- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
AML/CTF Rules 2025: what changed for existing reporting entities
The AML/CTF Rules 2025 took effect for existing reporting entities on 31 March 2026. Existing reporting entities now run an updated program and the new ongoing CDD obligations, with until 31 March 2029 to move initial CDD across.
- The Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 were registered on 29 August 2025 and give the detail for the obligations in the amended AML/CTF Act 2006.
- For businesses already regulated by AUSTRAC, the updated program, due diligence and value transfer obligations started on 31 March 2026, unless the transitional rules defer them.
- Existing reporting entities may keep using their old customer identification procedures (ACIP) for initial CDD until 31 March 2029, but only under documented transitional policies that had to be in place by 1 July 2026.
- The new ongoing CDD obligations apply to every customer from 31 March 2026, with no transition period.
- The same Rules govern Tranche 2 businesses, whose obligations started on 1 July 2026.
What the AML/CTF Rules 2025 are
The AML/CTF Rules are legislative instruments made by the AUSTRAC CEO under the AML/CTF Act 2006. The Act sets the broad obligations. The Rules fill in the detail: what a program must contain, what initial and ongoing customer due diligence (CDD) involves, what goes in reports and what records to keep.
The AML/CTF Rules 2025 (F2025L01026) were made to support the AML/CTF Amendment Act 2024, which Parliament passed on 29 November 2024. AUSTRAC made targeted amendments in March 2026 (F2026L00354), including an opt-out model for reporting groups and changes to CDD for real estate transactions. Always read the latest compilation on the Federal Register of Legislation.
The reforms move the regime toward outcomes. Instead of following a fixed identification procedure, a business must establish set matters about each customer on reasonable grounds, in a way that suits that customer's money laundering and terrorism financing (ML/TF) risk, and keep records of how it reached each conclusion. This page covers the change for existing reporting entities. For lawyers, accountants, conveyancers, real estate agents and other newly regulated businesses, see the Tranche 2 hub.
Who it applies to
AUSTRAC calls them existing or current reporting entities: businesses that were enrolled with AUSTRAC before the reforms. The transitional relief described here generally depends on being enrolled on 30 March 2026.
- Banks, credit unions and other lenders
- Remittance service providers
- Financial advisers and other financial services businesses already providing designated services
- Bullion dealers
- Gambling service providers
- Digital currency exchanges, now registered as virtual asset service providers
Newly regulated Tranche 2 businesses use the same Rules from 1 July 2026, but they cannot rely on the ACIP transition, because they had no pre-reform identification procedures to keep using.
What you have to do
AUSTRAC says your core responsibilities stay the same: manage ML/TF risk, keep an effective AML/CTF program and report suspicious matters. What changed is how the Rules expect you to show it. If you cannot meet an updated obligation on time, AUSTRAC expects a documented implementation plan that explains the gaps and how you will close them.
- Update enrolment and confirm your compliance officer
Businesses enrolled on or before 30 March 2026 must update their enrolment details in AUSTRAC Online. Existing reporting entities had until 30 May 2026 to notify AUSTRAC of their AML/CTF compliance officer.
One-off - Bring the AML/CTF program up to the new standard
Review your ML/TF risk assessment, AML/CTF policies and governance against the 2025 Rules. AUSTRAC's program guidance sets steps for governance (governing body, senior manager, compliance officer), risk assessment, policies, review and independent evaluation.
Program governance - Document your initial CDD transition
To keep using ACIP, you had to list by 1 July 2026 the classes of customers it applies to and the date each class moves to the new initial CDD. Each class can only follow one approach at a time, and every class must move by 31 March 2029.
Policy decision - Run initial CDD on the new model
Under section 28 of the Act, before providing a designated service you must establish on reasonable grounds who the customer is, who acts for them, any beneficial owners, and the purpose of the relationship. You verify KYC information with reliable and independent data appropriate to the customer's risk.
- Screen for PEPs and targeted financial sanctions
Initial CDD includes establishing whether the customer, its beneficial owners or anyone acting for it is a politically exposed person or designated for targeted financial sanctions.
- Rate customer risk and apply enhanced CDD
Identify each customer's ML/TF risk and collect KYC information to match. Higher risk means enhanced CDD, including source of funds and source of wealth where required.
- Apply the new ongoing CDD to every customer
The ongoing CDD obligations started on 31 March 2026 for all customers, including those first identified under ACIP. That means monitoring for unusual transactions and behaviour and keeping KYC information and risk ratings current.
What firms get wrong
Most errors come from reading the 2029 date as a general extension. It is narrow.
Only initial CDD has a transition. AUSTRAC's transitional rules guidance says the new ongoing CDD obligations apply to all customers from 31 March 2026, and other CDD reforms apply from that date too.
It is conditional. You must have been enrolled on 30 March 2026, keep ACIP that complied with the old Rules, and have had transitional policies listing customer classes and transition dates in place by 1 July 2026.
AUSTRAC says you cannot use the new deemed compliance or delayed CDD provisions for services provided in Australia until you have moved to the new initial CDD framework.
The OAIC says the AML/CTF Act does not require scanned copies or photocopies of identity documents for record keeping from 31 March 2026 for existing entities. Keep the details you need and the date you checked them, and destroy or de-identify copies you no longer need.
What happens when
- In force
Parliament passes the AML/CTF Amendment Bill 2024 Source
- In force
AML/CTF Rules 2025 registered (F2025L01026) Source
- In force
Updated obligations start for existing reporting entities, including ongoing CDD; ACIP transition opens Source
- In force
Deadline for existing reporting entities to notify AUSTRAC of their compliance officer Source
- In force
Transitional ACIP policies must list customer classes and transition dates; Tranche 2 obligations start Source
- Commencing
Earliest deadline for an existing entity's first independent evaluation (the later of this date or 4 years after its last independent review) Source
- Commencing
Initial CDD transition ends; default date to move from IFTI to IVTS reporting Source
Also on the regulatory timeline.
Related guides
Questions people ask
What are the AML/CTF Rules?
They are legislative instruments made by the AUSTRAC CEO that set out the detail of the obligations in the AML/CTF Act 2006. The current set is the AML/CTF Rules 2025, as amended in March 2026. For a plain-English summary of the Rules themselves, see AUSTRAC AML/CTF Rules explained.
When did the new AML/CTF Rules start?
For existing reporting entities, on 31 March 2026, unless a transitional rule defers a specific obligation. For Tranche 2 businesses such as lawyers, accountants and real estate agents, on 1 July 2026. See the Tranche 2 hub.
What changed for existing reporting entities?
AUSTRAC lists changes to AML/CTF program requirements, customer due diligence, value transfer and travel rule obligations, and enrolment details. The biggest practical shift is that CDD is now outcome based: you establish set matters on reasonable grounds and record how you did it.
Can we keep using our old ACIP?
For initial CDD only, until 31 March 2029, if you were enrolled on 30 March 2026 and had transitional policies in place by 1 July 2026. Ongoing CDD must follow the new Rules for all customers now. Our ongoing CDD guide covers what that involves.
What if we are not ready?
AUSTRAC says it will take a pragmatic and proportionate approach, but it expects a documented implementation plan, sustained progress against it, and continued management of ML/TF risk in the meantime.
Do the 2025 Rules change suspicious matter reporting?
The duty to report suspicious matters continues. AUSTRAC's transitional rules defer the move from IFTI reports to international value transfer service (IVTS) reports until 31 March 2029, with a later substitute date of up to 30 September 2029 for some entities.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- AUSTRAC, AML/CTF transitional rules 2026
- AUSTRAC, Changes to AML/CTF obligations: What you need to do
- AUSTRAC, About the reforms
- AUSTRAC, Amendments to the AML/CTF Rules
- AUSTRAC, Overview of initial customer due diligence
- Federal Register of Legislation, Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (F2025L01026)
- OAIC, Privacy guidance for reporting entities under the AML/CTF Act
Where StackGo fits
The Rules leave the method to you, and many firms meet them with their own forms, manual checks and a screening subscription. IdentityCheck is one way to run the customer-facing parts of CDD inside the practice software a firm already uses. It does not write your AML/CTF program or decide your transition plan.
- Biometric identity checks: a photo of a government ID document plus a live selfie with liveness, covering 12,500 document types from 230+ countries and territories
- PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients
- Onboarding forms, including multi-entity forms that collect each person and entity on a structure, and risk assessment forms with scoring and enhanced due diligence steps
- In Australia, DVS government document verification as an add-on, and beneficial ownership reports from a credit bureau partner, charged per report
- Links to Xero Practice Manager, Xero, Karbon and HubSpot, where by default the connected system gets a link to the result plus the outcome and status, with no personal details written back
- It does not lodge suspicious matter, threshold transaction, IFTI or IVTS reports with AUSTRAC
- It does not do transaction monitoring
- It does not accept the Australian Government Digital ID (myID) today
- It does not give legal advice or tell you whether your program meets the Rules
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.