On 19 August 2026 AUSTRAC published the findings of Operation Claw, a joint analysis of data from 10 major Australian banks. It identified potentially hundreds of millions of dollars in suspected fraudulent loans, mostly linked to properties in Sydney. (AUSTRAC media release)
The headline is a lending story, and AUSTRAC addressed it to lenders. But there is a sentence in AUSTRAC's own customer due diligence guidance that this finding lands on directly, and it is a sentence thousands of newly regulated firms have quietly been relying on since 1 July.
What Operation Claw Actually Found
Worth being precise, because the detail is what makes it useful.
The suspected fraud involved inflated incomes, misrepresented employment, and fabricated or unverifiable business activity used to support loan applications. The project identified cases where offshore or third-party funds were used to complete property settlements and make mortgage repayments.
The activity was not confined to one lender or one borrower group. AUSTRAC named the recurring warning signs across participating banks: falsified or misleading documents, and the repeated use of mortgage brokers, accountants and law firms across multiple loan applications.
Names of individuals and entities potentially involved in submitting false documents have gone to law enforcement and regulatory agencies, including ASIC, the Australian Taxation Office and the Tax Practitioners Board, for intelligence purposes. Some banking relationships have already been ended.
One qualifier AUSTRAC put in itself, and it deserves repeating rather than burying: the project did not identify evidence of widespread money laundering. AUSTRAC CEO Brendan Thomas framed it as exposure rather than proof, saying the weaknesses "could be exploited by criminals seeking to abuse Australia's financial system". This is a control-failure finding, not a laundering verdict.
The Sentence This Complicates
Open AUSTRAC's guidance on source of funds and source of wealth, last updated 29 July 2026, and you find this worked example of when you can stop early:
In some cases, the source of funds or source of wealth may be clear without needing to collect and verify more information. For example, a buyer using a loan from a bank to finance a real estate purchase.
(AUSTRAC, source of funds and source of wealth)
That guidance is current and it is still right most of the time. A bank loan is a genuinely strong signal, because a lender has done real work before releasing money. The same page makes the underlying logic explicit elsewhere: source of funds means how and where the funds were obtained, not which account they arrived from.
Operation Claw is the footnote. It describes, with numbers, the population where the signal fails: where the income behind the loan was invented, where the employment was misrepresented, and where the money that actually completed the settlement came from a third party or from offshore.
AUSTRAC's starter kits make the same assumption in the other direction. The risk assessment templates for conveyancers and real estate treat a high value purchase made without a mortgage as a medium risk factor, and they say why: "Lenders perform in-depth due diligence on clients and properties before providing funds as part of a mortgage. Where a property is bought without a mortgage, there's a significant difference in scrutiny on the buyer." (AUSTRAC, program starter kits)
Read that alongside the media release and the position is clear enough. A mortgage lowers one risk factor. It does not clear the file, and it was never meant to end the enquiry.
The Fragment You Hold
The most quotable line in the release is about information, not fraud.
Each bank may see only one fragment. When those fragments are brought together, the broader pattern becomes clear.
Here is the uncomfortable version of that for a Tranche 2 firm. The bank sees the application: payslips, tax returns, an accountant's letter, a business activity statement. What the bank mostly does not see is the money arriving on the day.
You do. The conveyancer sees who funded the deposit and where the settlement money came from. The real estate agent sees who is actually paying and who keeps appearing beside the buyer. The lawyer sees the structure the purchase is being run through.
AUSTRAC's own starter kit onboarding forms are built around exactly that split. The conveyancing form asks whether the buyer is using a mortgage, loan or other finance from a bank or lender, and then, separately, asks how they are paying, with this instruction attached: if you are using a mortgage, loan, or other finance from a bank or lender, also indicate how you are paying the deposit. (AUSTRAC, program starter kits)
The finance answer does not close the funding question. AUSTRAC wrote the second question into the form on purpose.
Four Things Operation Claw Just Named in Your File
Map the operation's findings onto the indicators AUSTRAC already publishes for the newly regulated sectors (AUSTRAC, risks and indicators of suspicious activity) and the overlap is close to exact.
Third-party or offshore settlement money. Operation Claw found offshore or third-party funds completing settlements and servicing repayments. The published real estate indicators already list a customer who uses third party transfers, private lenders, offshore banks or virtual assets, and a purchase paid by a third party.
Documents that do not sit right. Falsified or misleading documents were the operation's central mechanism. The indicator lists for both real estate and accountants include documents in an unexpected format, or that seem forged or altered.
A profile that does not fund the purchase. Inflated incomes and fabricated business activity are the loan-side version of an indicator you already have: a client whose lifestyle or transactions are inconsistent with what you know about their business and personal information, or who cannot explain their source of funds or wealth.
The same intermediaries, over and over. This is the one that is new in emphasis. AUSTRAC did not describe a single bad file. It described the repeated use of the same brokers, accountants and law firms across multiple applications. A pattern like that is only visible if someone is looking across files rather than down one.
What the Act Requires When One of These Shows Up
Unusual is not the same as illegal, and AUSTRAC says so plainly. Its guidance on responding to unusual transactions and behaviour sets out the sequence: review the activity in context, check the information you already hold, decide on next steps, then document your review and response (AUSTRAC, responding to unusual transactions and behaviour).
Where that sequence leads is set by rule, not by mood.
Enhanced CDD is mandatory in defined circumstances. You must apply it if the customer's ML/TF risk is high, if the service would involve an unusually complex or large transaction, if it has no apparent economic or legal purpose, or if it would involve an unusual pattern of transactions. You must also apply it if you are required to submit a suspicious matter report about the customer and intend to keep providing a designated service (AUSTRAC, enhanced customer due diligence). Collecting or verifying source of funds and source of wealth is one of the listed enhanced CDD measures, which is where a settlement funded by someone else stops being a curiosity and becomes work.
The SMR test is objective. Reasonable grounds means a reasonable person in your position, with similar knowledge, experience or training, reviewing the same material, would form the suspicion. The deadline is 3 business days after the day you form it, or 24 hours for terrorism financing. The obligation applies even if you never end up providing the service, and a fresh suspicion about a customer you have already reported needs its own SMR (AUSTRAC, suspicious matter reports). We walk through what a defensible one looks like in our SMR guide with examples.
Tipping off still binds while you ask. Enhanced CDD usually means asking the client questions, and AUSTRAC's ECDD guidance is explicit that your policies must set out how you manage tipping off obligations while you do it. The line between a due diligence question and a disclosure is worth knowing before you need it (the tipping off rules, in practice).
Write down the decision, including the no. Step 4 of AUSTRAC's own worked response is to keep a record of the alert, the review and the outcome. A file showing you looked at third-party settlement funds and satisfied yourself they were a documented gift from a parent is a defence. A file that is silent is indistinguishable from one where nobody looked (AUSTRAC, record keeping, and what to keep and what to destroy).
The Paragraph Accountants and Law Firms Should Read Twice
Being named in a pattern is not an allegation against any particular practice. Most firms that appear repeatedly across loan applications appear there because they are busy and because a developer or a broker sends them work. That is a normal referral relationship, not a finding.
But two things are now true at once. AUSTRAC has publicly identified repeated professional involvement as a warning sign it looks for, and it has sent names to the ATO and the Tax Practitioners Board for intelligence purposes. And since 1 July 2026 you are a reporting entity in your own right wherever you provide a designated service, which means the client whose numbers you prepared is a client you have your own monitoring and reporting obligations over.
The practical question is not whether you did anything wrong. It is whether you could show, from your own records, how you reached the view that a client's declared income and business activity were what they appeared to be. That is a risk rating question, and a default is not an assessment.
Four Checks This Week
- Find the mortgage shortcut in your program. If your source of funds procedure effectively says "bank finance, no further questions", tighten it to cover the deposit and the payer. That is the gap Operation Claw sits in. Our explainer on source of funds versus source of wealth is the short version to hand your team.
- Add one question to onboarding: who is paying, and from where. Copy AUSTRAC's own form structure. Finance answer first, funding answer second, and record the answer even when it is boring.
- Look sideways across files, not just down them. Pull the last six months of purchases and see whether the same broker, referrer or introducer keeps appearing. You cannot spot a pattern one matter at a time.
- Confirm someone can actually file within three business days. Not a policy that says so. A named person, a login that works, and a decision trail behind it (our SMR and TTR filing walkthrough).
Where AML Mate Fits
AML Mate keeps the source of funds and payer questions inside the client record rather than in someone's memory, carries the answer through to the risk rating, and holds the review trail with dates attached, so a decision you made in March is still evidence in an audit two years later. The free compliance check at /check will show you in about five minutes whether your program still treats a bank loan as the end of the conversation.
AUSTRAC issued its call to arms to lenders. But it also told everyone reading exactly which fragment of the picture it has been missing, and in a property transaction that fragment is usually sitting on your desk.
Two days after Operation Claw, AUSTRAC published a second financial-intelligence story: an illicit tobacco strike whose seizure list reads like a map of the newly regulated sectors. We walk it desk by desk in the seizure list sector map.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.