On 30 September 2026 AUSTRAC announced it has begun issuing infringement notices to businesses that failed to enrol under Australia's AML/CTF laws. The notices went to businesses in the real estate, accounting and jewellery sectors that AUSTRAC believes failed to enrol within 28 days of providing a designated service. They were issued at $21,840 for corporate entities and $4,368 for individuals, and AUSTRAC says they can accrue on a daily basis. (AUSTRAC, begins issuing infringement notices to non-enrolled businesses (opens in a new tab))
A month ago we wrote that the letters had started: formal requests for information to businesses that appeared to provide designated services but had never enrolled. We called those notices a question, not a verdict. This is what the verdict looks like for the businesses that did not answer it with an enrolment.
The Sequence Was Published in Advance
None of this came out of nowhere, and the order of events is the useful part.
In August AUSTRAC sent formal requests for information to businesses that appeared to provide designated services without being enrolled. Now, per the release, the enforcement action "follows" those requests. Questions first, then penalties, a little over a month apart. If you want to know what AUSTRAC will do next, it keeps telling you: its published priorities are the rubric.
The release also gives the result of the question stage, and it is the most reassuring number in it. Of the group of businesses AUSTRAC had enrolment concerns about, around 90 per cent have now enrolled or attempted to enrol. The infringement notices are aimed at what is left: in the CEO's words, "the small number that continue to ignore their obligations."
That is a regulator drawing a line between late and absent. Late firms that moved when asked are in the 90 per cent. The notices are for the ones who did not move.
What the Numbers Actually Say
The two figures are not arbitrary. AUSTRAC fines are calculated in penalty units, and for contraventions on and from 1 July 2026 one penalty unit is $364. (AUSTRAC, consequences of not complying (opens in a new tab), updated 25 June 2026) So $21,840 is 60 penalty units for a company, and $4,368 is 12 for an individual.
Put those beside the ceiling for the same regime. A civil penalty order from the Federal Court can reach 100,000 penalty units for a body corporate and 20,000 for anyone else. An infringement notice is one of four enforcement tools AUSTRAC lists, alongside remedial directions, enforceable undertakings and civil penalty orders, and at 60 units it is priced a very long way below that ceiling.
That is the reassuring reading. The less reassuring one is in three words from the release: "accrue on a daily basis." Failing to enrol is not a single missed date. It is a continuing state, and the release says plainly that the cost can keep running while it continues.
There is also a cost that is not in dollars. AUSTRAC says infringement notices may be made public, and it publishes the ones it issues alongside its other enforcement actions. For a real estate agency or an accounting practice whose business runs on trust, being on that page is its own penalty.
Who Is Next
The first notices named three sectors: real estate, accounting and jewellery. The August requests for information also went to lawyers, so the absence of legal practices from this round is not a clean bill of health for anyone. AUSTRAC is explicit that this is a beginning: "We are actively looking for businesses that haven't enrolled and we will issue more infringement notices where necessary."
The standing rule has not moved. You must apply to enrol no later than 28 days after the day you start providing a designated service, and once enrolled your business sits on AUSTRAC's Reporting Entities Roll. (AUSTRAC, enrol with us (opens in a new tab), updated 18 September 2026) For firms already providing designated services on 1 July, that window closed on 29 July. We covered what missing it means at the time: the breach does not expire, it continues until you fix it.
If You Have Not Enrolled
AUSTRAC's own advice in the release is the right advice: "now is the time to come forward, get in touch with AUSTRAC and get enrolled." In order:
- Confirm you are in. The test is whether you provide a designated service, not what industry you are in. Our walkthrough of the designated service test covers the lines firms most often misread. Do not enrol defensively if you are genuinely outside: AUSTRAC notes that while you stay on the Roll you keep obligations such as the annual compliance report.
- Enrol this week. It is a form in AUSTRAC Online, and our enrolment walkthrough still applies step for step. The deadline in the title has passed; the steps have not changed.
- Call if you are unsure. On the same day as the release, 30 September, AUSTRAC renamed its contact centre AUSTRAC Central, and said in that announcement that contacting it for guidance will not increase regulatory scrutiny. (AUSTRAC, meet AUSTRAC Central (opens in a new tab)) Take that at face value. The businesses receiving notices are the ones that stayed silent, not the ones that asked.
If an AUSTRAC request for information or notice has already arrived, respond to it by its date, and take advice before you characterise your services in writing. Our section 167 guide covers how to verify a notice is genuine, which matters: AUSTRAC warned in August (opens in a new tab) that scammers are impersonating it.
If You Enrolled Months Ago, Read the List Anyway
The comfortable reading is that this story is about someone else. For enrolment, it is. But look at the list of obligations AUSTRAC says can attract an infringement notice, of which enrolling is only one. It also includes designating a compliance officer and notifying AUSTRAC, documenting, approving and following your AML/CTF program, customer due diligence, reporting, notifying AUSTRAC of changes, complying with notices, and record keeping. (AUSTRAC, consequences of not complying (opens in a new tab))
The first round of notices went after the one failure that is public and binary: you are either on the Roll or you are not. The rest of that list is harder to see from outside, which is why it is tested by examination rather than by a search of the Roll. The release itself says businesses covered by the laws "must be enrolled and taking steps to understand their obligations, assess their risks and put appropriate controls in place."
A few of those are easy to let slide in a small firm, and each has a clock of its own. Enrolment details that change need updating within 14 days. The first annual compliance report will ask about the year that started on 1 July. And a program that exists but is not being followed is on the same list as one that does not exist. Operating the program as a routine is the protection, not the binder.
Where AML Mate Fits
AML Mate is built for the part after enrolment: a risk assessment and program that match what you actually do, client due diligence that leaves a dated record, and reminders for the clocks that keep running once the big deadlines are gone. If you are not sure whether you should be enrolled at all, the free compliance check starts by asking which designated services you provide, then scores your readiness across the six core obligations. No signup needed.
Three months ago the regime ran on deadlines. A month ago it added letters. Last week it added fines, with a promise of more. For the 90 per cent who answered, the message is that the routine now matters more than the paperwork. For the rest, AUSTRAC has already said what happens next.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.