Tranche 2 extends Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) laws beyond banks to professional services including legal, accounting and real estate.

Firms that provide designated services become reporting entities under the AML/CTF Act and must identify, assess and manage money-laundering and terrorism-financing risks in line with AUSTRAC requirements.

Designated services are specific activities listed in the AML/CTF Act that present a higher risk of money laundering or terrorism financing.

For professional services, this includes activities such as handling client funds, facilitating property transactions, creating or managing legal structures, or exercising authority over client assets. If a firm provides even one designated service, AML/CTF obligations apply to that scope.

Tranche 2 obligations commence from 1 July 2026. AUSTRAC enrolments are expected to open from 31 March 2026, and firms must enrol within 28 days of first providing a designated service once the regime is in effect. Monitor AUSTRAC guidance for final enrolment procedures and timelines.

Responsibility for AML/CTF compliance ultimately sits with the firm’s leadership. Firms must appoint an AML/CTF Compliance Officer with sufficient authority, independence and resources to oversee the AML/CTF Program and act as the primary contact with AUSTRAC. While tasks may be delegated, accountability cannot.

No. AUSTRAC expects AML/CTF programs to be operational and risk-based, not just documented. Policies must be supported by evidence showing how risks were identified, decisions were made, controls were applied and records were maintained. Activities that cannot be evidenced may be treated as non-compliant.

Not automatically. Tranche 2 introduces ongoing AML/CTF obligations, not just point-in-time checks. Firms do not need to re-onboard all existing clients from scratch. Existing clients may require identification and verification where a designated service is provided after commencement, or where a client's risk profile changes.

AUSTRAC expects a risk-based approach – prioritising higher-risk clients and services rather than re-verifying everyone at once.

A risk-based approach means tailoring controls to the level of money-laundering or terrorism-financing risk involved. Lower-risk clients and services may require simpler checks, while higher-risk relationships require enhanced due diligence, closer monitoring and stronger documentation. AUSTRAC expects firms to be able to explain and evidence how risk decisions were made.

If a firm provides even one designated service, it becomes a reporting entity for those activities and must comply with the AML/CTF regime for that scope. Tranche 2 applies based on what you do, not firm size or business model.

Yes. Tranche 2 applies based on whether a designated service is provided, not firm size, turnover or headcount. A sole practitioner providing a single designated service carries the same AML/CTF obligations for that activity as a large firm. Smaller firms are not exempt and are often considered higher risk if controls are informal or undocumented.

Many firms already operate under overlapping frameworks such as professional conduct rules, trust account regulations, privacy law and cybersecurity requirements. My Databoss is designed to support multiple regulatory obligations in parallel, aligning AML/CTF workflows with existing requirements so compliance is coordinated rather than duplicated. For example, conveyancers can align AML/CTF workflows with ARNECC obligations.

Many AML tools address isolated tasks such as identity verification or screening. Tranche 2 requires an end-to-end compliance system. My Databoss connects identity verification, consent, risk assessment, monitoring, training and audit records into a single system of record, helping firms demonstrate not just what they did, but when, why and how.

No. Technology cannot replace governance, leadership oversight or professional judgment. However, AUSTRAC expects firms to use systems that support consistent processes, reduce manual error and produce reliable evidence. My Databoss is designed to support and evidence compliance, not replace legal responsibility.

No. Tranche 2 represents a structural change to how professional firms manage risk, data and compliance. Firms that prepare early are better positioned to implement systems thoughtfully, train staff effectively and respond confidently to regulatory scrutiny.

Tranche 2 brings privacy and AML/CTF compliance together. Even where a firm is otherwise exempt under the Privacy Act, that exemption does not apply to AML/CTF activities. When handling personal information for AML/CTF purposes, firms must comply with applicable privacy requirements alongside their AML/CTF obligations.

This means sensitive identity and ownership information must be collected, used, stored and retained in a way that satisfies both frameworks – with appropriate security, access controls and auditability.

Under the AML/CTF Act, firms must generally retain records for at least seven years. Records must remain secure, accessible and auditable for the full retention period, even if staff change, systems are upgraded or clients disengage.

‘Tipping off’ occurs when a client is informed that a Suspicious Matter Report (SMR) has been, or may be, submitted to AUSTRAC. Tipping off is a criminal offence. Firms must have controls to ensure suspicions are escalated internally and reported appropriately without alerting the client or third parties.