By 30 July 2026, AUSTRAC had enrolled 13,010 accounting and professional services firms, 6,360 law practices, 17,460 real estate businesses, 1,580 conveyancers and 250 dealers in precious metals and stones (AUSTRAC, enrol with us). Call it 38,660 enrolment forms, each one a snapshot of a business on the day someone hit submit.
Here is the part almost nobody read on the way through: the snapshot is supposed to stay true. If details about your business or the designated services you provide change, you must update your enrolment details within 14 days of the change occurring (AUSTRAC, enrol with us).
Firms move offices. Partners join and leave. Practices get sold, merged, renamed and wound down. Every one of those ordinary events is now also an AUSTRAC event, and the regime's answer to "by when?" is almost always the same: 14 days from the thing happening. Nobody sends you a reminder, because nobody but you knows the clock started.
What counts as an enrolment detail
Think back to what the form asked for: your legal name, any business names you trade under, your ABN, contact details, the designated services you provide, and your key personnel (AUSTRAC, enrol a new business). It also asked you to name your AML/CTF compliance officer, which is why that one field felt like nominating a contact person and turned out to be rather more.
Any of that going stale is a change AUSTRAC expects to hear about within 14 days. In an ordinary small firm year, the realistic triggers look like this:
- You rebrand, or start trading under an additional name.
- You move, or your phone number or email changes. This one is quietly important: AUSTRAC's default way of reaching you is your AUSTRAC Online account and the email on file. An enrolment pointing at a departed staff member's inbox means official correspondence lands where nobody is reading.
- A partner or director joins or leaves, which changes your key personnel.
- You start or stop offering a designated service. An accounting practice that begins acting on property settlements, or a real estate agency that adds buyers' agency work, is not just growing. It is changing the answer it gave AUSTRAC.
The update itself is not a phone call. You log in to AUSTRAC Online, select the business, and choose Update Enrolment details, which opens a form pre-populated with what you told them last time. You review it, correct what changed, and submit (AUSTRAC, enrol a new business).
Two mechanical traps in that form, both documented by AUSTRAC: a saved draft expires after 14 days, and a submitted form cannot be edited, so a mistake means submitting another one (AUSTRAC, enrol a new business). Do not start the update on the day the clock runs out.
The compliance officer has clocks of his or her own
The change most likely to actually happen in the next year is also the most regulated one: the person you named as AML/CTF compliance officer stops being available. They resign, retire, go on extended leave, or stop being eligible.
The rule set is specific. You must appoint an AML/CTF compliance officer within 28 days of providing designated services, and you must notify AUSTRAC within 14 days of the appointment, using the enrolment form on AUSTRAC Online. The same requirements apply if your compliance officer leaves your business or becomes ineligible (AUSTRAC, AML/CTF compliance officer).
So a resignation starts two timers, not one: a 28 day window to appoint the replacement, then 14 days from that appointment to tell AUSTRAC. And the replacement is not just a name. The eligibility and vetting expectations that applied to the first appointment apply again, which means personnel due diligence on the new appointee, with records showing why they qualified (AUSTRAC, AML/CTF compliance officer).
In a sole practice, where you are the compliance officer, this section reads as irrelevant right up until you sell, merge or bring in a partner. Then it is the first thing that changes.
The change that needs paperwork before it happens
One category of change works backwards. If you are about to change your business in a way that is within your control, adding a service, opening a new delivery channel, moving service delivery online, AUSTRAC expects you to review and update your risk assessment before making the change, not after (AUSTRAC, review and update your AML/CTF program).
AUSTRAC's own worked example is a business that delivers services in person and plans to go online. Because the change is within the business's control, the risk assessment review comes first: identify the new risks, get senior manager approval for the updates, and notify your governing body in writing (AUSTRAC, review and update your AML/CTF program).
Then the documentation clock starts. Updates to your risk assessment or your AML/CTF policies must be documented in your program within 14 days of making the update, with the dates the changes were made (AUSTRAC, review and update your AML/CTF program). The same 14 day documentation rule applies to program updates generally once your program is approved and implemented (AUSTRAC, manage and mitigate your risks), and to updates you make after an independent evaluation finds problems.
Notice the ordering for a new service line: risk assessment first, then policies, then the enrolment update telling AUSTRAC your designated services changed. The enrolment form is the last step of that sequence, not the whole obligation.
Leaving the regime is also a form
The regime has an exit, and it is not silence. If you no longer provide any designated services, you must request a Reporting Entity Roll Removal, through AUSTRAC Online, under Business Profile, Remove from RE Roll (AUSTRAC, enrol a new business).
This is the one that catches retirements, practice sales and wind-downs. Simply stopping, letting the subscription lapse, ceasing to lodge, leaves you on the Reporting Entities Roll as a business that appears to have obligations and is meeting none of them. If the practice is genuinely done providing designated services, ask to come off the roll. And before anyone celebrates, the records you created while enrolled still have a retention life of their own.
The habit that makes this survivable
None of these clocks appears in a calendar, because none of them exists until something happens. That is the same shape as the SMR, TTR and CDD triggers: the regime hands you almost no dates, and in exchange expects you to notice your own events.
The fix is boring and takes ten minutes. Once a month, preferably attached to something you already do like the bank reconciliation, ask one question: did anything about the firm change this month? People, premises, names, services, structure. If yes, three follow-ups:
- Does the enrolment snapshot in AUSTRAC Online still match reality? If not, update it, and check the 14 days have not already run.
- Did the change touch risk, a new service, a new channel, a new client type? Then the risk assessment review comes first, and the update gets documented within 14 days.
- Did it touch people, especially the compliance officer or key personnel? Then the appointment and notification clocks in AUSTRAC Online are running.
A firm that asks that question monthly can never be more than about five weeks out of date. A firm that never asks it is betting that nothing changed since winter, and by next March that is rarely true.
Where AML Mate fits
AML Mate keeps the operational side of this honest: your program, risk assessment and policy versions live in one place with dates stamped, so when a change lands, the program editor shows what was updated and when, and the audit export proves the 14 day documentation happened. The monthly "did anything change?" check takes minutes when the current state of the program is not a matter of memory.
If you have not looked at your enrolment since the rush to get it lodged in July, the free self-assessment takes about five minutes, and logging in to AUSTRAC Online to reread your own answers takes about ten. Between them you will know whether the snapshot AUSTRAC holds still describes the firm you actually run.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.