AML compliance requirements in Australia
Under Australia’s AML/CTF Act, a business that provides a designated service must enrol with AUSTRAC, run a risk-based AML/CTF program and complete customer due diligence before it acts. It must also report to AUSTRAC and keep records for 7 years. Accountants, lawyers, conveyancers and real estate agents have had these obligations since 1 July 2026.
This guide is for businesses regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC), including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. The requirements come from the AML/CTF Act and AUSTRAC’s own guidance, checked on 21 October 2026.
Who has to meet AML requirements in Australia?
Any business that provides a designated service is a reporting entity. The services are listed in section 6 of the AML/CTF Act.
For accountants, lawyers, conveyancers, real estate agents and dealers in precious metals and stones, the dates were staged. Enrolment opened on 31 March 2026, and the main obligations started on 1 July 2026.
Not every task a firm does is a designated service. Check yours against AUSTRAC’s list of professional designated services, or our guide to designated services for accountants.
Key point
Under Australia’s AML/CTF Act, a business must apply to enrol with AUSTRAC no later than 28 days after it starts providing a designated service.
A firm that started on 1 July 2026 had until 29 July 2026 to enrol. Most businesses only enrol. Registration is extra, and applies to remittance and virtual asset services.
What are the core AML obligations?
Once you are enrolled, the obligations fall into five groups.
- An anti-money laundering and counter-terrorism financing (AML/CTF) program: a written risk assessment and the policies that manage those risks.
- Governance: a senior manager who approves the program and a compliance officer who runs it.
- Customer due diligence: knowing who your customer is, and their risk, before you act.
- Reporting: suspicious matters, large cash transactions, international transfers and an annual compliance report.
- Record keeping: evidence of what you did and why, kept for 7 years.
Each group feeds the next. Your risk assessment sets how much due diligence a customer needs, and your due diligence is what lets you spot something to report.
What must your AML/CTF program include?
Your program starts with an ML/TF risk assessment. It covers the money laundering, terrorism financing and proliferation financing risks you may reasonably face in providing your services.
Then come your AML/CTF policies, which say how you manage and mitigate those risks. Both must suit the nature, size and complexity of your business. AUSTRAC’s program starter kits for newly regulated sectors give you a template to customise.
A governing body oversees the program and a senior manager approves it. In a small business, one person may hold more than one of these roles.
You must appoint an AML/CTF compliance officer within 28 days of providing designated services, and tell AUSTRAC within 14 days. That person must be at management level, a fit and proper person, and resident in Australia if you provide services through a permanent establishment here.
Finally, your people. You must carry out personnel due diligence and train staff whose work touches your obligations. AUSTRAC’s training guidance asks for training tailored to each role, as often as necessary.
What does customer due diligence involve?
Customer due diligence, mapped to the five workflows
The customer-level obligations, before and after you provide the service
- Intake Collect KYC information: details, documents and consent
- Verify Identity, and beneficial ownership for entities
- Screen PEP, sanctions and adverse media, on every party
- Assess The risk rating and the decision
- Monitor Ongoing due diligence and re-checks
Ongoing due diligence. Changes in a customer’s behaviour or details feed back into their risk rating.
Sources: AUSTRAC, Overview of initial customer due diligence; AUSTRAC, Overview of ongoing customer due diligence Reviewed
You must complete initial customer due diligence before you start providing the service. That means establishing these matters on reasonable grounds:
- the identity of the customer, and of anyone acting for them
- the identity of any beneficial owner, such as a person who owns 25% or more of a company
- whether any of them is a politically exposed person or designated for sanctions
- the nature and purpose of the business relationship
- the source of funds and source of wealth, where enhanced due diligence applies
You verify the information using reliable and independent data, matched to the customer’s risk. If you cannot establish these matters, you must not provide the service.
Higher-risk customers need enhanced due diligence, and a foreign politically exposed person (PEP) always does. See our guide to enhanced due diligence for PEPs.
The work does not end at onboarding. Ongoing customer due diligence means monitoring for unusual transactions and behaviour, and updating know your customer (KYC) information and the customer’s risk rating when things change.
What do you report to AUSTRAC, and when?
AUSTRAC reporting deadlines after the trigger
- Suspicious matter, terrorism financingfrom forming the suspicion24 hours
- Suspicious matter, all otherafter the day you form the suspicion3 business days
- Suspicious matter, privilege claimednot for terrorism financing5 business days
- Threshold transactionafter the day of the cash transaction10 business days
- International funds transferafter sending or receiving the instruction10 business days
24 hours is drawn as one day. It is calendar time, not business days.
Sources: AUSTRAC, Suspicious matter reports; AUSTRAC, Threshold transaction reports; AUSTRAC, International funds transfer reports Reviewed
A suspicious matter report is due once you form a suspicion on reasonable grounds. You do not need to be certain a crime occurred.
Key point
Under Australia’s AML/CTF Act, a reporting entity must report a suspicion within 3 business days, or 24 hours for terrorism financing.
A threshold transaction report covers a transfer of A$10,000 or more in physical currency. An international funds transfer instruction report covers money sent into or out of Australia. Both are due within 10 business days.
Once a year, you lodge an annual compliance report. The first financial-year period runs from 1 July 2026 to 30 June 2027, and you lodge between 1 July and 30 September 2027.
Keep the report to yourself. Telling a customer about a suspicious matter report can be the criminal offence of tipping off, under section 123 of the Act. Our guide to AUSTRAC reporting forms covers how to lodge each one.
How long must you keep records?
Keep customer due diligence records for at least 7 years after the business relationship ends. Keep transaction records for at least 7 years from the date the transaction was completed.
The records must show how you established each matter, not just the documents you collected. Keep them easy to retrieve, as AUSTRAC’s record keeping checklist advises.
How do you keep your program up to date?
You must review your risk assessment at least once every 3 years. You must also review it after a significant change, such as a new service or a new way of delivering it.
A senior manager approves any update, and you record it in your program within 14 days. Your governing body must be told in writing.
Separately, an independent evaluator must test your program at least once every 3 years. They must be free of conflicts and know the obligations that apply to you, and they give you a written report.
For what is at stake, see AML non-compliance penalties for the maximums and recent cases.
Frequently asked questions
Do I need to register with AUSTRAC or just enrol?
Most businesses only enrol. Registration is an extra step for remittance and virtual asset service providers. AUSTRAC says lawyers, accountants, real estate agents, conveyancers and dealers in precious metals and stones generally do not need to register.
When is my first independent evaluation due?
At least once every 3 years, at a frequency your policies set. AUSTRAC suggests newly enrolled businesses consider an earlier first evaluation.
What is the penalty for not complying?
Under Australia’s AML/CTF Act, the civil maximum is A$36.4 million per contravention for a company and A$7.28 million for an individual. That is 100,000 and 20,000 penalty units at A$364, the rate from 1 July 2026.
Do card payments or bank transfers need a threshold transaction report?
No. Threshold transaction reports apply to physical currency only, meaning notes and coins. Electronic transfers, cheques and card payments do not trigger one, even at A$10,000 or more.
Next steps
If your business is newly regulated, start with what AML/CTF compliance involves. Then work through our AML compliance checklist and customer due diligence checklist.
StackGo’s IdentityCheck runs KYC and AML identity checks inside the customer relationship management (CRM) or practice management software your team already uses. Results are written back to the client record. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.
Sources
The facts on this page come from these sources, checked on 21 October 2026.
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 6, 26D, 26F, 26J, 26K, 28, 41, 123, 175)
- AUSTRAC, Enrol with us overview
- AUSTRAC, AUSTRAC opens enrolment for new professions in next step for AML reforms (31 March 2026)
- AUSTRAC, AML/CTF compliance officer
- AUSTRAC, Overview of initial customer due diligence
- AUSTRAC, Suspicious matter reports
- AUSTRAC, Step 5: Conduct an independent evaluation