What AUSTRAC Expects From Reporting Entities

If your firm provides a “designated service” under the AML/CTF Act, you are a reporting entity, and AUSTRAC expects you to operate a documented, risk based compliance framework. Here is what that means in practice.

1. Know whether you are a reporting entity

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) applies to businesses that provide one or more “designated services”. Australia’s Tranche 2 reforms extend the regime to professional services that have not previously been captured, including many accountants, legal and conveyancing practices, trust and company service providers, and real estate agents. The first step is mapping your services against the designated service definitions to confirm your status.

2. Enrol with AUSTRAC

Reporting entities must enrol with AUSTRAC, and certain entities (such as remittance providers and digital currency exchanges) must also register. Enrolment tells the regulator who you are and what services you provide, and it is the gateway to lodging reports.

3. Maintain an AML/CTF Program

At the heart of compliance is a written AML/CTF Program tailored to your business. A compliant program is built on a documented ML/TF risk assessment of your customers, services, delivery channels and geographies, and sets out the systems and controls you use to manage that risk. It should also provide for:

• Board and senior management oversight, and approval of the program;
• A nominated AML/CTF Compliance Officer at management level;
• An ongoing employee risk awareness and training program;
• Customer identification and ongoing due diligence procedures; and
• Regular independent review of the program.

4. Conduct customer due diligence (CDD)

Before providing a designated service, you must identify your customer and verify that identity using reliable, independent data. For higher risk customers you must apply enhanced due diligence, and for all customers you must conduct ongoing due diligence, keeping information current and monitoring transactions for activity that is unusual or inconsistent with what you know about the customer.

5. Meet your reporting obligations

AUSTRAC relies on entities to report particular matters. Generally these include:

• Suspicious matter reports (SMRs), lodged when you form a relevant suspicion, generally within 3 business days (within 24 hours where it relates to terrorism financing);
• Threshold transaction reports (TTRs), for cash transactions of A$10,000 or more, generally within 10 business days;
• International funds transfer instructions (IFTIs), where applicable to your services; and
• An annual compliance report describing how you met your obligations.

6. Keep records for seven-years

You must retain records of customer identification, transactions, your AML/CTF Program and compliance decisions for at least seven-years. Good record keeping is what lets you demonstrate compliance if AUSTRAC asks, long after the work was done.

7. Get ready ahead of the deadline

Newly regulated firms should not wait. Under the current reform timetable, enrolment for Tranche 2 entities is scheduled to open from 31 March 2026, with full obligations commencing 1 July 2026. Building your risk assessment and program early gives you time to embed the workflow before the deadline.