Hall & Wilcox AML/CTF services supporting CPA Australia members

To provide clarity to accountants, lawyers, conveyancers and other Tranche 2 entities, AUSTRAC has published guidance on what is expected of regulated entities as the reforms approach, and what regulated entities can expect from AUSTRAC in return. Our article Countdown to AML/CTF reforms: AUSTRAC outlines what's required provides a breakdown of AUSTRAC's guidance.

In short, before 1 July 2026, new reporting entities will be expected to:

• enrol as a reporting entity (the online enrolment system will be accessible from 31 March 2026)
• implement an AML/CTF program
• appoint an AML/CTF compliance officer
• train staff on their AML/CTF program and processes
• be ready to ask clients questions and report suspicious activity. 

Tranche 2 entities should prepare for a significant review and update to their customer onboarding processes, risk management systems, and compliance procedures. In less than 12 months, these entities will need to:

• conduct know your client (KYC) checks
• monitor client transactions for suspicious activity
• conduct internal training on AML/CTF obligations
• monitor their compliance with their AML policies to report to AUSTRAC on a yearly basis. 

A reporting entity must conduct a ML/TF risk assessment having regard to the nature, scale and complexity of its operations when determining its exposure to ML/TF risks and incorporate relevant risks communicated to it or otherwise published by AUSTRAC.

At a minimum, reporting entities are required to assess risks associated with:

• the kinds of customers they service
• the designated services they offer
• the channels through which those services are delivered, and
• the jurisdictions with which they engage.

ML/TF risk assessments must be regularly reviewed and updated to ensure they remain current. 

Importantly, reporting entities must not commence to provide a designated service to a customer if it does not have an up-to-date ML/TF risk assessment.

Generally, the key elements of an AML/CTF program are:

• an ML/TF risk assessment
• an appropriate governance framework, including reporting lines and group compliance
• properly instituted internal AML/CTF policies and procedures
• established reporting protocols
• review and record keeping systems and processes, and
• effective customer identification procedures. 

Before providing a designated service to a customer, the general rule is that you must identify: 

• the customer
• any person on whose behalf the customer is receiving the designated services
• the identity of any person acting on behalf of the customer
• if the customer is not an individual – any beneficial owners of the customer, and
• whether any of the above people are politically exposed persons. 

You must also monitor your customers in relation to the provision of the designated services to appropriately identify and manage the risks of ML/TF/PF that you may reasonably face in providing the designated services. Specific requirements apply if you provide the designated services through a permanent establishment in Australia.

AUSTRAC acknowledges the challenges newly regulated entities face in preparation for the reforms and has committed to facilitating the implementation of AML/CTF programs by providing ample guidance, education, and materials.

However, it is critical to note that non-compliance by newly regulated entities will be closely monitored by AUSTRAC from 1 July 2026 and will face intense scrutiny should ignorant or malicious non-compliance be encountered. 

To help navigate your compliance journey we encourage you to explore our latest articles or reach out to our team to learn more: 

Transitional Rules update announced for Australia’s AML/CTF reforms – key guidance for reporting entities

Proposed AML/CTF Rules: the red and green flags

New Draft Rules shake up AML/CTF regime

Countdown to AML/CTF reforms: AUSTRAC outlines what's required

Upcoming AML/CTF compliance for the accounting profession

Upcoming Tranche 2 AML/CTF Reforms: key KYC obligations