The 29 July enrolment deadline has passed. If you got it done, congratulations, you are on AUSTRAC's radar in the way you are supposed to be.
Now look at your calendar. There is nothing in it.
That is not an oversight. It is the shape of the regime you just joined, and it is the single most dangerous moment in a Tranche 2 firm's first year.
The next date AUSTRAC gives you is nearly a year away
The annual compliance report is the one recurring thing AUSTRAC asks every reporting entity to submit on a fixed schedule. The reporting period is now the financial year, and you submit within 3 months of the period ending, so the window runs 1 July to 30 September each year (AUSTRAC, annual compliance reports).
Your first period as a Tranche 2 entity is 1 July 2026 to 30 June 2027. Which means the first time AUSTRAC asks you for anything on a date is 1 July 2027.
The two other scheduled obligations are just as far out. You must review your risk assessment at least once every 3 years (AUSTRAC, review and update your AML/CTF program), and an independent evaluation must happen at least once every 3 years (AUSTRAC, conduct an independent evaluation).
So: eleven months of empty diary.
What replaced the dates
Everything that actually matters between now and July 2027 starts when something happens, not when a date arrives. Three clocks, and you are the one who has to start them.
You form a suspicion. You must submit a suspicious matter report within 24 hours if it relates to terrorism financing, and within 3 business days after the day you formed the suspicion for everything else. If you are claiming legal professional privilege over part of it, you get up to 5 business days, and that extension does not apply to terrorism financing (AUSTRAC, suspicious matter reports).
Read that again: the clock starts when you form the suspicion. Nobody tells you it has started. There is no notification, no portal reminder, no email. If you notice something on a Tuesday and get to it the following week, you are late, and the record of when you noticed is the thing that proves it.
A client pays you $10,000 or more in physical currency. A threshold transaction report is due within 10 business days after the day the transaction takes place (AUSTRAC, threshold transaction reports). Same structure. The event starts the clock.
You take on a new client, or an existing relationship changes. Customer due diligence happens before you provide the designated service, not after. We covered how this plays out for clients you already had in pre-commencement customers, and the day-to-day rhythm in how to actually run your program.
Why firms stop here
We watch how firms use this stuff, and the pattern is consistent enough to be uncomfortable.
A firm signs up, works hard for three or four days, generates the program, gets the AUSTRAC registration details in, runs a couple of clients through, exports the evidence pack. Then nothing. Weeks of nothing.
They are not lazy and they are not ignoring the law. They finished the thing that had a deadline. Every signal they had been responding to since March was a date, and the dates ran out.
The problem is that "nothing on the calendar" and "nothing to do" feel identical from the inside, and only one of them is true. A firm that does nothing between now and July 2027 has not paused its obligations. It has just stopped creating the evidence that it met them.
A checkpoint you set yourself: 31 August
Since AUSTRAC will not give you a date for another eleven months, use one of your own. Thirty days is enough to be useful and short enough to actually happen.
By the end of August, your file should contain things that did not exist in July:
Named people, in writing. Your compliance officer notification was due by 29 July, but the harder question is who covers it when that person is on leave, and whether anyone else has been trained. Training is an obligation in its own right, not a nice-to-have.
At least one client through the full process, end to end. Not a test record. A real client, identified, risk rated, screened, with the outcome written down and the date on it. If you cannot point at one, the program is still theoretical.
A written answer to "what would make us suspicious?" Generic red flags are worthless in an examination. Your answer should mention your actual services and your actual client base. A conveyancer and a jeweller do not get suspicious about the same things.
Evidence you looked, on days when nothing happened. This is the one everyone misses. Compliance that only leaves a trace when something goes wrong looks, from the outside, exactly like compliance that was never happening. Monitoring you can prove is worth more than monitoring you did.
A diary entry for the risk assessment review. It is due within 3 years, which means everyone will forget. Put it in now.
The record-keeping trap while you are in there
Records generally have to be kept for 7 years (AUSTRAC, record keeping overview). Most firms hear that and start hoarding scans of passports and licences.
Do not. The amended Act narrowed what you keep. You keep the record of what you did, the information you collected, the method you used and the outcome. You are not required to keep copies of the identity documents themselves, and holding them longer than you need is now a privacy problem rather than a compliance one. We wrote that up separately in what to keep and what you now have to destroy.
This trips up careful firms specifically because they are careful. Keeping more feels safer. Here it is not.
Where AML Mate fits
Most of this is calendar and evidence discipline, which is exactly the kind of thing that quietly stops happening when nobody is watching. Screening runs on a schedule instead of when you remember. Reporting deadlines surface before they are due rather than after. The audit pack shows what you did on the quiet days, not just the eventful ones.
If you have already built your program, the self-assessment takes about five minutes and will tell you which of the August items you are actually missing.
The deadlines are done. What you do in the next eleven months is what an examination will eventually be about.
This article is general information, not legal advice. For advice specific to your circumstances, consult a qualified AML/CTF professional.