Four things changed for Australian compliance this month, and one date is coming up. Here is the short version on film, and the long version underneath, with every source linked.
1. AUSTRAC is issuing infringement notices for not enrolling
On 30 September AUSTRAC said it has begun issuing infringement notices (opens in a new tab) to businesses that it believes failed to enrol within 28 days of providing a designated service. The notices issued so far went to businesses in the real estate, accounting and jewellery sectors.
The amounts: $21,840 for a company and $4,368 for an individual, and AUSTRAC says they can accrue on a daily basis. These are infringement notices, not court penalties, and they followed formal requests for information that AUSTRAC sent in August.
What to check: if you provide a designated service, you must apply to enrol no later than 28 days after you start (AUSTRAC, enrolment (opens in a new tab)). Our AUSTRAC registration guide walks through it.
2. The $10,000 cash rule, made clearer
On 14 October AUSTRAC updated its threshold transaction reports guidance (opens in a new tab) with a section on when a transaction involves physical currency, and examples including mixed transactions.
The rule itself: if you provide a designated service involving the transfer of $10,000 or more in physical currency (notes and coins), you must submit a threshold transaction report (TTR) within 10 business days. Electronic transfers, cheques and card payments do not trigger a TTR, even at $10,000 or more.
More detail, including split payments: the $10,000 cash rule for Tranche 2 firms and our TTR guide.
3. Tax practitioners: the TPB has new powers
From 1 October 2026 the Tax Practitioners Board has an enhanced compliance and enforcement toolkit (opens in a new tab). The headline number: the maximum civil penalty for an individual is now 2,500 penalty units, up from 250, ten times higher (TPB, enhanced sanctions regime (opens in a new tab)). That is a maximum a court can impose, not a fixed fine.
4. Large data breaches are rising
The OAIC's latest notifiable data breach statistics (opens in a new tab), covering January to June 2026, show 667 notifications, against 662 in the previous period. Globally, breaches reported to the OAIC that affected over 1,000,000 individuals rose to 11, up from 4.
Contact and identity information, including identity documents, remains among the most compromised types of personal information. Australian Privacy Commissioner Carly Kind: "Organisations can't lose personal information they don't hold."
For an AML program that collects ID for customer due diligence, that is a prompt to check what you keep, for how long, and why. Our piece on Tranche 2 and the Privacy Act small business exemption covers where the two regimes meet.
Coming up: 10 December 2026
From 10 December 2026, APP entities (organisations covered by the Privacy Act) must say in their privacy policy when they have arranged for a computer program to make, or inform, decisions that significantly affect individuals (OAIC guidance on automated decisions (opens in a new tab)).
This week, check two things
- Are you enrolled? If you provide a designated service and have not enrolled, that is the gap AUSTRAC is now enforcing.
- Does your team know the cash rule? $10,000 or more in notes or coins during a designated service means a TTR within 10 business days.
Sources: AUSTRAC media release, 30 September 2026, and threshold transaction reports guidance, updated 14 October 2026, © AUSTRAC for the Commonwealth of Australia 2026, CC BY 4.0. OAIC website, www.oaic.gov.au (opens in a new tab), © Commonwealth of Australia, CC BY 4.0. Tax Practitioners Board website.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.