Autono Legal, home
Menu

Australia’s New AML/CTF Regime: What Businesses Need to Know About the 2026 Reforms

Australia's reformed AML/CTF regime is now in force: what existing reporting entities and Tranche 2 businesses need to know.

Autono Legal

Introduction

Australia's anti-money laundering and counter-terrorism financing (AML/CTF) framework has undergone a major overhaul since the original 2006 legislation. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, together with the AML/CTF Rules 2025, brings changes that affect both existing reporting entities and newly regulated sectors. The key dates in March and July 2026 have now passed, so the question for most businesses is no longer "what is coming" but "are we compliant now?"

Key Implementation Dates

The reforms rolled out in phases:

  • 31 March 2026: The reformed obligations (Schedules 1–3 of the Amendment Act and the AML/CTF Rules 2025) commenced for existing reporting entities, including virtual asset service providers. Tranche 2 services also became designated services on that date, but the main obligations (AML/CTF programs, customer due diligence, reporting and record keeping) did not apply to them until 1 July 2026
  • 1 July 2026: Tranche 2 obligations commenced (Amendment Act Schedule 3, Part 4, item 11). The first annual AML/CTF compliance reporting period under the 2025 Rules also runs from 1 July 2026 to 30 June 2027
  • 29 July 2026: Enrolment deadline for Tranche 2 businesses that were already providing designated services before 1 July 2026, the date from which they have had the main AML/CTF obligations (Amendment Act Schedule 3, Part 4, item 12; otherwise enrolment is required within 28 days of starting to provide a designated service: s 51B)
  • 30 March 2029: Latest end date for certain transitional reporting arrangements. Entities already on the Reporting Entities Roll at commencement can keep using the legacy suspicious matter and threshold transaction report formats until the earlier of 30 March 2029 or a date AUSTRAC specifies (AML/CTF Rules 2025, rr 12-2 and 12-4).

Tranche 2: Who Is Now Regulated?

Since 1 July 2026, the following businesses have had the main AML/CTF obligations when providing designated services:

  • Legal practitioners, accountants and other professionals: When providing the professional services listed in the Act, including assisting with buying, selling or transferring real estate or a body corporate or legal arrangement, receiving, holding and controlling client money or other property as part of a transaction, organising equity or debt financing, and creating or restructuring companies and trusts (s 6, table 6)
  • Real estate professionals: When brokering the sale, purchase or transfer of real estate, or selling real estate without an independent agent; there is no value threshold (s 6, table 5)
  • Dealers in precious metals and stones: When buying or selling precious metals, precious stones or precious products in a transaction involving $10,000 or more in physical currency or virtual assets (s 6, table 2, item 2). (Bullion dealing was already covered, with no threshold: table 2, item 1.)
  • Trust and company service providers: When forming companies or other legal arrangements, acting (or arranging for someone to act) as a director, secretary, trustee or partner, or providing a registered office address (s 6, table 6)

Tranche 2 entities had to enrol with AUSTRAC within 28 days of first providing a designated service (s 51B; for Tranche 2 businesses that were already providing designated services before 1 July 2026, the date from which they have had the main AML/CTF obligations, by 29 July 2026: Amendment Act Sch 3, Pt 4, item 12), and to have AML/CTF programs in place from 1 July 2026.

Fundamental Shift: Risk-Based Approach

The reforms embed a principles-based, risk-responsive approach throughout the regime. Key changes include:

Unified Customer Due Diligence Framework

Under the previous rules, customer identification, ongoing customer due diligence (OCDD), and enhanced customer due diligence (ECDD) operated somewhat independently. The new regime integrates these into a single CDD framework in Part 2 of the Act comprising:

  • Initial Customer Due Diligence (ICDD) (s 28): Generally before providing designated services
  • Ongoing Customer Due Diligence (OCDD) (s 30): Continuous monitoring throughout the business relationship
  • Simplified CDD (s 31) where risk is low, and Enhanced CDD (s 32) where ML/TF risk is high or other triggers apply

Critically, CDD is now a continuous obligation across the entire customer lifecycle, not a one-time onboarding exercise followed by separate monitoring.

Fewer Prescribed Timeframes

The new framework puts more weight on risk-based triggers and less on fixed calendar cycles. Under the Act:

  • Reviews must be triggered by risk indicators, such as significant changes to the business or information from AUSTRAC (s 26D)
  • The timing of CDD measures must be commensurate with assessed risk levels
  • Some outer limits remain: the ML/TF risk assessment, the AML/CTF policies and independent evaluations must each be reviewed or carried out at least once every 3 years (ss 26D and 26F)

This means a high-risk customer relationship may require re-verification within days of a risk indicator appearing, while a low-risk relationship may appropriately be reviewed less frequently. But the business must justify its approach based on risk assessment.

Proliferation Financing

A significant addition is the explicit inclusion of proliferation financing (PF) risk. Under the Act, "ML/TF risk" means the risks of money laundering, financing of terrorism and proliferation financing that a reporting entity may reasonably face in providing its designated services. So businesses need to consider PF risk in their ML/TF risk assessments.

AML/CTF policies must manage and mitigate proliferation financing risk alongside money laundering and terrorism financing risk (s 26F).

Virtual Asset Services: Expanded Scope

The reforms significantly expand coverage of virtual asset services:

Terminology Changes

  • "Digital currency" becomes "virtual asset" (s 5B)
  • "Digital Currency Exchange (DCE)" becomes "Virtual Asset Service Provider (VASP)"
  • The DCE Register is now the Virtual Asset Service Provider Register (Part 6A)

New Designated Services

Virtual asset designated services now include:

  • Exchange between virtual assets and money (s 6, table 1, item 50A)
  • Exchange between virtual assets (item 50B, newly covered)
  • Safekeeping of virtual assets for customers (item 46A, newly covered)
  • Transfers of virtual assets on behalf of customers, through the transfer of value provisions
  • Other table 1 services provided in connection with the offer or sale of a virtual asset by a business participating in the offer or sale (item 50C)

Travel Rule Obligations

The "travel rule" requires ordering institutions to collect, verify and pass on payer and payee information for value transfers, including virtual asset transfers (AML/CTF Act Part 5, ss 64–66A; AML/CTF Rules 2025, Part 8). This includes:

  • Payer's full name plus one or more of: a unique customer identification number, a unique identifier, date and place of birth, or address
  • Payee's name and tracing information (for virtual assets, including the wallet address)
  • Due diligence on the receiving wallet, including self-hosted wallets (s 66A)

Practical Implications

For Existing Reporting Entities

The new obligations have applied since 31 March 2026. If you have not yet:

  1. Reviewed your AML/CTF program: Ensure it reflects the new ML/TF risk assessment and AML/CTF policies structure, and remove references to separate Part A and Part B structures
  2. Updated terminology: Replace references to "digital currency" with "virtual asset" throughout documentation
  3. Moved to risk-responsive triggers: Replace fixed review periods with risk-based triggers, while keeping the statutory 3-year outer limits
  4. Documented PF assessments: Include proliferation financing in risk registers
  5. Implemented travel rule compliance: Ensure systems can collect, verify and pass on travel rule information

For Tranche 2 Entities

  1. Confirm whether you are caught: Map your services against the designated services in s 6 (particularly tables 5 and 6)
  2. Enrol with AUSTRAC: Enrolment is required within 28 days of starting to provide a designated service (s 51B). If you have not enrolled, act now
  3. Maintain your AML/CTF program: Document risk assessments, CDD procedures, and compliance governance
  4. Designate an AML/CTF Compliance Officer: Appoint an individual with appropriate authority (ss 26J–26L)
  5. Train staff: Ensure personnel understand obligations and recognise suspicious matters
  6. Prepare for compliance reporting: The first reporting period runs from 1 July 2026 to 30 June 2027, with a 3-month lodgement period after it (r 9-9)

Conclusion

Now that the reforms are in force, the shift to principles-based, risk-responsive obligations gives businesses flexibility but needs more judgment in compliance. For existing reporting entities and Tranche 2 businesses alike, the priority now is checking that what is on paper matches what happens in practice.

This is general information, not legal advice.

Questions? Email [email protected].

Sources