AML/CTF compliance questions, answered

AUSTRAC regulates designated services with a geographical link to Australia. These include certain services provided by accountants, lawyers, conveyancers, real estate professionals, trust and company service providers, and dealers in precious metals and stones. Your obligations depend on the services you provide, not just your job title or business size.

Tranche 2 is the expansion of Australia's AML/CTF regime to cover designated non-financial businesses and professions: accountants, lawyers, conveyancers, real estate agents, and dealers in precious metals and stones. Introduced by the AML/CTF Amendment Act 2024, the obligations commenced on 1 July 2026, bringing an estimated 90,000+ businesses under AUSTRAC supervision for the first time.

A designated service is an activity specified in the AML/CTF Act. Coverage depends on the exact service, conditions and geographical link to Australia, rather than your job title alone. Examples include certain real estate brokering, conveyancing, company formation and client-money services. Review the official service definitions and exceptions. The free check can help you identify questions to investigate; it is not a legal determination.

• Check the services for your industry

Being small or operating as a sole trader does not by itself remove AML/CTF obligations. Check whether your services fall within the regulated definitions, their geographical link and any applicable exemption. Your program should reflect the nature, size, complexity and risks of your business.

If you provide a designated service you must be on the AUSTRAC Reporting Entities Roll. Enrolment opened on 31 March 2026 and Tranche 2 entities were required to be enrolled by 29 July 2026, so that date has now passed. If you are not enrolled yet, do it now. If you start providing a designated service from here on, the standing rule is that you must apply to enrol no later than 28 days after the day you start. Enrolment is free. AML Mate includes a step-by-step registration tracker that assembles the exact details AUSTRAC asks for.

• Create your AUSTRAC Online account
• Enrol your business step by step

Check whether you provide a designated service with a geographical link to Australia. If you do, you must apply to enrol no later than 28 days after the day you start providing it. If that deadline has passed, act promptly and contact AUSTRAC if you need help. Complete the enrolment form in AUSTRAC Online. Creating an AML Mate account does not enrol your business.

• How to enrol your business in AUSTRAC Online

Civil penalties under the AML/CTF Act can reach up to $36.4 million per contravention for companies (100,000 penalty units) and $7.28 million for individuals (20,000 penalty units), calculated at $364 per penalty unit (from 1 July 2026). Penalties apply per contravention and can stack. AUSTRAC can also issue infringement notices, enforceable undertakings, and remedial directions.

You can develop your own program. AUSTRAC provides guidance and industry starter kits, but you must check every eligibility criterion before using a kit. Tailor the program to your services and risks, have it approved and implement it. Seek independent advice where your circumstances are complex or uncertain.

• Find your industry guide

No. A generated document is a starting point. Your business must tailor its program to its risks, have it approved by a senior manager, apply it in daily operations and keep it current. AML Mate supports that work; it does not certify compliance or provide legal advice.

Your business details, services and risk answers feed a rules-based risk assessment and prefilled program templates. You can edit the program and use AI assistance for supported fields. Review the output against your actual practice before approval and use. Generated text is not a legal opinion or a compliance certificate.

• See what the product includes

Reporting entities must appoint a suitable AML/CTF compliance officer to oversee and coordinate day-to-day compliance. A small practice owner may fill the role if they meet the requirements. For newly regulated businesses, the transitional notification deadline is the later of 14 days after enrolment and 29 July 2026. Appointment and notification are separate requirements; check AUSTRAC's guidance for your circumstances.

• Understand officer notification and transitions

AUSTRAC requires training for personnel who perform functions relevant to your AML/CTF obligations, which is not necessarily everyone on the payroll, and it must be given when a person is engaged and on an ongoing basis afterwards. AUSTRAC also expects the training to suit the functions that person actually performs. AML Mate includes eight modules: five core modules that must all be completed before training counts as complete, and three optional modules you can assign on top. Staff are invited by email and complete their modules without an account, so the number of people you train does not affect your plan.

The time depends on your services, business risks, existing records and the review your program needs. AML Mate can help prepare the documents, but generating them is only one part of the work. Your business also needs to implement its program and keep it current. There is no fixed software completion time that establishes compliance.

No. AML Mate provides software and information based on AUSTRAC's publicly available guidance and Starter Kits. It does not provide legal advice or certify compliance. Seek independent advice when reviewing and implementing your AML/CTF program, especially for complex business structures.

Customer due diligence means understanding who your customer is and the risks of providing services to them. It includes identifying and verifying relevant customer information, understanding ownership and control where applicable, assessing risk and conducting ongoing reviews. Initial CDD generally comes before a designated service, subject to specific exceptions. The evidence required depends on the customer and risk; photo ID is not the only permitted approach.

Hosted identity verification sends the client to a provider's document and selfie check and returns the result to their file. Where enabled, RapidID offers a separate DVS document-data matching option with separate pricing. Sanctions and PEP screening and ABN Lookup are distinct checks; an ABN match alone does not verify all company ownership or control. Plans include 5, 20 and 50 hosted ID checks per month on Essentials, Professional and Business respectively. Check availability and charges before starting a verification.

• Review check allowances and prices

Not automatically. First establish whether the client qualifies as a pre-commencement customer for the relevant designated services. Initial CDD is triggered if an SMR obligation arises, or a significant change in the nature and purpose of the relationship results in medium or high risk, even if the client was already medium or high risk. Complete initial CDD before providing the next designated service when a trigger applies. Ongoing CDD still applies. The separate transition for eligible existing reporting entities is not a blanket catch-up deadline for Tranche 2 clients.

• Read the customer transition guidance

The AML/CTF Act does not require copies of identification documents. Keep the relevant information, verification steps and outcomes needed to demonstrate CDD. Other laws may require copies in particular circumstances. AML Mate retains verification records; hosted verification images stay with the provider. Uploaded files classified as ID documents have a separate deletion policy, described below under data retention. Do not treat that policy as permission to delete other required records.

AML/CTF retention periods depend on the record type and trigger; CDD records are generally kept for seven years after the relationship ends or the occasional service is provided. AML Mate's retention process removes eligible personal data after the recorded relationship-end retention period. Uploaded ID-document files are eligible for deletion 90 days after CDD completion, with a 365-day upload backstop if CDD remains incomplete. That is a product policy for ID files, not a statutory 90-day rule for every document. Hosted verification images stay with the provider. A deletion request does not override a legal retention requirement; seek advice about specific requests.

• Read our privacy policy

No. AML Mate helps you prepare SMR and TTR records and an internal annual summary. You submit the required reports yourself through AUSTRAC Online. Saving, exporting or marking a record as lodged in AML Mate does not send it to AUSTRAC or confirm that AUSTRAC accepted it.

• Follow the AUSTRAC Online tutorials

An SMR concerns reasonable grounds for suspicion in connection with a designated service. It is generally due within 3 business days after the day suspicion forms, or within 24 hours for terrorism financing; a specific legal professional privilege extension can apply to other suspicions. A TTR concerns a designated service involving receipt or payment of A$10,000 or more in physical currency (or its foreign-currency equivalent), and is due within 10 business days after the transaction day. AML Mate helps prepare records; you lodge through AUSTRAC Online.

• How to lodge an SMR
• How to lodge a TTR

AUSTRAC's next reporting period is 1 July 2026 to 30 June 2027. Where required, submit the report within 3 months after that period ends, from 1 July to 30 September 2027. Check whether an exemption applies to your business. An AUSTRAC Online administrator submits the official form. AML Mate can prepare an internal annual summary from your records; generating or finalising it does not submit the official report.

• Annual compliance report tutorial

Yes. Our six free tutorials walk you through creating an account, enrolling your business, lodging reports and what to do after you lodge. Follow the screenshots at your own pace and click any image to enlarge it. You do not need an AML Mate account to read them.

• Explore AUSTRAC Online tutorials

AML Mate is AML/CTF software for Australian accountants, legal practices, conveyancers, real estate businesses and jewellers. It helps you draft and review your program, manage client due diligence, prepare reports and organise ongoing compliance records in one place.

• Explore the product features

Paid plans start at $49 AUD/month, including GST. Eligible accounts get a 14-day free trial. A card is required at checkout. Your subscription automatically renews at your selected monthly price unless you cancel before the trial ends. During the trial you can build and use your program and records in the app. Downloading the program and audit pack unlocks with your first payment, and you can start paying early at any time. Accounts that have already used a trial, or choose to skip it, start with payment. The free check requires no signup or card.

• Compare all plans and allowances

Every client record you create in AML Mate counts, including clients you have offboarded, because that record has to survive the seven-year retention period anyway. What does not count is the rest of your client base. You only create a record for clients you provide a designated service to, which for most firms is a fraction of the total, so a practice with 600 clients on the books may have far fewer to bring into AML Mate. Essentials covers 50 client records, Professional 200, and Business 5,000. Business has unlimited team members, not unlimited client records.

No. Plans are monthly and you can cancel at any time from your billing portal. If you cancel, access continues to the end of the period you have already paid for. There is no annual contract, no minimum term and no exit fee.

Yes. The AUSTRAC guidance behind the platform and the in-app assistant is refreshed from AUSTRAC's own published pages, and the DFAT sanctions list used for screening updates automatically rather than by hand. Client review dates are set on a risk basis, so higher-risk clients come up for review sooner than lower-risk ones. Product changes are listed on our What's New page.