Australia's AML/CTF Tranche 2 reforms require businesses that provide "designated services" under the Act, which commonly includes accountants, bookkeepers, lawyers, conveyancers, and real estate agents carrying out specific captured activities, to verify client identity, assess money-laundering risk, and maintain a documented compliance program. This is current law, not a future proposal, and it already applies to businesses across Footscray, Melbourne, and Victoria that provide those designated services.
If you run an accounting practice, bookkeeping service, law firm, conveyancing business, or real estate agency, and any part of what you do falls within a designated service under the Act, this changes how you take on new clients. For businesses that have not yet worked out whether they are captured and addressed their obligations, the time to do so is now, before enforcement attention turns squarely to the newly captured sectors.
What the Tranche 2 Reforms Actually Changed
Before the Tranche 2 reforms, Australia's AML/CTF obligations applied mainly to the financial sector: banks, credit unions, money transfer businesses, and similar entities.
The reforms close that gap. They bring Australia into line with international AML standards set by the Financial Action Task Force (FATF), which had previously identified Australia's exclusion of designated non-financial businesses and professions (DNFBPs) as a significant gap in its framework.
This is a substantive new compliance obligation with real consequences for non-compliance.
Who Is Captured in Australia?
The businesses captured by the expanded regime are those providing what the AML/CTF Act calls designated services. The most relevant categories for businesses include:
- Accountants and tax agents: when providing services involving business structuring, asset management, or financial transactions on behalf of clients
- Bookkeepers: when managing financial records or processing transactions in ways that could be used to obscure the movement of money
- Lawyers and conveyancers: particularly when handling real property transactions, client funds, company formations, or business acquisitions
- Real estate agents: when facilitating the purchase, sale, or lease of real property
- Trust and company service providers: businesses that form, register, or manage corporate structures or trusts on behalf of clients
What Are the Four Core Obligations?
1. Customer Due Diligence (KYC)
Before providing designated services, businesses must verify who their clients are. For individual clients, this means verifying name, date of birth, and address using a reliable identity document such as a passport or driver's licence. For business clients, verification extends to the entity itself and, critically, to the beneficial owners: the individuals who ultimately own or control the business.
KYC is not a one-time onboarding exercise. It must be maintained on an ongoing basis. Where client circumstances change (new ownership, new business activities, new transactions), the verification must be updated.
2. Risk Assessment
Every business captured by the regime must assess the money laundering and terrorism financing risks inherent in its client base, services, and transaction types. This assessment must be documented and must form the basis of the AML/CTF program.
3. Monitoring and Reporting
Where there are reasonable grounds to suspect a transaction or matter is linked to criminal activity, a suspicious matter report (SMR) must be lodged with AUSTRAC, regardless of the amount involved, and regardless of whether the suspicion can be substantiated. Cash transactions of $10,000 or more also trigger mandatory threshold transaction reports.
4. Staff Training and Record Keeping
Staff who deal with clients or handle transactions must be trained on the business's AML/CTF obligations: what to look for, what the red flags are, and what to do when a concern arises. Training must be documented. Identity verification records must be retained for a minimum of seven years.
Why Now Is the Right Time for Melbourne Businesses
The businesses that manage AML/CTF compliance most effectively are the ones that build it into their operations from the outset, so that asking for ID is normal, documentation is current, and the program runs alongside the business rather than as a separate administrative burden.
The businesses that struggle are invariably the ones that wait until a compliance review, a client complaint, or a regulator inquiry forces the issue. By that point, the options are narrower, the cost of remediation is higher, and AUSTRAC's view of the business is already forming.
For businesses in Melbourne and Victoria that are newly captured, the current period is the window to get this right. AUSTRAC has signalled its intention to focus enforcement attention on the newly captured sectors. The businesses that have their programs in place before that attention arrives are in a materially better position than those that do not.
If You Are a PCA Client
PCA is one of the firms these laws now apply to. Before we act on certain matters, such as buying or selling property, setting up a company or trust, or handling money for a client, we are required to confirm who we are working with. For companies and trusts, that includes who owns or controls them.
We will tell you at the start of your matter what we need and why. Our guide AML/CTF Client Verification: What to Expect explains the process step by step.
Frequently Asked Questions
1. Do the new AML rules apply to small businesses in Melbourne?
Yes, if they provide a designated service under the Act. The expanded AML/CTF regime applies to businesses of all sizes providing designated services, which commonly arise in accounting, bookkeeping, legal, conveyancing, and real estate work, across Melbourne and Victoria. It is the designated service that matters, not the profession as such.
2. What is an AML/CTF program?
An AML/CTF program is a documented framework covering how your business identifies and manages money laundering and terrorism financing risks.
3. What is the KYC process?
KYC requires verifying client identity before providing services: name, date of birth, and address for individuals; entity details and beneficial ownership for business clients.
4. What are the penalties for AML/CTF non-compliance in Australia?
Penalties include civil financial penalties, enforceable undertakings, and in serious cases, criminal prosecution. AUSTRAC has broad enforcement powers and uses them across all business sizes.