On 28 August 2026 AUSTRAC announced it has begun issuing section 167 notices to businesses that appear to be providing designated services but have not enrolled under the AML/CTF Act. The notices are going to real estate agents, accountants, lawyers and jewellers, and they require the recipient to provide information so AUSTRAC can determine whether the business is providing regulated services and meeting its obligations. (AUSTRAC, issues notices to non-enrolled businesses)
The quote AUSTRAC's CEO chose for the announcement is the one to sit with: "The time for preparation has passed."
This is the moment the whole year has been pointing at. Not a fine, not a court case. A letter that asks a question you are legally required to answer.
The Regulator Told You Which Line It Would Enforce First
Nobody reading AUSTRAC's own planning documents gets to be surprised by this.
Five days before the notices were announced, AUSTRAC published its regulatory priorities for 2026-27, and named its intervention trigger for the newly regulated sectors in plain words: reporting entities "who haven't enrolled or are recklessly involved in, or complicit with, criminal activity." We wrote at the time that the examiner had published the rubric, and that not being enrolled was the one item on the intervention list a firm could fix in an afternoon.
The notices are that sentence turning into paper. AUSTRAC spent the first two months of the regime on webinars, starter kits and a help line. The education has not stopped, but the agency has now shown it will also go looking for the businesses that ignored all of it. Enrolment was always the visible test of engagement: it is public, it is dated, and a firm that has not done it has, by definition, done nothing else either.
AUSTRAC has not said how it built its mailing list, and we will not guess in detail. It is enough to note that the sectors involved are licensed, advertised and searchable, and that AUSTRAC is an intelligence agency. A business that decided to stay quiet was never invisible. It was just unexamined.
What a Section 167 Notice Actually Is
Section 167 is one of AUSTRAC's information-gathering powers, and the reformed Act sharpened it. A notice can now be issued to any person who has information or a document relevant to compliance with, or enforcement of offences under, the Act and its Regulations. (AUSTRAC, information-gathering powers, updated 25 June 2026)
Three things follow from that, and each one matters to how you respond.
It is a question, not a verdict. A section 167 notice does not fine you and does not accuse you. In this campaign it exists to establish facts: whether you provide designated services, and whether you are meeting the obligations that follow. If your firm genuinely provides none, the notice is where you get to say so, with reasons. Plenty of practices sit outside the regime, and the boundary is the designated service test, not the name on the door. Our walkthrough of that test is the place to start if you are not sure which side you are on.
It is compulsory. AUSTRAC's guidance on these powers is direct: other than the voluntary sharing power in section 49C, there can be serious consequences for failing to comply with a notice. Ignoring the letter is not a neutral act. It converts "we have a question about your enrolment" into "this business does not respond to compulsory notices", which is a materially worse file to be in.
It arrives with its own instructions. AUSTRAC says every notice comes with a covering letter that explains which section of the Act authorises it, why it was issued, what you need to do, and the consequences of not doing it, along with contact details for AUSTRAC staff if anything is unclear or hard to meet. That structure is worth memorising, because of what landed two days before this announcement.
The Same Week, AUSTRAC Warned About Fake AUSTRAC
On 26 August, two days before the notices story, AUSTRAC put out a warning that scammers are impersonating the agency and its staff, using official-looking emails, calls and messages with a false sense of urgency to extract payments and personal details. (AUSTRAC, warns of scammers impersonating agency and staff)
So the genuine article and the counterfeit are now in circulation at the same time, aimed at the same audience: businesses new to the regime who half-expect a letter and do not yet know what one looks like. The distinctions are clean if you know them.
A real section 167 notice asks for information. It names the section of the Act it is issued under, explains itself, and gives you AUSTRAC staff contact details. A scammer asks for money or credentials. AUSTRAC's CEO put it plainly: the agency does not contact people unexpectedly demanding payment, and it will never ask you to pay in cryptocurrency or through apps like WhatsApp or Telegram. Where money is genuinely owed, for levies or infringement notices, AUSTRAC notifies you in writing and gives you time to ask questions first.
The verification move costs one phone call: stop, do not click links, and check through AUSTRAC's official channels before acting. AUSTRAC's Contact Centre is 1300 021 037. Pausing to verify a compulsory notice does not breach it.
If a Notice Lands on Your Desk
- Verify it is real through official channels, not the details printed on the letter alone. One call, then proceed.
- Do not ignore it. Diarise the response date the moment the letter is opened. The consequences that attach to a section 167 notice attach to non-response, whatever your enrolment position turns out to be.
- Answer the actual question. If you provide designated services, say so and get your enrolment moving in the same breath. If you do not, set out what you actually do and why it falls outside the designated services. This is a legal characterisation of your service lines, so a firm with any doubt should take advice before signing.
- Use the door AUSTRAC left open. The announcement goes out of its way to say that contacting AUSTRAC for help is not a red flag, and that the Contact Centre exists to help businesses comply, not to catch out the ones making a genuine effort. Take that at face value.
If You Have Not Enrolled and No Letter Has Come
The standing rule has not changed: you must apply to enrol no later than 28 days after the day you start providing a designated service, through AUSTRAC Online, after which your business appears on the Reporting Entities Roll. (AUSTRAC, enrol with us, updated 30 July 2026) For firms already providing designated services on 1 July, that clock expired on 29 July, and we wrote honestly about what missing it means: the breach continues until you fix it.
What has changed is the cost of drifting. Failing to enrol sits on AUSTRAC's published list of obligations that can attract an infringement notice, and the ladder above that runs through remedial directions and enforceable undertakings to civil penalty orders, with ceilings of 100,000 penalty units for a company and 20,000 for an individual, at $364 a unit from 1 July 2026. (AUSTRAC, consequences of not complying, updated 25 June 2026) Those ceilings are for the worst cases, not for a late suburban practice. But every rung of that ladder reads differently for a firm that enrolled late, unprompted, than for one that waited to be found.
Enrolling late is a form you can lodge this week, the walkthrough is here. A section 167 notice is AUSTRAC lodging it for you, on its timetable, with its questions.
If You Enrolled Months Ago, This Is Still Your News
The comfortable reading is that the letters are for someone else. Mostly true, and still worth a minute of your attention, because campaigns like this reveal sequence. AUSTRAC said through its priorities that engagement, education and supervision remain the plan for the new sectors, and its enforcement debut targets the firms that did nothing at all. That confirms the lane you want to be in: enrolled, program in place, operating it as a routine rather than a binder.
It also tells you what the next question after "are you enrolled?" will be, because the notices ask it already: whether you are meeting your obligations under the Act. Enrolment is, in AUSTRAC's own words, a basic requirement and a first step. The firms that treated 29 July as the finish line have the same gap as the non-enrolled, one rung up: enrolment was never the program.
Where AML Mate Fits
AML Mate exists for the step after the form: the risk assessment, the program, the client due diligence and the dated evidence trail that shows the obligations are actually being met, which is precisely what a notice asks about. The free compliance check takes five minutes and tells you whether your services are designated and where your setup stands, before anyone has to write to you about it.
For fourteen months this regime ran on deadlines announced in advance. As of last week it also runs on letters that arrive unannounced. The difference between the two is entirely about who chooses the timing, and for a business that has not enrolled, that choice is still, for now, yours.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.