AUSTRAC Tranche 2 — the complete compliance guide for Australian businesses

Enrol with AUSTRAC

Every reporting entity must enrol at online.austrac.gov.au before commencing to provide designated services (or before the 29 July 2026 deadline for existing businesses). Enrolment requires your ABN, business structure details, designated service categories, and compliance officer details. There is no fee to enrol.

Conduct a ML/TF risk assessment

Before finalising your AML/CTF Program, you must conduct a documented risk assessment of your exposure to money laundering and terrorism financing. The assessment must consider your customer types, geographic risk, transaction methods, delivery channels, and the nature and complexity of your designated services. The risk assessment must be reviewed at least annually and whenever you introduce a new service.

Develop an AML/CTF Program

Your AML/CTF Program is a written document that governs how your business identifies, manages and mitigates ML/TF risk. It must cover your organisation-wide risk framework — risk assessment, governance, compliance officer role, training, and audit — and customer identification and due diligence — how you verify client identity and monitor ongoing relationships. AUSTRAC no longer requires these to be structured as separate labelled 'Part A'/'Part B' sections since the 2024 reforms. Both must be tailored to your firm's actual services and risk profile; the AUSTRAC starter kit is a template, not a finished program.

Appoint an AML/CTF Compliance Officer

Every reporting entity must designate a named individual as its AML/CTF Compliance Officer. This person is responsible for managing the firm's AML/CTF obligations, making regulatory notifications, overseeing training, and acting as the primary contact for AUSTRAC. For small firms, the principal or a senior employee typically holds this role. The appointment must be in writing.

Conduct customer due diligence (CDD)

Before providing a designated service, you must verify the identity of each customer using reliable, independent source documents — typically government-issued photo ID and proof of address. For companies, you must identify and verify the beneficial owners (individuals with more than 25% ownership or effective control). Enhanced due diligence applies to higher-risk customers, including politically exposed persons (PEPs) and customers from high-risk countries.

Monitor ongoing customer relationships

CDD is not a once-at-onboarding exercise. Reporting entities must monitor ongoing customer relationships and transactions to detect behaviour that is inconsistent with the customer's known profile. Transaction monitoring does not require sophisticated software — for small firms, documented periodic file reviews are generally sufficient. High-risk clients warrant more frequent monitoring.

File Suspicious Matter Reports (SMRs)

If you suspect — or have reasonable grounds to suspect — that a client or transaction involves money laundering, terrorism financing, or proceeds of crime, you must file a Suspicious Matter Report with AUSTRAC. The standard deadline is 3 business days after forming the suspicion; for terrorism financing, 24 hours. The tipping-off prohibition in the AML/CTF Act 2006 prevents you from disclosing the SMR to the client or any other person. Cash transaction reports (TTRs) are required for physical currency transactions of $10,000 or more within 10 business days.

Arrange an independent evaluation

Your AML/CTF Program must undergo an independent evaluation at least once every 3 years, conducted by a suitably qualified person who was not involved in designing, implementing, or maintaining the program or your risk assessment. This can be an external consultant or, for larger firms, a genuinely independent internal audit function. The evaluation assesses effectiveness, compliance with the Rules, whether the program has actually been implemented, and whether your business has consistently followed it. Transitional rules stagger the first evaluation deadline for newly regulated Tranche 2 entities.

Maintain records for 7 years

You must retain all AML/CTF-related records for a minimum of 7 years. This includes CDD documents, transaction records, SMR documentation (the full SMR record and supporting documents — note: the tipping-off prohibition restricts disclosure to clients, not internal retention), your AML/CTF Program and all versions of it, training records, and audit reports. Records must be stored in a format that allows AUSTRAC to access them on request.

Check if you are captured

Use the eligibility checker at /am-i-regulated or review the AML/CTF Act 2006 as amended. If any of your services are designated services, proceed.

Create an AUSTRAC Online account

Go to online.austrac.gov.au and register with your ABN. Enrolment opens 31 March 2026.

Appoint your Compliance Officer in writing

Document the appointment, their responsibilities, and ensure they have access to all client files. Notify AUSTRAC by 29 July 2026.

Complete your ML/TF Risk Assessment

Assess your risk exposure by service type, client type, payment methods, and geography. Document it formally — it will be the foundation of your Program.

Write (or generate) your AML/CTF Program

Your Program must cover your risk framework (governance, risk, controls) and CDD procedures. Customise to your services. Klyvon generates both in one session from your intake answers.

Set up CDD procedures

Establish how you will collect and verify identity documents for new clients. For higher-risk clients, document your enhanced due diligence process.

Train all staff

Every employee involved in client services must complete AML/CTF awareness training before 1 July 2026. Document attendance.

Enrol with AUSTRAC before 29 July 2026

Submit your enrolment at online.austrac.gov.au. Keep your enrolment details current — AUSTRAC must be notified within 14 days of material changes.