Are you an AUSTRAC reporting entity? A plain-English checklist
"Am I a reporting entity?" is the question that decides everything else. If the answer is yes, you have an enrolment, a program, customer checks and seven years of records ahead of you. If it's no, you have nothing to do.
Most owners guess based on their industry. That's the wrong test, and it produces wrong answers in both directions. Here's the actual one.
The test is the service, not the industry
Australia's AML/CTF regime works off a list of designated services. Provide one of them in the course of your business, and you're a reporting entity. Don't, and you're not — regardless of what your ABN says you do.
This matters because two accountants down the same street can land on opposite sides of the line. One does tax returns and payroll. The other registers companies and acts as a trustee. Same profession, different answer.
So the question isn't "am I an accountant / lawyer / agent?". It's "do any of my engagements appear on the list?"
The plain-English checklist
Work through these. One yes is enough.
Money and accounts
Do you hold, manage or transfer money on behalf of a client? (Trust accounts, client money, settlement funds.)
Do you make or receive payments for a client, other than paying your own invoices?
Companies, trusts and structures
Do you form or register companies, partnerships or trusts for clients?
Do you act as, or arrange for someone to act as, a director, secretary, partner or trustee for a client?
Do you provide a registered office, business address or correspondence address for a client's entity?
Do you act as a nominee shareholder, or arrange one?
Property and business transactions
Do you sell, buy or transfer real property on behalf of a client? (Agents, buyer's agents, conveyancers.)
Do you advise on or arrange the buying or selling of a business entity?
Goods
Do you buy or sell precious metals, precious stones or products made from them, above the transaction threshold?
Existing regime
Do you provide remittance, currency exchange, digital currency exchange, lending, or other financial services?
If you ticked nothing, you're likely outside the regime today. Write down why, date it, and revisit it when your services change — that note is worth having if anyone asks later.
Four things people get wrong
"We're too small."
There's no size threshold for most designated services. A sole practitioner is captured on the same basis as a national firm. The obligations scale with your risk, not your headcount.
"Our clients are all long-standing locals."
Low risk isn't the same as out of scope. A low-risk customer base means your due diligence can be simpler — it doesn't mean you skip enrolment or the program.
"We only do it occasionally."
Providing a designated service once, in the course of carrying on a business, is enough. There's no minimum frequency.
"Our software provider handles compliance."
No tool makes you compliant. Tools collect and store evidence. The enrolment, the program, the risk assessment and the decisions are yours.
If you are a reporting entity, here's what follows
Not as scary as it sounds when you lay it out:
Enrol with AUSTRAC. Free registration through AUSTRAC Online. For tranche 2 businesses, enrolment opens 31 March 2026 ahead of the 1 July 2026 start.
Do a risk assessment. Where could your business be used to move dirty money — which customers, which services, which countries, which channels.
Write your AML/CTF program. Your written rules for verification, escalation, training, record-keeping and oversight, signed off by whoever runs the business.
Appoint a compliance officer. A named person. In a small firm, usually the owner.
Verify customers before you serve them. Identity, and for entities, the beneficial owners behind them.
Report and keep records. Suspicious matters to AUSTRAC, threshold transactions where they apply, seven years of records.
Get an independent review. Periodically, someone who didn't write the program checks whether it works.
The bit that decides how painful this is
Steps 1 to 4 are a one-off. Steps 5 and 6 are forever, and they happen on your busiest days — when a new client is signing up and everyone wants to get moving.
If ID collection and record-keeping live in a checklist someone has to remember, they'll be skipped under pressure and you'll find out two years later. If they're built into the onboarding form the client already fills in, they just happen.
That's the whole game: make the compliant path the easy path.
Not sure where you land?
Our free AML Compliance Pack generator walks you through your services and produces a starting risk assessment and program you can read and edit. It takes a few minutes and costs nothing.
If you'd rather we set the whole thing up and wire it into your onboarding, our AML/CTF and client onboarding setup starts at A$999 fixed price. You talk to the person doing the work, and there's no lock-in.
For the legislation itself and AUSTRAC's own guidance, start at austrac.gov.au.
Common questions
Do I enrol before or after I write my program?
Write the program first. Enrolment tells AUSTRAC you're operating under a program — it's not a place to work things out.
What if I'm only captured for part of what I do?
That's normal. Your program covers the designated services you provide, not every service on your price list. Be specific about which is which.
Can I be a reporting entity without knowing it?
Yes, and it's the most common risk for professional services firms. The obligation attaches to the service, so a single engagement outside your usual work can bring you in.
How often do I need to re-check an existing client?
Ongoing due diligence means monitoring, not a fixed calendar. Re-verify when the relationship changes materially — new structure, new beneficial owner, unusual activity, or a shift in risk.