AML Mate / Journal
Browse compliance articles, practical guides and commentary for Australian professionals.
37 articles Page 2 of 4
On 28 August 2026 AUSTRAC began issuing section 167 notices to businesses that appear to provide designated services but never enrolled. Here is what a notice actually compels, how to tell a real one from the impersonation scams AUSTRAC warned about two days earlier, and why enrolling late still beats waiting for a letter.
A real client who cannot produce a driver licence or passport is not a dead end. AUSTRAC publishes an alternative identification playbook, and it is more generous than most firms assume. Referee statements, government correspondence, expired ID and, as a last resort, self-attestation are all on the table, provided you assess the risk and write down what you did. Here is the whole toolkit, translated for a suburban practice.
AUSTRAC's regulatory priorities for 2026-27 spell out what newly regulated firms should have done by mid-2027, and who it will intervene against first. The five-line checklist ends with the hard part: policies embedded in daily operations. Here is the document read from a small firm's desk, what each line means, and the three moves worth making this week.
AUSTRAC's illicit tobacco strike seized cash, gold bullion, luxury watches and 280,000 vapes, and restrained $25 million in property and shares. The network ran through legitimate freight businesses, and the asset list reads like a map of the sectors AUSTRAC now regulates. Here is what the operation looks like from inside a client file, and which routine obligations are built to catch it.
Your first AUSTRAC compliance report covers 1 July 2026 to 30 June 2027 and is lodged between July and September 2027, not 31 March. The questions are mostly yes/no answers and counts, and nearly all of them can only be answered from records you keep during the year. Here is what the report asks, the register that answers each question, and the small monthly habit that makes next July boring.
New partner, new office, new service line, a compliance officer who resigned: AUSTRAC expects to hear about it within 14 days of the change. Here is what counts as an enrolment detail, where the update form lives in AUSTRAC Online, and the other 14 day clocks the reformed Act starts every time something changes inside your firm.
AUSTRAC moved the annual compliance report to financial years, so your first one is not due until the 1 July to 30 September 2027 window. Nothing is due this September. But the reporting period it asks about opened on 1 July 2026, which means the answers are being written right now, in the records you either keep or do not.
Every AML/CTF program must be independently evaluated at least once every 3 years, and for newly regulated firms the deadline for the first one is already fixed by the last two digits of the AUSTRAC account number. Here is how to read your date, who is allowed to run the evaluation, what the written report must cover, and why the paperwork about it is due years before the evaluation itself.
The Act created three governance roles in your firm: governing body, senior manager and AML/CTF compliance officer. In most small firms all three are you. Wearing every hat does not merge the duties: some approvals cannot be delegated, one report is owed every 12 months, and AUSTRAC expects records showing each role actually did its job.
A stored risk rating and a risk assessment are not the same thing, and AUSTRAC asks you to keep a record of the second one. If your client files were rated low by a default rather than by a person, the rationale AUSTRAC expects to see does not exist. Here is how to tell the difference, and a three-step check you can run on your own files this morning.
If your practice sits under a trust or holding company that owns something else, you may already be in a reporting group without having chosen one. Business groups become reporting groups automatically, a lead entity has to be appointed in writing within 28 days, and the entity that ends up carrying the group program may be one that has never provided a designated service in its life. Here is the test, the clock, and what you actually get in return.
The AML/CTF Act tells you to collect identity information and keep the record for seven years, which quietly turns your practice into something worth stealing. AUSTRAC's data breach guidance covers that, and it also covers the case nobody expects: a breach at some other organisation that never touches your systems and still weakens every identity check you run. Here is what it expects you to do about both.
