Tranche 2 AML in Australia: what changes on 1 July 2026
If you run an accounting practice, a law firm, a real estate agency or a buyer's agency in Australia, you're about to be pulled into a set of rules that used to apply only to banks and casinos. It's called Tranche 2, and the start date is 1 July 2026.
Most owners we talk to have heard the words and nothing else. So here's the plain-English version: what's changing, who's captured, what you actually have to do, and how long it takes.
What Tranche 2 actually is
Australia has had anti-money laundering laws since 2006. Until now they covered banks, remittance providers, casinos and bullion dealers — the "tranche 1" businesses.
The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 extends the same regime to a second group: professional services businesses that handle money, property and company structures for clients. That's the tranche 2 group. It's the biggest expansion of the regime since it started, and it brings tens of thousands of small Australian businesses into scope for the first time.
The reason is boring but real: Australia was one of the last developed economies not to cover these sectors, and the Financial Action Task Force had flagged it for years. The law caught up.
Who's captured
Under the reforms, you're likely in scope if you provide any of these as a business:
Accounting and bookkeeping services — setting up companies or trusts, acting as a nominee, managing client money, or advising on the buying and selling of businesses
Legal and conveyancing services — the same list of "designated services", not general legal advice
Real estate — selling, buying or transferring real property on behalf of a client, including buyer's agents
Trust and company service providers — forming companies, providing registered office addresses, acting as director or trustee for a client
Dealers in precious metals and stones — above the transaction threshold
Two things owners get wrong here.
First, it's the service that's captured, not the industry. An accountant doing nothing but tax returns and BAS may not provide a designated service at all. The same accountant who registers a client's company or acts as a trustee almost certainly does. Read the service list, not the job title.
Second, there's no small-business exemption. A sole trader conveyancer is captured on the same terms as a 200-person firm. What changes is how much you have to build, not whether you're in.
The dates that matter
31 March 2026 — enrolment with AUSTRAC opens for tranche 2 businesses, and the reformed obligations begin for businesses already in the regime
1 July 2026 — tranche 2 obligations start. From this date you need to be enrolled, have your AML/CTF program in place, and be running customer checks
That's the deadline, not the start line. AUSTRAC has been clear that the program needs to exist and be working from day one — not be "in progress".
What you actually have to do
Strip out the legislation and there are five practical jobs.
1. Enrol with AUSTRAC
A registration, not an application. You give AUSTRAC your business details and the designated services you provide. It's free and it's the easy part.
2. Write a risk assessment
A documented view of where your business could be used to move dirty money — by customer type, the services you offer, the countries you deal with and the channels you use (face-to-face versus online). This is the document everything else hangs off. If your risk assessment is generic, your whole program is generic.
3. Write an AML/CTF program
Your rules, in writing: how you verify customers, when you escalate, who signs off, how staff are trained, how records are kept. It has to be approved by your governing body — for most small firms that's the owner or the partners.
4. Run customer due diligence
Verify who your customer is before you provide the service. For companies and trusts, that means working out who's really behind them — the beneficial owners. Higher-risk customers get more checks. Everyone gets re-checked when something changes.
5. Report and keep records
Suspicious matter reports to AUSTRAC when something doesn't smell right, threshold transaction reports for large cash movements, and seven years of records for everything you did and why.
The honest picture on effort
For a small firm, the writing is a week or two of work if you know what you're doing, and a lot longer if you're starting from a Google search. The ongoing part is what catches people out: every new client now needs an ID check that's documented, filed and retrievable years later.
That's where the manual approach falls apart. A PDF program in a folder and a shoebox of licence photocopies technically ticks the box until someone asks you to produce the file for a client you onboarded in 2027. The firms that handle this well build it into onboarding once and stop thinking about it.
What we'd do first if we were you
You don't need to solve all of it this quarter. In order:
Work out if you're captured. Read the designated services list against what you actually do and write down the answer.
Draft your risk assessment. Everything else depends on it, and it forces the useful thinking.
Fix onboarding before you fix paperwork. If ID collection, verification and record-keeping happen automatically when a client signs up, the compliance part looks after itself.
Then enrol when enrolment opens in March 2026.
Get a head start
We built a free AML Compliance Pack generator that asks you about your business and produces a starting risk assessment and program document you can actually read. No cost, no call required.
If you'd rather have the whole thing set up and wired into the tools you already use — your CRM, your document storage, your client onboarding forms — that's our AML/CTF and client onboarding setup, from A$999 fixed price.
Either way, start before March. The firms that leave it to June 2026 will be paying rush prices for the same work.
Common questions
Does Tranche 2 apply to me if I only do tax returns?
Probably not. Preparing tax returns and BAS on its own isn't generally a designated service. Setting up companies or trusts, acting as a nominee director or trustee, managing client money, or advising on business sales usually is. Check the service list against your actual engagements.
What happens if I'm not ready by 1 July 2026?
You'd be providing a designated service without being enrolled and without a compliant program, which is a breach. AUSTRAC has signalled an education-first approach for newly captured sectors early on, but that's not a grace period you can plan around.
Do I need a full-time compliance officer?
No. You need a named AML/CTF compliance officer, and in a small firm that's usually the owner or a senior staff member wearing another hat. The role has to be real, not decorative.
Is a template program enough?
A template is a fine starting point and a poor finishing point. The risk assessment has to reflect your actual customers and services. A program that could belong to any firm in the country is the first thing a reviewer will pick up on.