AUSTRAC AML compliance for small business: the honest 2026 guide
If you're an accountant, lawyer, real estate agent, conveyancer, bookkeeper or trust and company service provider in Australia — the rules just changed. From 1 July 2026, you're officially a 'Tranche 2' reporting entity under the AML/CTF Act. That means AUSTRAC enrolment, a written program, customer due diligence, transaction monitoring and suspicious matter reports. Miss the deadline and the fines are eye-watering.
This is the plain-English guide we wish existed when clients started ringing us in a panic. No jargon. No 40-page PDF. Just what you need to do, by when, and how to get it sorted without hiring a compliance officer.
The short version
From 1 July 2026, ~90,000 new Australian businesses need to comply with AML/CTF laws.
You must enrol with AUSTRAC before you provide a 'designated service'.
You need a written AML/CTF program, KYC on every client, and ongoing monitoring.
Penalties reach A$33 million per contravention for companies. Directors can be personally liable.
Most small firms can be compliant in 2–4 weeks with the right templates and a bit of software.
Who's affected (Tranche 2 in plain English)
The AML/CTF Amendment Act 2024 brings a bunch of professions into the regime for the first time. If you provide any of these 'designated services', you're in:
Accountants & bookkeepers — setting up companies/trusts, acting as a nominee, managing client money, buying/selling real estate on a client's behalf.
Lawyers & conveyancers — real estate transactions, managing client funds, forming companies, acting as a trustee.
Real estate agents — buying and selling real estate for a client (both sides — buyer's and seller's agent).
Trust and company service providers — company formation, registered office, nominee director/shareholder services.
Dealers in precious metals & stones — any cash transaction A$10,000 or more.
Rule of thumb: if you handle client money, help move property or set up legal structures, assume you're in. Then check with AUSTRAC.
The 6 things you actually have to do
Enrol with AUSTRAC — free, online, before you provide your first designated service after 1 July 2026.
Do an ML/TF risk assessment — a written document identifying your customers, services, delivery channels and jurisdictions. It doesn't need to be 50 pages. Ours are usually 4–6.
Write an AML/CTF program — Part A (how you manage risk) and Part B (how you identify customers). This is the big one, but it's a template job — you don't need to write it from scratch.
Verify every new customer — full name, DOB, address, and for companies: ABN/ACN, beneficial owners. Electronic verification (Green ID, FrankieOne, IDVerse) makes this a 60-second step.
Monitor and report — flag unusual transactions, submit Suspicious Matter Reports (SMRs) within 3 business days, Threshold Transaction Reports (TTRs) for cash A$10k+.
Train your team & review annually — everyone who deals with customers needs AML training. Refresh the program at least once a year.
The timeline: what to do, by when
Now – March 2026: Do a scoping call. Confirm which of your services are 'designated'. Pick your ID verification provider.
April – May 2026: Draft your risk assessment and AML/CTF program. Set up your customer onboarding forms.
June 2026: Train the team. Test your process with a few live clients. Enrol with AUSTRAC.
1 July 2026: Compliance obligations start. From this date, every new designated service = full KYC + monitoring.
Ongoing: Annual program review, ongoing customer due diligence, SMR/TTR reporting as needed.
Do not leave this until June. The good compliance software providers and consultants will be booked out. The panic-hire market in Q2 2026 is going to be brutal.
What it costs (real numbers, not scare tactics)
For a small firm (1–20 staff), a realistic compliance budget looks like:
Setup: A$1,500 – A$4,000 one-off — risk assessment, program document, onboarding forms, training deck. This is what we charge for our AML Compliance Setup.
ID verification software: A$2 – A$5 per check — pay-as-you-go, no lock-in. Most small firms spend under A$100/month.
Ongoing: A$0 – A$300/month — self-managed is free (just your time). We offer a light-touch review + SMR-on-demand plan for firms that want backup.
Compare that to the alternative: a A$33 million penalty ceiling, or a A$3,000+/month retainer with a compliance consultancy. For most small firms, a fixed-price setup + a good bit of software is 90% of what you need.
The 5 mistakes we see most often
Waiting for AUSTRAC to send a letter. They won't. Enrolment is your responsibility.
Copying a program off the internet. Generic templates get picked apart in an audit. Yours needs to reflect your actual clients and services.
Skipping the risk assessment. It's the foundation of the whole program. Without it, everything else is guesswork.
Not training the front desk. AUSTRAC audits love asking receptionists what they do if a client tries to pay $20k cash. If they can't answer, you fail.
No documentation. If it isn't written down, it didn't happen. Keep records for 7 years.
How we help — AML Compliance Setup
We built our AML Compliance Setup service specifically for small AU firms getting caught by the 2026 reforms. It's a fixed-price job — no retainers, no lock-in, no compliance-consultant-speak.
Core setup — A$999 fixed. Risk assessment, AML/CTF program (Part A + B), customer onboarding forms, staff training deck, AUSTRAC enrolment checklist. Delivered in 2 weeks.
Custom setup — from A$1,999. Everything above, plus we wire the KYC into your existing systems (Xero, Karbon, FYI, Actionstep, MYOB, PropertyMe, whatever you use).
Ongoing support — from A$300/month. We keep the program up to date, help with SMRs, run your annual review, and stay on the phone when AUSTRAC comes knocking.
You talk to Anton directly. Fixed price. No lock-in. If you'd rather DIY the whole thing, we'll happily send you the template list — we'd rather you be compliant than pay us.
FAQ
Do I really need to enrol before I provide a service?
Yes. AUSTRAC enrolment must be complete before you provide your first designated service after 1 July 2026. Enrolment is free and takes about 20 minutes online.
What if I only occasionally provide a designated service?
Doesn't matter — one designated service is enough to trigger the whole regime. If you're not sure, err on the side of enrolling. It's free and low-risk.
Can I use my existing client onboarding process?
Partly. You'll need to layer AML-specific verification (electronic ID, beneficial owner checks, source-of-funds questions) on top of what you already do. Most firms bolt this onto their engagement letter workflow.
What's the difference between KYC and AML?
KYC (Know Your Customer) is the identity-verification part. AML (Anti-Money Laundering) is the broader program — risk assessment, monitoring, reporting, training. KYC is one piece of AML.
What happens if I get it wrong?
Civil penalties up to A$33 million per contravention for companies, up to A$1.65 million for individuals. AUSTRAC has publicly said it will focus on education for the first 12 months for Tranche 2 entities that are trying to comply — but 'trying' means enrolled, with a program in place. Doing nothing is not a defence.
How long does the setup actually take?
For a small firm with clean workflows: 2–4 weeks end-to-end. That's risk assessment, program document, onboarding forms, training, AUSTRAC enrolment. We've done a full setup in 10 business days when the client was organised.
Get sorted before the rush
The last 3 months before a compliance deadline are always the worst. Prices go up, good help disappears, and the AUSTRAC portal usually crashes. Get moving now — even if you don't build with us, get something on paper by Easter 2026.
Book a free 30-min AML compliance call — we'll tell you honestly whether you're in scope, what you need, and roughly what it'll cost. No pitch, no pressure.