AML/CTF for Accountants: Tranche 2 in 2026

AML/CTF means anti-money laundering and counter-terrorism financing. For accountants, compliance means identifying regulated services and managing the risk of criminals using them. Tranche 2 brings certain accounting services under AUSTRAC’s rules, with obligations now operating for those services.

What AML/CTF Means and What Tranche 2 Changes

AML/CTF compliance requires a regulated business to assess financial-crime risk, know its customers and report suspicious activity. Accounting work can help criminals hide asset ownership or disguise where money came from. The law also addresses proliferation financing, which includes funding the spread of weapons of mass destruction.

The original Anti-Money Laundering and Counter-Terrorism Financing Act 2006 covered designated services in sectors including banking, remittance and gambling. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 extends the regime to further services provided by accountants, lawyers, real estate professionals and others.

The Act establishes the obligations and lists designated services. The AML/CTF Rules supply more detailed requirements, while transitional rules govern specific changes and timing. AUSTRAC, the Australian Transaction Reports and Analysis Centre, publishes guidance explaining how it interprets those requirements.

Tranche 2 is the extension to these newly regulated services. Your practice becomes a reporting entity when it provides a designated service with the required Australian geographical link, subject to applicable exemptions. This explanation helps you decide whether the regime applies. Your AML/CTF program records how your practice meets it.

Designated Services That Bring a Practice Under AUSTRAC

A designated service is an activity listed in the AML/CTF Act because it carries financial-crime risk. Your job title alone does not decide whether your practice is regulated. Assess the actual work, including occasional services and registered-address arrangements.

AUSTRAC’s professional designated services guidance covers these activities:

• Assisting a real-estate purchase, sale or transfer, including its planning.
• Advancing the sale, purchase or transfer of a company or legal arrangement.
• Handling another person’s money or other property to advance a transaction.
• Organising financing, or helping plan or carry out equity or debt funding, for a company or legal arrangement.
• Selling or transferring a shelf company.
• Assisting company formation or restructuring, or equivalent work for relevant legal arrangements such as trusts.
• Taking specified roles, or arranging another person to take them, including director or trustee roles and nominee shareholder arrangements.
• Providing a registered office or principal place of business address for a company or legal arrangement.

Preparing tax returns, routine bookkeeping and general tax advice are not automatically designated services. Transaction work can change that answer. Advice about the tax implications of a possible sale differs from acting for the client to advance an identified sale.

Client-money work also needs a separate assessment. Routine bookkeeping payments can fall outside item 3 where the bookkeeper implements fixed obligations without substantive discretion. An incidental-payment exception depends on the services the whole business provides. It cannot be assumed for a separate department within a regulated practice.

These fictional examples show the distinction:

Practice engagement	Is it caught?	Deciding fact
Prepare an individual’s tax return from supplied records	No, on these facts	The engagement contains no designated service. Tax-practitioner identity duties still apply.
Establish a company and an express trust for a client	Yes, subject to the geographical link and exemptions	The practice helps create entities covered by the professional services list.
Provide the practice’s address as a company’s registered office	Yes, subject to the geographical link and exemptions	Address provision is its own designated service, even if other work is tax-only.

Use AUSTRAC’s regulated-business checker alongside the detailed guidance. Record the work considered and the reason for each classification, particularly where an exemption determines the answer.

When Accountants’ Obligations Start

Accountants’ tranche 2 obligations are already operating for covered services. Enrolment opened before the professional-services commencement boundary in 2026. AUSTRAC’s enrolment and commencement announcement sets out the exact boundaries.

A practice continuing covered services across commencement needed an operating AML/CTF program and arrangements for customer due diligence, reporting and record keeping. Enrolment’s permitted deadline did not postpone those duties. A business first providing a designated service after commencement must enrol within 28 days of starting it.

Specific later deadlines apply to compliance-officer notification and the first independent evaluation. Newly regulated businesses have staggered evaluation deadlines determined by their AUSTRAC account number. These arrangements do not give a general extension for implementing the program or checking new customers.

Use AUSTRAC’s transitional rules guidance to identify the provision that applies to your practice. Existing regulated businesses’ customer-identification transition is a different arrangement. Regulatory amendments can change timing, so retain the official deadline details with your implementation record.

Core AML Requirements for Accountants

A regulated practice needs a documented program that its staff use when providing designated services. Work through the obligations in this order, with governance roles assigned while the program is developed.

1. Enrol with AUSTRAC. Identify the legal business providing the services and give AUSTRAC its required business and service information. Follow the AUSTRAC enrolment guide and keep those details up to date.
2. Assess your risks. Identify how your services and customers could expose the practice to financial crime. Consider delivery methods and countries involved, then record the assessment and the reasons for it.
3. Adopt AML/CTF policies. Set the actions staff take to manage those risks and obtain the required approval. Your AML/CTF program guide explains how the risk assessment and policies fit together.
4. Appoint an eligible compliance officer. Give that person authority and resources to oversee daily compliance, and record why they meet the eligibility requirements. Apply AUSTRAC’s appointment and notification rules.
5. Run customer due diligence. Ordinarily, establish the required identity and risk matters before providing a new customer’s designated service. The KYC guide for accountants covers the checks and the treatment of representatives and beneficial owners.
6. Report to AUSTRAC. Lodge suspicious matter reports when the legal trigger arises, with threshold transaction reports where applicable. Assign responsibility for the annual compliance report as well.
7. Keep records. Preserve evidence of your program and the checks and decisions made under it. AUSTRAC’s record keeping guidance sets different starting points for retention periods.

A suspicious matter report concerns a suspicion on reasonable grounds. Proof of a crime is unnecessary. Report terrorism-financing suspicions within 24 hours and other reportable suspicions within three business days after the day the suspicion forms. Use the suspicious matter report guide for triggers and lodgement.

A threshold transaction report applies to a designated service involving a transfer of $10,000 or more in physical currency, including the foreign-currency equivalent. Lodge it within 10 days. Electronic transfers and card payments do not trigger that cash threshold, though suspicious matter reporting can still apply. AUSTRAC’s reporting guidance explains the difference.

The annual compliance report describes how the business met its obligations during the reporting period. The next cycle covers the 2026-27 financial year, with submission within three months after that period ends. Apply AUSTRAC’s annual-report requirements, including any applicable exemption.

Train staff in the program and review whether it works. Customer due diligence continues during the relationship, so a completed initial check does not close the AML/CTF work permanently.

What Changes in Your Client Onboarding

AML/CTF adds service scoping and a documented risk decision to the identity work your practice already performs. Record what the client is engaging you to do before deciding which checks apply. A tax-only engagement does not acquire AML/CTF duties merely because another client needs an entity restructure.

For regulated work, assess the client’s risk and establish the required identity matters. Entity clients require beneficial-owner checks, as well as checks on the person acting for them and their authority. Determine relevant politically exposed person, or PEP, status and targeted financial-sanctions status. AUSTRAC’s initial due diligence overview explains what must be established.

Consider a fictional new company client that initially requests a tax return. During onboarding, the director asks your practice to create a trust and transfer the business into it. That request changes the proposed services, so staff pause before advancing the restructure.

Record the revised scope and identify the designated service. Collect the company’s ownership details, identify beneficial owners and establish the director’s authority. Then complete the applicable screening and risk assessment, with further enquiries where the risk requires them. The authorised staff member records the decision before the designated work starts.

Existing-customer and delayed-check provisions have their own conditions. Apply those provisions expressly when relevant instead of assuming every longstanding client needs the same new-customer procedure.

Tax Genie brings identity verification, beneficial-owner screening and AML/CTF risk records into onboarding. Staff record the risk determination and its reasons, while the risk register shows each client’s standing and next review date. That record makes the service decision and the client checks available together.

AUSTRAC Guidance for Tranche 2 Entities

AUSTRAC’s accountants resource page links service guidance and compliance obligations. Its accounting program starter kit contains a risk assessment, policies, procedures and recording forms to customise for a suitable practice. AUSTRAC also publishes introductory webinar recordings and reform resources.

The starter kit has suitability criteria beyond staff numbers. They cover the services provided, client mix and higher-risk activity, among other conditions. A five-person practice still needs to compare its work with every criterion before relying on the kit.

AUSTRAC’s regulatory expectations call for meaningful implementation during the first financial year of regulation. It expects enrolment, an AML/CTF program, a compliance officer, staff training and readiness to report suspicions. It recognises that implementation improves over time, while expecting real effort.

That supervisory approach does not suspend legal duties. AUSTRAC has issued infringement notices to non-enrolled businesses, including businesses in the accounting sector. Keep evidence of your actions and resolve missing obligations promptly.

The Tax Practitioners Board’s reform guidance explains how AML/CTF duties sit beside existing tax-practitioner obligations. CPA Australia’s reform material also helps members assess the extension. Use those materials for professional context, with AUSTRAC’s designated-service and transitional details deciding the regulatory task.

Understand Enforcement Actions

AUSTRAC’s enforcement register separates current proceedings from concluded court proceedings and ongoing undertakings from concluded undertakings. An application asks a court to make an order. A proposed penalty remains a proposal until the court decides it.

The register includes concluded proceedings concerning missed annual compliance reports, with penalties ordered by the court. It also lists ongoing proceedings alleging broader failures. Read the status and underlying documents before describing an allegation as an established breach.

AUSTRAC’s consequences guidance distinguishes four enforcement tools:

• A civil penalty order is a court order requiring payment for a breach.
• An enforceable undertaking is an accepted written commitment to specified compliance actions.
• An infringement notice addresses certain failures and specifies a payment amount.
• A remedial direction instructs a business to take specified actions to correct or prevent breaches.

Use an action to identify the failed duty, then compare it with your own designated services and safeguards. For a missed report, assign a staff member to document the reporting calendar and escalation if the preparer is absent. Another industry’s penalty does not automatically determine an accountant’s liability.

First Steps for a Small Practice

Start by deciding which services your practice provides and documenting the resulting obligations. A small team can assign the work plainly without creating a separate department.

1. Map each service against AUSTRAC’s list. Include company formation, trustee arrangements and registered-office services, even if they generate little revenue. Record any exemption you apply.
2. Decide whether enrolment is required. If your business provides a covered service, enrol within the applicable period. If that period has passed, address the omission promptly and record the corrective action.
3. Appoint the compliance officer. Record eligibility and give the officer access to the information needed to act. Assign senior approval and oversight responsibilities too.
4. Draft the practice’s risk assessment. Use actual services and clients, including countries involved and how work reaches the practice. Record why a risk is rated as it is.
5. Adapt the starter kit if it fits. Put the approved policies into daily work, train staff and assign reporting responsibilities. Set the review schedule and your first independent-evaluation deadline.

A sole practitioner can hold the governing-body, senior-manager and compliance-officer roles. AUSTRAC’s sole-trader governance guidance explains that you do not need to report to yourself. You still need the risk assessment, approved policies and records of your compliance decisions.

Non-compliance can lead to directions, infringement notices or civil proceedings, alongside the harm of a criminal using your services. Before the next designated engagement starts, make sure the file records its service classification, required checks and the person authorised to approve it.