AML non-compliance penalties in Australia
Under Australia’s AML/CTF Act, the Federal Court can order a civil penalty of up to A$36.4 million per contravention for a company and A$7.28 million for an individual. Offences such as giving AUSTRAC false information carry up to 10 years’ jail. AUSTRAC can also issue infringement notices and remedial directions, and accept enforceable undertakings.
This guide is for businesses regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC), including the accountants, lawyers, conveyancers and real estate agents regulated from 1 July 2026. Penalty figures come from the AML/CTF Act and AUSTRAC’s own pages, checked on 2 November 2026.
What is the maximum AML penalty in Australia?
- Company
- Up to A$36.4 million per contravention100,000 penalty units
- Individual
- Up to A$7.28 million per contravention20,000 penalty units, for a person other than a company
- Penalty unit
- A$364 from 1 July 2026Up from A$330
- Which value applies
- The value on the date of the contraventionNot the date the breach is found or the penalty is ordered
- Time limit
- 6 yearsAUSTRAC must start civil penalty proceedings within 6 years of the contravention (s 178)
Sources: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 26E, 26F, 26K, 26M, 175); AUSTRAC, Consequences of not complying Reviewed
AUSTRAC can ask the Federal Court for a civil penalty order when a business breaches its anti-money laundering and counter-terrorism financing (AML/CTF) obligations. Under section 175 of the Act, the maximum is 100,000 penalty units for a company and 20,000 for an individual.
At A$364 a unit, that is A$36.4 million for a company and A$7.28 million for an individual. Those are maximums for each contravention, not for each case.
Key point
Under Australia’s AML/CTF Act, the Federal Court can order a company to pay up to 100,000 penalty units for each civil penalty contravention.
That is why the totals get large. A business that skips customer due diligence for 50 customers may face 50 contraventions, each with its own maximum.
What are the largest AML penalties so far?
The largest AML/CTF civil penalties in Australia
- Westpacordered 21 October 2020A$1.3 billion
- Commonwealth Bankordered 20 June 2018A$700 million
- Crown Melbourne and Crown Perthordered 11 July 2023A$450 million
- The Starordered 28 October 2026A$260 million
- SkyCity Adelaideordered 7 June 2024A$67 million
- Tabcorpordered 16 March 2017A$45 million
Penalties only. Legal costs ordered on top are not drawn.
Sources: AUSTRAC, Enforcement actions taken; AUSTRAC, Westpac ordered to pay $1.3 billion penalty (21 October 2020); AUSTRAC, Federal Court makes ruling in Crown matter (11 July 2023); AUSTRAC, Star ordered to pay $260 million for serious AML/CTF breaches (28 October 2026); AUSTRAC, Federal Court makes ruling in SkyCity case (7 June 2024) Reviewed
The biggest penalties have gone to banks, casinos and a wagering business. Each was a Federal Court order on AUSTRAC’s application, and each followed years of failures in risk assessment, monitoring or reporting.
Westpac’s A$1.3 billion penalty in 2020 was the highest civil penalty in Australian history, AUSTRAC said at the time. The court found Westpac had breached the Act on more than 19 million occasions.
The most recent is The Star. On 28 October 2026 the court ordered The Star Entertainment Group to pay A$260 million, the fourth largest AML/CTF penalty so far. It found The Star failed to maintain a compliant AML/CTF program and failed to monitor customers to identify, mitigate and manage money laundering and terrorism financing risks. More than 1,200 high-risk customers were able to gamble through high-risk channels.
In setting the amount, Justice Moore noted that The Star had already received penalties of A$200 million for conduct that significantly overlaps with this case. The two failures the court found, the program and customer monitoring, are obligations every reporting entity has, including the businesses regulated from 1 July 2026.
Smaller cases reach the court too. In May 2026 the court ordered two financial services firms to pay A$50,000 and A$45,000, plus costs, after they did not pay AUSTRAC infringement notices of A$18,780 each.
Who can be penalised?
The reporting entity carries the obligations, so it usually carries the penalty. But people inside it are exposed too.
Under section 174 of the AML/CTF Act, it is itself a contravention to aid, induce or be knowingly concerned in a contravention. A director, senior manager or compliance officer who takes part can face an individual civil penalty.
Key point
Under Australia’s AML/CTF Act, a person knowingly concerned in a company’s contravention can face their own civil penalty of up to 20,000 penalty units.
Criminal offences, below, also apply to individuals. A court cannot make a civil penalty order against a person already convicted of an offence for substantially the same conduct.
Which breaches are criminal offences?
Most compliance failures are civil matters. The Act also creates offences for deliberate conduct, prosecuted in the criminal courts, and money laundering itself is a crime under the Criminal Code.
| Offence | Law | Maximum |
|---|---|---|
| Tipping off a customer about a suspicious matter report | AML/CTF Act s 123 | 2 years, 120 penalty units, or both |
| Giving AUSTRAC false or misleading information | AML/CTF Act s 136 | 10 years, 10,000 penalty units, or both |
| Producing false or misleading documents | AML/CTF Act s 137 | 10 years, 10,000 penalty units, or both |
| Splitting cash deals to avoid a threshold report | AML/CTF Act s 142 | 5 years, 300 penalty units, or both |
| Laundering money or property worth A$1 million or more | Criminal Code s 400.3 | 25 years, 1,500 penalty units, or both |
| Laundering money or property worth A$10 million or more | Criminal Code s 400.2B | Life imprisonment |
The money laundering offences apply to anyone, not just reporting entities. The penalty depends on the value involved and what the person knew or intended.
What can AUSTRAC do besides seek a penalty?
Three AUSTRAC enforcement actions besides a penalty
| Action | What it is | Public? |
|---|---|---|
| Enforceable undertaking | A written commitment you offer the AUSTRAC CEO to take, or not take, specific actions. If you breach it, AUSTRAC can apply to the Federal Court to enforce it. | Can be made public |
| Infringement notice | Issued for not meeting some obligations, including enrolling, customer due diligence, reporting, record keeping and appointing a compliance officer. | May be made public |
| Remedial direction | A written instruction to take specific actions so you comply, do not breach the same part of the Act again, or give AUSTRAC a report you did not give. | Can be made public |
Source: AUSTRAC, Consequences of not complying Reviewed
AUSTRAC has other enforcement tools that do not need a court hearing, and most of them can be made public.
AUSTRAC can also seek an injunction from the court. It can issue a written notice that makes you appoint an external auditor to review your compliance or to carry out a money laundering and terrorism financing (ML/TF) risk assessment. The auditor must give you a report of the result.
An infringement notice is generally 60 penalty units for a company, or A$21,840 at the current rate, and 12 for an individual, or A$4,368. Paying it discharges your liability for that contravention, so AUSTRAC cannot then take you to court for it.
On 30 September 2026 AUSTRAC began issuing infringement notices to real estate, accounting and jewellery businesses it believes did not enrol within 28 days of providing a designated service. The notices were A$21,840 for a company and A$4,368 for an individual, and AUSTRAC says they can accrue daily. Our guide to AUSTRAC’s infringement notices covers what to do if your business is not enrolled.
How does the court set the amount?
The court decides the penalty, not AUSTRAC. Section 175 tells it to consider all relevant matters, including:
- the nature and extent of the contravention
- any loss or damage it caused
- the circumstances in which it happened
- whether the court has found similar conduct before
Cooperation counts in practice. In the May 2026 cases, AUSTRAC said both firms’ levels of cooperation were factored into the penalties.
The penalty unit value is the one in force on the day of the contravention, not the day of the order. It rose from A$330 to A$364 on 1 July 2026. Under section 4AA of the Crimes Act 1914, it is indexed to inflation every three years from then.
How do you reduce the risk of a penalty?
The penalties follow the obligations, so the work is meeting them every day. Start with an ML/TF risk assessment and a written AML/CTF program based on it.
Then make the program run on every client. That means verifying identity before you act and screening for sanctions and politically exposed persons. It also means monitoring clients over time and reporting to AUSTRAC on time.
Keep the evidence. AUSTRAC’s record keeping checklist says to keep customer due diligence records for at least 7 years after the relationship ends.
Frequently asked questions
Can a small business be fined by AUSTRAC?
Yes. The maximums are the same for every company. In May 2026 two financial services businesses were ordered to pay A$50,000 and A$45,000 after leaving infringement notices unpaid.
Has AUSTRAC acted against newly regulated businesses yet?
Yes. On 30 September 2026 it began issuing infringement notices to real estate, accounting and jewellery businesses it believes failed to enrol on time. Its enforcement actions page listed no court proceedings against a business regulated from 1 July 2026 when we checked on 2 November 2026.
What penalty did The Star get?
A$260 million. The Federal Court ordered it on 28 October 2026, finding The Star failed to maintain a compliant AML/CTF program and failed to monitor customers for money laundering and terrorism financing risk. AUSTRAC applied for the order in November 2022.
Which penalty unit value applies to my breach?
The value on the date of the contravention. A breach on or after 1 July 2026 is calculated at A$364 a unit; a breach between 7 November 2024 and 30 June 2026 at A$330.
How long does AUSTRAC have to bring a case?
Proceedings for a civil penalty order must start no later than 6 years after the contravention, under section 178 of the AML/CTF Act.
Does paying an infringement notice end the matter?
Yes, for that contravention. Once paid, and if the notice is not withdrawn, you cannot be prosecuted or face civil penalty proceedings for the same alleged contravention.
Next steps
If your business is newly regulated, see what AML/CTF compliance involves and work through our AML compliance checklist.
StackGo’s IdentityCheck runs know your customer (KYC) and AML identity checks inside the customer relationship management (CRM) or practice management software your team already uses. Results are written back to the client record. See how IdentityCheck supports AUSTRAC Tranche 2 compliance.
Sources
The facts on this page come from these sources, checked on 2 November 2026.
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (ss 123, 136, 137, 142, 174, 175, 178, 180, 186A, 186B, 188)
- Criminal Code Act 1995 (ss 400.2B, 400.3)
- Crimes Act 1914 (s 4AA)
- AUSTRAC, Consequences of not complying
- AUSTRAC, Enforcement actions taken
- AUSTRAC, Federal Court imposes penalties after businesses fail to pay AUSTRAC infringement notices (27 May 2026)
- AUSTRAC, Record keeping checklist