On 1 July 2026, AUSTRAC's regulated population went from roughly 19,000 businesses to close to 100,000, almost overnight. Accountants, lawyers, conveyancers, real estate agents and dealers in precious metals and stones are now reporting entities for the first time.
That number is the whole story for a lot of small firms, and most are reading it exactly backwards.
The common reaction is: "There are 100,000 of us now. AUSTRAC has a few hundred staff. A firm my size will never get looked at." It feels like safety in numbers. It is the wrong bet, and it is worth understanding why before the 29 July enrolment deadline, which is now about two weeks away.
AUSTRAC cannot look at everyone, so it triages
Start with the true part. AUSTRAC genuinely cannot audit 100,000 entities. Supervising a register five times its previous size, across professions it has no prior regulatory relationship with, is a real operational problem. So it will not try to look at everyone. It will triage.
The mistake is assuming triage is random, or that it works in your favour because you are small. It is neither. Triage means AUSTRAC uses the information it has to decide who to look at first, and being small does not remove you from that list. It just changes which signals put you on it.
The dividing line is effort, not size
AUSTRAC has been unusually clear about its early enforcement posture. Its consistent message is that the first focus is on businesses that wilfully ignore their obligations, not those making a genuine effort to comply. In its own words: it does not expect perfection immediately, but it expects to see genuine effort.
Read that as two piles.
- The good-faith pile. You have enrolled. You have an AML/CTF program, even a work-in-progress one. You are applying customer due diligence and can show you are trying. If AUSTRAC looks at you, the story your file tells is "a small firm getting it done."
- The wilful pile. You have not enrolled by the deadline. You have no program. You are providing designated services as if nothing changed on 1 July. If AUSTRAC looks at you, the story is "a firm that ignored the law."
Size does not decide which pile you are in. Effort does. And AUSTRAC has told you which pile it opens first.
The signals that pull a small firm onto the list
If size is not the trigger, what is? These are the signals a risk-based regulator uses to pick who to look at, and every one of them is within your control:
- Enrolment gaps. AUSTRAC can see which businesses provide designated services and cross-check that against who has enrolled. A firm that plainly should be on the register and is not is one of the easiest entities in the country to identify. Not enrolling is not hiding. It is raising your hand.
- Reporting that does not match your profile. As we covered in why zero suspicious matter reports is now a red flag, AUSTRAC reads its own reporting data for firms whose activity looks inconsistent with their sector.
- Complaints and referrals. A disgruntled client, a bank that de-risks you, another regulator, or a professional body can put your name in front of AUSTRAC without you ever knowing.
- Sector campaigns. AUSTRAC has repeatedly picked a sector, studied a sample, and used what it found to write to the rest. Real estate and the professions are obvious candidates for that treatment.
None of these care whether you are a sole trader or a national firm. They care whether you look like someone who is trying.
Why "they'll never find me" ages badly
The "safety in numbers" bet has a second flaw: it assumes the population stays at 100,000 unexamined firms forever. It will not. AUSTRAC is building its triage systems now, and its history is to work through a sector methodically, one cohort at a time, using each finding to justify the next round. "We have not heard from AUSTRAC" is not a compliance position. It is a place in a queue that is being built as you read this.
And the tool it reaches for first is rarely a courtroom. As the enforcement pattern of the last year shows, AUSTRAC increasingly uses administrative powers, external audit orders and infringement notices, which are fast, do not need a court, and land on the firm, not the regulator, to pay for.
The cheapest move onto the right side
Here is the practical part, with about two weeks on the clock. You do not need a perfect compliance program by 29 July. You need to be on the right side of the line AUSTRAC actually drew. That is a much lower bar, and it is mostly one action:
- Enrol. Enrolment is free and it is the single clearest signal that you are in the good-faith pile rather than the wilful one. Missing the 29 July enrolment deadline is the one mistake that is hard to explain away later.
- Have a program, even a draft. A documented AML/CTF program and risk assessment, in place and being applied, is the evidence of genuine effort AUSTRAC says it wants to see. It does not have to be finished to count.
- Apply CDD and keep records. Start with new and higher-risk clients. A file that shows you are doing the checks beats a perfect policy that nobody follows.
That is the whole move. It is the difference between being a firm AUSTRAC can see is trying, and a firm it can see did nothing. For more on what "genuine effort" looks like when you are not going to be perfect in time, see what AUSTRAC actually expects.
The takeaway
There are not 100,000 businesses hiding from AUSTRAC. There are 100,000 businesses AUSTRAC will sort into two piles, and the sort is by effort, not size. Being small does not keep you off the list. Not enrolling, and having nothing to show, is what puts you at the top of it. The good news is that getting onto the right side is cheap, fast, and mostly done by one deadline that is 15 days away.
AML Mate gets a small firm from nothing to enrolled, with a documented AML/CTF program, client CDD and screening, in an afternoon rather than a project. Run a free compliance check to see exactly what applies to you, or view pricing and be on the right side of 29 July.