4,368) for an individual per contravention, or a civil penalty of up to $36.4M (body corporate), maximum per contravention.
    Full obligation page →
  2. 2

    AML/CTF Act Part 1A (AML/CTF programs); AML/CTF Rules 2025

    Document an ML/TF risk assessment of the firm's risk by customer type, channel, jurisdiction and service, and AML/CTF policies that mitigate and manage those risks (the reformed structure that replaced the former Part A / Part B program). Approved by the governing body or principal of the firm.

    Who's responsible
    Board / managing partner
    Frequency
    Ongoing; update the risk assessment on significant change
    Penalty
    Civil penalty up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention.
    Full obligation page →
  3. 3

    AML/CTF Act Part 2 (customer due diligence); AML/CTF Rules 2025

    Document customer due diligence procedures in your AML/CTF policies (formerly the Part B program): customer identification (individuals, companies, trusts, partnerships), beneficial owner identification (≥25% control or ownership), source-of-wealth + source-of-funds checks for higher risk, ongoing customer due diligence, transaction monitoring rules.

    Who's responsible
    AMLCO + client onboarding partners
    Frequency
    Ongoing
    Penalty
    Each unverified customer can be a separate civil penalty contravention; up to $36.4M (body corporate), maximum per contravention.
    Full obligation page →
  4. 4

    AML/CTF Rules Part 4.13 (PEPs)

    Screen every customer + beneficial owner against politically exposed persons (foreign, domestic, international organisation) lists. PEPs trigger Enhanced Customer Due Diligence: senior-management approval, source-of-wealth, source-of-funds and ongoing review.

    Who's responsible
    AMLCO
    Frequency
    At onboarding + on customer-risk change
    Penalty
    Civil penalty regime to AML/CTF Act maximum.
    Full obligation page →
  5. 5

    Charter of the United Nations Act 1945 + Autonomous Sanctions Act 2011

    Screen every customer + beneficial owner against the DFAT Consolidated List of sanctioned persons and entities before providing a designated service.

    Who's responsible
    AMLCO
    Frequency
    At onboarding + ongoing (DFAT list updated weekly)
    Penalty
    Criminal — up to 10 years imprisonment; strict liability for the conduct.
    Full obligation page →
  6. 6

    AML/CTF Act 2006, ss 41-42 (SMR — suspicious matter reports)

    Lodge an SMR via AUSTRAC Online within 3 business days of forming a suspicion (24 hours for terrorism financing). Document the suspicion-formation reasoning in a file note before lodging.

    Who's responsible
    AMLCO (with input from engagement partner)
    Frequency
    Event-driven
    Penalty
    Failure to report: civil penalty up to $36.4M (body corporate), maximum per contravention. Tipping off the customer about the report is a separate criminal offence (up to 2 years imprisonment and/or 120 penalty units).
    Full obligation page →
  7. 7

    AML/CTF Act 2006, s 43 (TTR — threshold transaction reports)

    Lodge a TTR within 10 business days for any cash transaction of AUD 10,000 or more (including the foreign currency equivalent). Note: tax agents handling client money in trust accounts will trigger TTR obligations.

    Who's responsible
    AMLCO
    Frequency
    Event-driven
    Penalty
    Civil penalty up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention.
    Full obligation page →
  8. 8

    AML/CTF Act 2006, ss 45-46 (IFTI — international funds transfer instructions)

    Lodge an IFTI report within 10 business days of instructing or receiving an international funds transfer on behalf of a client. Most accountants do not directly handle IFTIs, but trust-account remittances overseas do trigger this.

    Who's responsible
    AMLCO
    Frequency
    Event-driven
    Penalty
    Civil penalty up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention.
  9. 9

    AML/CTF Act 2006, s 47 (ACR — annual compliance report)

    Lodge the AUSTRAC Compliance Report (ACR) covering the prior calendar year by 31 March each year. The ACR self-attests to enrolment, program, training, independent evaluation and CDD posture.

    Who's responsible
    AMLCO
    Frequency
    Annual — calendar-year basis, lodged by 31 March
    Penalty
    Failure to lodge: civil penalty + AUSTRAC remediation directions.
  10. 10

    AML/CTF Act 2006, s 36 (ongoing customer due diligence)

    Apply ongoing customer due diligence including transaction monitoring, periodic re-verification, and trigger-based review (PEP status change, change of beneficial owners, suspicious activity).

    Who's responsible
    AMLCO + client engagement partner
    Frequency
    Ongoing
    Penalty
    Civil penalty regime to AML/CTF Act maximum.
  11. 11

    AML/CTF Act 2006, s 36 + AML/CTF Rules Part 15 (Enhanced Customer Due Diligence)

    Apply Enhanced CDD for higher-risk customers: PEPs, complex ownership structures, high-risk jurisdictions, customers refusing to provide information. Document senior-approval decisions.

    Who's responsible
    AMLCO
    Frequency
    Event-driven (on identification of higher risk)
    Penalty
    Civil penalty regime to AML/CTF Act maximum.
  12. 12

    AML/CTF Act 2006, s 123 (tipping-off offence)

    Do not disclose to the customer or any other person that an SMR has been lodged or is being prepared, that AUSTRAC has been notified, or that information has been requested by AUSTRAC.

    Who's responsible
    Every employee + partner
    Frequency
    Continuous
    Penalty
    2 years imprisonment and/or 120 penalty units ($43,680).
  13. 13

    AML/CTF Act 2006, Part 10 (record-keeping)

    Keep KYC records, transaction records, SMR working papers, training records and program documents for 7 years after the customer relationship ends or the transaction occurred.

    Who's responsible
    AMLCO + practice manager
    Frequency
    Continuous (7-year retention)
    Penalty
    Civil penalty up to $36.4M (body corporate) or $7.28M (individual), maximum per contravention.
  14. 14

    AML/CTF Act Part 1A (independent evaluation); AML/CTF Rules 2025

    Arrange an independent evaluation of the whole AML/CTF program (risk assessment and policies) at least once every 3 years, at a frequency set in your AML/CTF policies. The evaluator can be internal or external but must be independent of the people who developed the program. For newly regulated firms the first evaluation is due between 30 June 2029 and 31 December 2030, depending on the last two digits of the AUSTRAC account number.

    Who's responsible
    Board / managing partner (commission), AMLCO (manage delivery)
    Frequency
    At least once every 3 years (frequency set in your policies)
    Penalty
    Civil penalty regime to AML/CTF Act maximum ($36.4M body corporate, maximum per contravention).
    Full obligation page →
  15. 15

    AML/CTF Rules Part 8.2 (AML/CTF Compliance Officer)

    Designate an AML/CTF Compliance Officer (AMLCO) employed or engaged at management level, who is a fit and proper person with the authority, independence and resources to discharge the function, and notify AUSTRAC (Tranche 2: by the later of 29 July 2026 or 14 days after enrolling). Check AUSTRAC's compliance officer guidance before outsourcing any part of the role — outsourcing does not transfer liability. Sole practitioners will usually designate themselves.

    Who's responsible
    Board / managing partner
    Frequency
    Continuous; reappoint on departure
    Penalty
    Civil penalty regime to AML/CTF Act maximum; AUSTRAC remediation.
    Full obligation page →
  16. 16

    AML/CTF Rules Part 8.5 (employee due diligence)

    Screen employees who will perform AML/CTF functions or have access to customer data. Police checks where the role warrants. Document the EDD framework.

    Who's responsible
    AMLCO + HR
    Frequency
    Pre-employment + role change
    Penalty
    Civil penalty regime to AML/CTF Act maximum.
  17. 17

    AML/CTF Rules Part 8.3 (AML/CTF training)

    Deliver AML/CTF training to every employee in a customer-facing role + every partner + AMLCO. Annual refresher. Record attendance and content.

    Who's responsible
    AMLCO
    Frequency
    On hire, then annual
    Penalty
    Civil penalty regime to AML/CTF Act maximum.
  18. 18

    AML/CTF Act 2006, s 41A (beneficial owner identification)

    Identify and verify every beneficial owner — natural persons with ≥25% ownership or control of a non-individual customer. For complex structures, identify the ultimate natural-person controllers.

    Who's responsible
    AMLCO + onboarding partner
    Frequency
    At onboarding + on structural change
    Penalty
    Each unverified beneficial owner is a separate breach.
  19. 19

    Tax Agent Services Act 2009, Code of Professional Conduct (TPB)

    Comply with the Code of Professional Conduct: act honestly and with integrity, comply with taxation laws, exercise reasonable care. The TPB treats serious AML/CTF breaches as Code breaches.

    Who's responsible
    Every registered tax agent + BAS agent
    Frequency
    Continuous
    Penalty
    Termination of registration; civil penalties up to $1,820,000 for body corporates (TPB).

Deadlines

Pulled from the Rules Mate compliance calendar. Click through for the full deadline page.

Forms and regulator portals

Direct links to the lodgement forms and regulator portals. Rules Mate does not host copies — we link to the official source.

  • AUSTRAC Online enrolment form

    Web-based enrolment for reporting entities. Required within 28 days of first designated service.

    Open portal →

  • Suspicious Matter Report (SMR)

    Lodged via AUSTRAC Online. 3 business days from suspicion formation (24 hours terrorism financing).

    Open portal →

  • Threshold Transaction Report (TTR)

    Lodged via AUSTRAC Online. 10 business days for cash transactions ≥AUD 10,000.

    Open portal →

  • International Funds Transfer Instruction (IFTI)

    Lodged via AUSTRAC Online. 10 business days from instruction or receipt.

    Open portal →

  • AUSTRAC Compliance Report (ACR)

    Annual self-attestation. Due 31 March each year, covering the prior calendar year.

    Open portal →

Free tools that help

Interactive Rules Mate tools matched to this persona.

AML Tranche 2 scope checker

Use tool →

Beneficial owner identifier

Use tool →

Compliance calendar builder

Use tool →

Penalty estimator

Use tool →

What changes 2025–2026

31 March 2026 — AUSTRAC enrolment opened

Tranche 2 entities could enrol on AUSTRAC Online from 31 March 2026.

1 July 2026 — Tranche 2 commenced

The AML/CTF Amendment Act 2024 extended the regime to accountants, lawyers, conveyancers, real estate agents, TCSPs and precious-metals dealers. Obligations are in force now; the ML/TF risk assessment must be in place before a designated service is provided.

29 July 2026 — Enrolment deadline (passed)

A Tranche 2 entity that provided a designated service from 1 July 2026 had to enrol by 29 July 2026; a firm that starts later has 28 days from its first designated service. Each day a designated service is provided while unenrolled can be a separate contravention — AUSTRAC can issue an infringement notice ($21,840 for a company, $4,368 for an individual, per contravention) or seek a civil penalty of up to $36.4M per contravention.

28 August 2026 — Notices to unenrolled businesses

AUSTRAC began issuing information notices to apparently unenrolled accountants, lawyers, real estate agents and jewellers: "The time for preparation has passed."

FY26/27 — "Effort, not perfection"

AUSTRAC expects newly regulated businesses to be enrolled, have an AML/CTF program and compliance officer, train staff and be ready to report. It expects effort, not perfection, in FY26/27, but will take early enforcement action against failure to enrol and complicity in money laundering.

31 March 2027 — First ACR

The first AUSTRAC Compliance Report for Tranche 2 entities covers H2 2026 and is due 31 March 2027.

30 June 2029 – 31 December 2030 — First independent evaluation

Newly regulated entities' first independent evaluation of the whole program is due on one of four dates in this window, set by the last two digits of the AUSTRAC account number. After that, at least once every 3 years.

In-depth reading

10 Rules Mate articles tagged to this playbook.

Frequently asked

Are tax-only and BAS-only services captured by Tranche 2?

No. Pure tax compliance (preparation and lodgement of returns) and pure BAS lodgement are not designated services under table 6 in section 6(5B) of the AML/CTF Act 2006. The moment a firm sets up a company, helps sell or transfer a business, acts as a registered office or nominee director, or manages client money, it is captured. The AUSTRAC designated services map is the definitive source.

Can a sole practitioner be their own AMLCO?

Yes. The AMLCO must be employed or engaged at management level and be a fit and proper person with sufficient authority. For a sole practitioner that is usually the sole practitioner. Document the designation in your AML/CTF policies, notify AUSTRAC, and put a succession plan in place for incapacity.

Does the Privacy Act apply to a small accounting firm's AML/CTF work?

Yes. Under s 6E(1A) of the Privacy Act 1988, a small business operator that is an AML/CTF reporting entity is treated as an organisation for its AML/CTF activities — so the Australian Privacy Principles apply to the KYC and other personal information you handle for AML/CTF purposes, even if your turnover is under $3M. Source: https://www.legislation.gov.au/C2004A03712/latest/text

Do I have to verify a beneficial owner's identity even if I already know them personally?

Yes. The AML/CTF Act requires verification, not just knowledge. Reasonable measures of verification must be documented — government-issued ID is the default. The risk-based approach allows simplified verification in lower-risk cases, but only if the customer + product + delivery channel are all low-risk and the firm has documented why.

What penalty does AUSTRAC actually apply for small firms?

The statutory maximum is $36.4M for a body corporate or $7.28M for an individual, per contravention. AUSTRAC has said it expects "effort, not perfection" from newly regulated businesses in FY26/27, but will take early enforcement action against businesses that fail to enrol or are complicit in money laundering. It began issuing information notices to apparently unenrolled businesses on 28 August 2026, and infringement notices ($21,840 per contravention for a company) are available for failures such as not enrolling. Treat the maximum as the worst case; treat enrolment, a documented program and a designated AMLCO as the minimum AUSTRAC expects now.

How does Tranche 2 interact with TPB Code of Professional Conduct obligations?

A serious AML/CTF contravention is treated by the Tax Practitioners Board as a Code of Professional Conduct breach (notably the obligation to comply with taxation laws and the obligation to act honestly). The TPB can act on a Code breach independent of any AUSTRAC enforcement. In practice, AML/CTF risk has become a TPB risk for registered tax and BAS agents.

What records does AUSTRAC actually ask for in a desk audit?

Typically: enrolment confirmation; the ML/TF risk assessment and AML/CTF policies with governing body / principal approval; CDD procedures with sample customer files; the AMLCO designation and AUSTRAC notification; training records (attendees + content); independent evaluation report (once due); SMR and TTR logs with redacted samples; and the ACR submission.

Are we exempt if all our clients are existing pre-1 July 2026 relationships?

No exemption — but transitional rules allow ongoing CDD on existing clients to be completed within a reasonable period based on risk. New designated services to those clients after 1 July 2026 trigger full CDD obligations. Document the transition plan in your AML/CTF policies.

Free assessment

Get a personalised obligation list

2-minute structured check tailored to your business.

AI advisor (waitlist)

Ask any compliance question

Coming Phase 2 — grounded answers with citations.

Last verified: 6 June 2026

Rules Mate provides citation-first reference material, not legal advice. Always consult a qualified professional for specific obligations.