AUSTRAC AML/CTF Rules: Current Obligations And 2026 Reforms

Australia’s anti-money laundering framework is undergoing its most significant transformation in over a decade. For accounting firms and other professional services businesses, understanding the Australian Transaction Reports and Analysis Centre (AUSTRAC) anti-money laundering and counter-terrorism financing (AML/CTF) rules isn’t optional, it’s becoming a legal requirement that will fundamentally change how you onboard and verify clients.

The reforms taking effect through 2025 and 2026 extend AML/CTF obligations to a much broader range of "reporting entities," including accountants, lawyers, and real estate professionals. This means thousands of businesses that previously operated outside AUSTRAC’s regulatory scope must now implement compliant identity verification processes, customer due diligence programs, and ongoing monitoring systems.

At StackGo, we help regulated businesses integrate identity verification and know your customer (KYC) compliance directly into their existing software stack, whether that’s HubSpot, Salesforce, or another customer relationship management (CRM). As these new obligations come into force, having the right infrastructure in place will determine whether compliance becomes a competitive advantage or an operational burden.

This article breaks down the current AUSTRAC AML/CTF framework, explains what’s changing with the 2026 reforms, and outlines the practical steps your business needs to take. We’ll cover the legislative requirements, transitional timelines, and what compliance actually looks like in practice.

What the AUSTRAC AML/CTF Rules cover

The AUSTRAC AML/CTF rules establish Australia’s legal framework for combating money laundering and terrorism financing across the financial system. These rules, made under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, prescribe specific obligations that reporting entities must follow when providing designated services. The framework covers everything from customer identification requirements to transaction monitoring, reporting suspicious activity, and maintaining compliance programs.

Core legislative framework

Your obligations under the AUSTRAC framework stem from two primary sources: the AML/CTF Act 2006 and the AML/CTF Rules. The Act establishes the broad legislative requirements, while the Rules provide the detailed, prescriptive obligations you must implement in your business operations. AUSTRAC updates these Rules periodically to address emerging risks, with the most significant changes coming into effect during 2025 and 2026.

The Rules specify exactly how you must verify customer identities, what documentation you need to collect, and the timeframes within which you must complete verification. They also define the types of businesses and services that fall under the regulatory regime, establishing clear boundaries around who is considered a reporting entity.

The scope of regulated activities

The framework applies to businesses providing designated services, which historically included banks, remittance providers, casinos, and bullion dealers. These entities must conduct customer due diligence, monitor transactions, and report to AUSTRAC when they identify suspicious activity or handle threshold transactions of A$10,000 or more in physical currency.

Designated services now encompass activities where money laundering risks exist, such as client account operations, property settlements, and business advisory services involving significant funds. The expansion recognises that criminals increasingly use professional intermediaries to legitimise illicit proceeds, making these sectors critical to Australia’s financial crime defences.

Key compliance requirements

You must implement several interconnected obligations under the Rules. Customer identification requires you to verify the identity of individuals and beneficial owners of entities before providing designated services. This means collecting specific identity documents, verifying their authenticity, and maintaining records for seven years after the business relationship ends.

Transaction monitoring obligations require you to have systems that detect suspicious activity and unusual transaction patterns. When you identify reportable matters, you must submit suspicious matter reports (SMRs) to AUSTRAC within specified timeframes. Your business must also maintain an AML/CTF program that assesses your money laundering and terrorism financing risks, implements appropriate controls, and ensures ongoing compliance through regular audits and staff training.

Current obligations for reporting entities

If your business is already captured under the existing AUSTRAC AML/CTF rules, you’re subject to a comprehensive set of obligations that govern how you identify customers, monitor transactions, and report suspicious activity. These requirements apply to traditional reporting entities including financial institutions, remittance providers, casinos, and bullion dealers. Understanding these current obligations provides the baseline for what newly regulated entities will need to implement when the 2026 reforms commence.

Customer identification and verification

You must verify the identity of every customer before providing a designated service. This means collecting and checking specific identity documents that meet AUSTRAC’s verification standards, including government-issued photo identification for individuals and company registration details for entities. Your verification process must occur within a reasonable timeframe, typically before you provide the service, though some limited exceptions exist for low-risk situations.

The Rules require you to identify beneficial owners when dealing with corporate entities, trusts, or partnerships. You need to establish who ultimately owns or controls the entity, typically identifying individuals who hold 25% or more ownership interest. This prevents criminals from hiding behind complex corporate structures to launder money or finance terrorism.

Ongoing monitoring and reporting

Your obligations don’t end after initial customer verification. You must implement ongoing due diligence to monitor customer transactions and activities throughout the business relationship. This includes detecting unusual patterns, conducting enhanced due diligence for high-risk customers, and updating customer information when circumstances change or risks increase.

When you identify suspicious activity that may involve money laundering or terrorism financing, you must submit a suspicious matter report to AUSTRAC. You also need to report threshold transactions, where you receive or pay A$10,000 or more in physical currency (notes and coins), and maintain an AML/CTF program that documents your risk assessment and compliance approach.

What changes in the 2025 Rules and 2026 start

The AML/CTF Rules 2025 represent the most significant expansion of Australia’s financial crime framework since its inception. These new AUSTRAC AML/CTF rules, which commenced on 31 March 2026 for existing reporting entities and on 1 July 2026 for Tranche 2 businesses, extend reporting entity obligations to accountants, lawyers, real estate professionals, and other trust and company service providers. Your business now falls under regulatory oversight if you provide services involving client accounts, property settlements, or business structuring advice that previously operated outside AUSTRAC’s scope.

Expansion to professional services

Accounting firms must now comply when they prepare or lodge tax returns involving client money, establish or manage client trust accounts, or provide business structuring advice. Legal practices face obligations when conducting property settlements, managing trust accounts, or forming companies and trusts on behalf of clients. Real estate agents and conveyancers come under the framework when they handle funds in settlement transactions or act as intermediaries in property transfers.

These expanded obligations recognise that criminals increasingly exploit professional intermediaries to legitimise illicit funds, making your sector critical to Australia’s anti-money laundering defences.

Enhanced verification requirements

The 2025 Rules introduce stronger identity verification standards that go beyond the previous framework. You must now collect biometric-capable identity documents where possible, verify beneficial ownership chains more thoroughly, and implement ongoing monitoring systems that detect suspicious patterns across your client base. Enhanced due diligence requirements apply when dealing with high-risk customers, including politically exposed persons or clients from jurisdictions with weak anti-money laundering controls. Your business needs systems that can flag unusual transaction patterns, verify complex ownership structures, and maintain comprehensive audit trails for all verification activities you conduct.

AUSTRAC video: How Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws are changing

Transitional arrangements and existing clients

AUSTRAC’s transitional arrangements are narrow. They don’t give newly regulated businesses a phased path to compliance: if you are an accountant, lawyer, conveyancer, real estate agent or dealer, your AML/CTF program, customer due diligence, reporting and record-keeping obligations applied from 1 July 2026. You must enrol with AUSTRAC no later than 28 days after you first provide a designated service.

What the AML/CTF Transitional Rules 2026 change for you

• Compliance officer notification. Notify AUSTRAC of your AML/CTF compliance officer by the later of 29 July 2026 or 14 days after you enrol.
• Your first independent evaluation. Your deadline depends on the last two digits of your AUSTRAC account number (AAN): 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030.

The 31 March 2029 dates you may see in the transitional rules are for businesses that were already regulated before the reforms, such as banks and remitters. They cover continued use of the old customer identification procedures and the move to new international transfer reporting. They don’t apply to Tranche 2 businesses.

Clients you already had on 1 July 2026

You don’t have to re-verify your whole client book. A client is a pre-commencement customer if you were providing them a designated service on 1 July 2026, or you had an ongoing relationship with them involving a designated service you provided before that date. You can keep serving these clients without initial CDD unless either of these happens:

• a suspicious matter reporting obligation arises for that client, or
• there is a significant change in the nature and purpose of the relationship that makes the client’s money laundering and terrorism financing (ML/TF) risk medium or high.

If either happens, complete initial customer due diligence (CDD) before you next provide them a designated service. Meanwhile, ongoing CDD applies to every pre-commencement client: monitor for unusual transactions and behaviour, keep their KYC information up to date, and watch for changes that raise their risk.

How to prepare your business for compliance

Preparing for the AUSTRAC AML/CTF rules requires a structured approach that addresses your identification processes, risk management frameworks, and internal controls. Your first step involves conducting a comprehensive audit of your current client onboarding procedures to identify gaps between your existing practices and the regulatory requirements. This assessment reveals which systems need upgrading, what training your team requires, and where you can leverage existing infrastructure to minimise compliance costs.

Conduct a comprehensive risk assessment

You must document the money laundering and terrorism financing risks your business faces based on your client types, service offerings, and geographic exposure. Your risk assessment identifies which customers require enhanced due diligence, what transaction patterns signal suspicious activity, and how often you need to review client information. This framework guides every compliance decision you make, from verification standards to monitoring thresholds.

Your risk assessment isn’t a one-time exercise; you must review and update it whenever your business operations change or new threats emerge.

Establish compliant verification procedures

Your verification procedures need to capture the right identity documents, confirm their authenticity, and maintain audit trails for every customer interaction. Consider integrating identity verification technology directly into your CRM or practice management software, eliminating manual data entry and reducing verification errors. StackGo’s IdentityCheck reads contact information from your existing system, verifies identities against global databases, and writes outcomes back automatically, ensuring your compliance data lives where you already work rather than requiring separate platforms or manual processes.

Build ongoing monitoring capabilities

Transaction monitoring requires systems that flag unusual patterns, detect high-risk activities, and generate suspicious matter reports when necessary. Your monitoring approach must align with your risk assessment, applying stricter oversight to higher-risk clients while maintaining efficient processes for standard relationships.