On 27 October, Australian Federal Police officers searched two homes in Strathfield and Burwood with AUSTRAC's help. They found an estimated $750,000 in cash in two grocery bags, along with luxury handbags and watches, a cash-counting machine and electronic devices. A 40-year-old Sydney man was charged the next day (AFP, 28 October 2026 (opens in a new tab)).
On 3 November AUSTRAC published its own account of the case, and the phrase it chose is the one worth keeping. The network allegedly converted criminal cash into cryptocurrency and moved funds offshore "through shell companies operating as corporate money mules" (AUSTRAC, 3 November 2026, node 1796 (opens in a new tab)).
A money mule is usually a person who lets their bank account receive and pass on someone else's money. A corporate money mule does the same job with a company. And a company is something a Tranche 2 firm may have formed, given an address, or put a director into.
The case in brief
Everything below is alleged. Nothing has been tested in court.
- The network is suspected of laundering more than $123 million for multiple organised crime syndicates (node 1796 (opens in a new tab)).
- Taskforce Avarus, an AFP-led initiative with AUSTRAC, the ACIC and the ABF, began investigating in February 2026 (AFP (opens in a new tab)).
- The AFP will allege the Sydney man controlled shell company bank accounts used to transfer millions of dollars in criminal proceeds, which were then converted into cryptocurrency or sent overseas.
- He faces two counts of recklessly dealing with proceeds of crime, one for $10 million or more and one for $100,000 or more. He was refused bail, and the investigation is continuing.
AUSTRAC calls it crime as a service, where "specialist criminal networks can provide the infrastructure needed to move, convert and disguise the proceeds generated by other criminal activity." CEO Brendan Thomas listed what that infrastructure is made of: "cash, bank accounts, companies, cryptocurrency or moving money offshore" (node 1796 (opens in a new tab)).
Nothing published says an accountant, lawyer or any other professional set up or ran the companies in this case. That isn't why it matters to you. It matters because of the third item on Thomas's list.
Why this one lands on Tranche 2 firms
Since 1 July 2026, the services that create and maintain companies are regulated. Table 6 of the Act lists nine professional designated services, and AUSTRAC says seven of them relate to a body corporate or legal arrangement (items 2, 4 and 6 to 9) or to shelf companies (item 5) (AUSTRAC, professional designated services, node 1280 (opens in a new tab), last updated 25 September 2026). The ones a shell company touches most directly:
- Creating it (item 6). This includes preparatory steps such as registering applications and forms with ASIC to register a company. AUSTRAC says your customer is the person giving you instructions, and for a new company it names who that is: the company's proposed beneficial owners and directors.
- Selling one off the shelf (item 5). The customer is the buyer or transferee.
- Putting in a director, or holding the shares (items 7 and 8). Acting as, or arranging for someone else to act as, a director or secretary on someone else's behalf, or as a nominee shareholder. The customer is the nominator, the person you are acting for.
- Giving it an address (item 9). Making your address available as its registered office or principal place of business. The customer is the company. We went through how item 9 works in September.
Compare that with routine bookkeeping. AUSTRAC's own example of a bookkeeper paying a client's regular bills on fixed instructions concludes it is less likely to be managing the client's money as a designated service. The examples it gives of other services that would change that picture are business address services and arranging for someone to act in a role in a company or legal arrangement (node 1280 (opens in a new tab)).
The AFP's closing line in its release was aimed at people who help on purpose: "This arrest should serve as a warning to anyone providing financial services to organised crime: you are an essential part of the criminal business model." The AML/CTF regime is aimed at everyone else. That means the firm that would never knowingly help, and still might, if nobody asks what the company is for.
What a mule company looks like, in AUSTRAC's words
AUSTRAC's risk insights for accountants and for legal professionals use the same words about shell companies. Companies "without ongoing business activities or assets" may be used for transactions, but "they can also hide beneficial ownership", and criminals may use them "to add legitimacy to their operations" (accountants, node 1364 (opens in a new tab), last updated 10 July 2026; legal professionals, node 1365 (opens in a new tab), last updated 8 October 2026).
The indicator lists on those two pages read like a mule company seen from three desks.
At formation. A client who:
- asks for a large volume of company or trust creations at one time
- wants to create or use shell or shelf companies "to distance themselves from funds"
- asks to buy aged shelf companies rather than set up new ones
- says they have a business entity "without any, or enough, knowledge about their business, its operations or sector"
In the officer and shareholder roles. AUSTRAC warns that criminals may appoint "a family member, associate, or professional as a nominee director or shareholder", hiding ownership while effectively staying in control (node 1365 (opens in a new tab)). Where you act as nominee, "you should understand the reasons", verify the identity of the beneficial owner and make sure their purpose is legitimate (node 1364 (opens in a new tab)). A request for a nominee shareholder service with no obvious reason is an indicator in itself (node 1365 (opens in a new tab)).
In the money. If you see the company's accounts, the mule pattern has a recognisable shape. The accountant indicators include:
- accounts "used for pass-through activities. For example, to receive and forward funds to others"
- money moved in and out of an account on the same day, or within a short period, without a legitimate reason
- cryptocurrency or other virtual assets that don't match the client's profile
- frequent overseas transfers that don't match their profile
- funds received into several accounts, then consolidated and sent overseas
- transactions inconsistent with the declared business, "for example, no payroll payments"
- one company used for trade before quickly being replaced by a new one
And the address itself: AUSTRAC lists providing a registered or correspondence address among the accounting services criminals exploit, because it "helps criminals hide their true location and make their activities appear more legitimate" (node 1364 (opens in a new tab)).
No single item proves anything. Plenty of honest holding companies have no staff and move money between related entities. The indicators matter in combination, and only if someone at your firm is in a position to notice the combination.
Three questions that catch most of it
Your CDD already makes you ask these. A case like this is a reason to ask them properly rather than tick them.
1. Who actually controls it? A beneficial owner is an individual who directly or indirectly owns 25% or more of the customer, or controls it, and you must follow the chain of ownership until you reach the individuals (AUSTRAC, ownership and control structures, node 1343 (opens in a new tab)). The allegation in this case is about who controlled the bank accounts. The director on the ASIC extract tells you who signs. It doesn't always tell you who decides.
2. What is the company for? You must establish the nature and purpose of the business relationship with a company client. AUSTRAC expects you to collect the customer's general commercial activity and the reasons it wants your services, because that baseline is what lets you notice when the way your services are used is inconsistent with what you were told (AUSTRAC, initial CDD for a body corporate, node 1308 (opens in a new tab), last updated 25 August 2026). Write the answer down in a form you could test later: what it sells, to whom, and roughly how much money should move through it.
3. Where does the money come from? AUSTRAC names the "use of shell companies or complex trust or corporate structures that have obfuscated beneficial ownership" as a risk best managed by establishing source of funds and source of wealth (AUSTRAC, enhanced CDD, node 1321 (opens in a new tab), last updated 15 July 2026). A structure that seems built to hide its owner is where the enhanced CDD questions start.
When the answers don't add up
You must submit a suspicious matter report if you suspect on reasonable grounds that information you have may be relevant to crime, among other grounds. The deadline is 24 hours if the suspicion relates to terrorism financing, and 3 business days after the day you formed it for anything else (AUSTRAC, suspicious matter reports, node 1338 (opens in a new tab), last updated 9 September 2026).
One line on that page fits this case closely. SMR obligations apply when you start or propose to provide a designated service, or someone asks for one, and "the obligation applies even if you don't end up providing the designated service." AUSTRAC's reason is that criminals may "test the market" to find vulnerabilities with certain providers (node 1338 (opens in a new tab)). So the client who wanted six companies by Friday, and left when you asked what they were for, hasn't taken your obligation with them.
Be careful what you say on the way out. Tipping off is a criminal offence (AUSTRAC, tipping off, node 1178 (opens in a new tab)), and our tipping-off guide covers what that rules out. For writing the report itself, see the SMR guide.
Check this week
- List every company using your address. Item 9 clients are easy to forget because they rarely generate work. For each one, can you name the beneficial owner and say in a line what the company does?
- Find the batch formations. Look for any client for whom you formed or sold several companies in the past year. Is there a reason on file for each company, not just for the client?
- Review your director and nominee arrangements. For every company where you act as, or arranged, a director, secretary or nominee shareholder: who is the nominator, and is the reason written down?
- Read one set of books looking for a mule. Pick a company client whose transactions you see. Money in and straight out, no wages, overseas transfers: if that is the picture, take it to your compliance officer today. If an SMR is needed, it is due within 3 business days after the day you form the suspicion.
Where AML Mate Fits
A company client's file in AML Mate starts from its ASIC extract. Upload the current extract and AML Mate reads the directors, shareholders and share structure, then you confirm each beneficial owner, verify them and screen each one against PEP and sanctions lists. The same file holds a guided source of funds and wealth enquiry and, if it comes to that, guided preparation of a suspicious matter report. If you aren't sure which designated services your firm provides, the free compliance check starts there and doesn't need a signup.
This article is general information, not legal advice. It relies on AUSTRAC's article of 3 November 2026 and the AFP's media release of 28 October 2026. The charges are allegations that have not been tested in court, and nothing published suggests that any accountant, lawyer or other professional was involved. For advice specific to your circumstances, consult a qualified AML/CTF professional.