AUSTRAC tranche 2 explained: who is caught, the enrolment deadline, the AML/CTF programme and CDD duties, and what the Act actually changed from 1 July 2026.
Table of contents
- Tranche 2 is the popular name for Schedule 3 of the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, titled "Regulating additional high risk services", which received assent on 10 December 2024.
- That schedule brings three groups into the regime in three separate parts: real estate, dealers in precious metals and stones, and professional services such as lawyers, conveyancers and accountants.
- The Explanatory Memorandum to the Bill estimated the amendments would produce approximately 90,000 new reporting entities.
- Obligations commenced on 1 July 2026. AUSTRAC opened enrolment on 31 March 2026 and set 29 July 2026 as the date by which newly regulated businesses providing a designated service had to enrol.
- Enrolment is the smallest of the duties. The same Act rewrote AML/CTF programmes (Schedule 1), customer due diligence (Schedule 2) and the tipping off offence (Schedule 5) for every reporting entity, old and new.
Tranche 2 is the extension of Australia's anti-money laundering regime to real estate professionals, dealers in precious metals and stones, and professional service providers including lawyers, conveyancers and accountants. It took effect on 1 July 2026 under Schedule 3 of the amending Act, and requires those businesses to enrol with AUSTRAC and run full compliance programmes.
TL;DR
Tranche 2 moved roughly 90,000 Australian businesses from unregulated to regulated on 1 July 2026. Enrolment with AUSTRAC was the entry ticket, due by 29 July 2026, but the substantive work is an AML/CTF programme, a money laundering risk assessment, customer due diligence and suspicious matter reporting. The trigger is whether you provide a designated service, not what your industry is called.
What is tranche 2, and what law creates it?
Tranche 2 is not a statute. It is the informal name for the expansion of Australia's anti-money laundering regime to professions that the Financial Action Task Force calls designated non-financial businesses and professions. The legal instrument is the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, No. 110 of 2024, which received assent on 10 December 2024 and is administered by the Department of Home Affairs.
The relevant provisions sit in Schedule 3, titled "Regulating additional high risk services". The name matters more than it looks: the schedule regulates services, not professions. It is divided into Part 1 for real estate, Part 2 for dealers in precious metals and stones, Part 3 for professional services, and Part 4 for transitional provisions. Australia had left this gap open since the original regime began in 2006, and closing it was the country's long-standing commitment to the Financial Action Task Force.
Who is actually caught?
Schedule 3 captures three groups, each in its own part of the Act. Real estate comes first, covering agents and others involved in buying and selling property. Dealers in precious metals and stones follow. Professional services form the third and broadest part, reaching lawyers, conveyancers, accountants and trust and company service providers.
The Explanatory Memorandum to the Bill put the scale at approximately 90,000 new reporting entities. That figure is an estimate of businesses, not of people, and it dwarfs the population AUSTRAC supervised before. For context, the regime previously centred on banks, remitters, gambling operators and digital currency exchanges, which is a much smaller and far more concentrated group.
AUSTRAC's enrolment table, updated to 17 September 2026, records 18,350 enrolments from real estate, 13,780 from accounting and professional services, 6,580 from lawyers, 1,600 from conveyancers and 320 from jewellers and dealers in precious metals, so the estimate was of the right order.
Being in one of those industries does not by itself make you a reporting entity. The test is whether you provide a designated service, which is why two accounting firms on the same street can land on different sides of the line.
What are the enrolment dates and deadlines?
Four dates define the transition. AUSTRAC opened enrolment on 31 March 2026, obligations commenced on 1 July 2026, and businesses providing a designated service from that date had to enrol by 29 July 2026. Assent, back on 10 December 2024, gave the sector eighteen months of notice.
| Date | Milestone | What it meant |
|---|---|---|
| 10 December 2024 | Act receives assent | The reforms become law, starting the transition clock |
| 31 March 2026 | AUSTRAC enrolment opens | Newly regulated businesses can register |
| 1 July 2026 | Obligations commence | Full AML/CTF duties apply to tranche 2 entities |
| 29 July 2026 | Enrolment deadline | Last date to enrol for services provided from 1 July |
Enrolment is not a one-off administrative act that ends the matter. It registers you with the regulator and starts the reporting relationship. A business that enrolled on the deadline and did nothing else is a registered business with no compliance programme, which is a worse position than not being visible at all.
What is a designated service, and why does it decide everything?
A designated service is a specific activity listed in the Act, and providing one is what makes a business a reporting entity. This is the single most misunderstood point in the whole reform. The obligation attaches to the activity, not to the professional title on the door.
The practical consequence is that scope is a question you answer service by service. A law firm doing only litigation may provide no designated service at all, while the same firm assisting with a conveyance or setting up a company structure almost certainly does. An accountant preparing tax returns is in a different position from one administering client money or acting as a nominee director.
That is why the readiness question is not "am I an accountant?" but "which of my engagements fall inside the list, and can I tell when a new one does?" Firms that answered it as a policy question, once, in writing, are in a defensible position. Firms that assumed their whole practice was in or out are usually wrong in one direction or the other.
What obligations apply beyond enrolment?
Enrolment is the smallest duty. The substantive obligations mirror what banks and remitters have carried for years, and they apply in full from the commencement date.
| Obligation | What it requires in practice |
|---|---|
| AML/CTF programme | A documented programme governing how the business manages its money laundering and terrorism financing risk |
| Risk assessment | An assessment of the money laundering and terrorism financing risk the business actually faces |
| Customer due diligence | Identifying and verifying customers, and understanding beneficial ownership and control |
| Ongoing due diligence | Monitoring the relationship over time rather than verifying once at onboarding |
| Suspicious matter reports | Reporting suspicious matters to AUSTRAC |
| Record keeping | Retaining the records that evidence each of the above |
Two of these carry more weight than firms expect. The risk assessment is the document every other control hangs off, and a generic template that could describe any business in the country tends to read, to an examiner, as evidence that no assessment happened. Ongoing due diligence is the other: it converts compliance from an onboarding task into a permanent operating cost, which is the part small practices consistently underestimate.
What did the Act change for businesses already regulated?
Tranche 2 attracted the attention, but the Act reformed the regime for every reporting entity. Schedule 1 rewrote AML/CTF programmes and introduced business group provisions. Schedule 2 rewrote customer due diligence outright, in a main amendment plus consequential changes reaching the Banking Act 1959 and the Commonwealth Electoral Act 1918.
So a bank or remitter that read the reforms as "a lot of new firms are joining" and changed nothing internally misread them. The customer due diligence rules that apply to a long-standing reporting entity from the commencement date are not the rules that applied before it, and the programme obligations moved at the same time.
How do the legal professional privilege and tipping off rules work?
Two schedules address the friction of regulating lawyers. Schedule 4 deals with legal professional privilege, which is the reason bringing legal practitioners into an AML regime is constitutionally and professionally delicate: a duty to report can collide with a duty of confidence that the courts protect.
Schedule 5 rewrote the tipping off offence and the rules on disclosing AUSTRAC information to foreign countries or agencies. The redrafted offence matters to every reporting entity, not just lawyers, because it governs what you may say to a customer once a report has been made or is contemplated. Firms new to the regime often get this wrong in the most human way, by explaining to a client why a transaction is being delayed.
What does compliance cost a small firm?
Honestly, more than the enrolment form suggests, and the burden falls unevenly. A national real estate franchise absorbs a compliance programme across hundreds of transactions. A sole conveyancer carries the same categories of obligation across a handful, and the fixed costs of identity verification, screening and record keeping do not scale down neatly.
The strongest counter-argument to the reform is exactly this proportionality point, and it deserves a fair hearing rather than a dismissal: a regime designed for banks, applied to two-partner firms, risks producing paperwork rather than intelligence. The counter to the counter is that the gap was real, and that criminals had been routing property and structuring work through precisely the professions that sat outside the regime.
The one place the cost can come down is verification. Collecting and storing copies of driver's licences and passports creates a permanent liability that most small firms are not equipped to defend, and every stored copy is a record someone may later have to breach-notify.
A tranche 2 readiness checklist
Run this in order. Each step produces a document, because in a supervised regime an undocumented decision did not happen.
- List every service line and mark each one as a designated service or not, with the reasoning recorded.
- Confirm your enrolment with AUSTRAC is complete and the details are current.
- Write the money laundering and terrorism financing risk assessment for your business specifically, naming your customer types, delivery channels and jurisdictions.
- Adopt an AML/CTF programme that reflects that assessment rather than a generic template.
- Define the customer due diligence standard, including how you establish beneficial ownership and what triggers enhanced measures.
- Set the ongoing due diligence rhythm and name who performs it.
- Write the suspicious matter reporting procedure, and train staff on the tipping off rules before they need them.
- Fix a record keeping standard, including how long records are held and how they are produced on request.
- Decide what identity data you will retain, and minimise it.
- Diarise a review date, because the assessment ages.
How should firms verify identity without building a honeypot?
The default answer is to collect identity documents and keep them, which is how a conveyancer ends up holding a database of driver's licences with no security team. A better model is to verify identity to a high assurance level and retain the proof of verification rather than the underlying documents.
Zyphe's KYC software verifies the document, reading the NFC chip where the document carries one, with active liveness and a face match to the portrait, and its KYB software resolves company and trust ownership to natural persons. The documents and biometrics are processed transiently and stored encrypted in the individual's own vault; the firm keeps the verification result, the audit log and the proof, which is the record AUSTRAC asks for. For an Australian firm, that turns a permanent data liability into a verification record that can be produced on request without a store of driver's licences behind it.
The bottom line
Tranche 2 changed the question Australian professional firms have to answer. It is no longer whether anti-money laundering rules apply to your industry, but which of your services sit on the list and whether you can evidence how you decided. Enrolment was the visible deadline and the easy part. The durable work is a risk assessment that describes your actual business, a programme built on it, and a verification approach that does not leave a filing cabinet of identity documents behind. Firms that treat 29 July 2026 as the finish line have completed the registration and not the compliance.
This article is general information, not legal advice. Obligations depend on the services a business provides, and firms should take advice on their own circumstances.
Related resources
- Customer due diligence for fintech companies
- Enhanced due diligence versus standard CDD
- Sanctions screening: lists, process and software
- Australia's tranche 2 reforms: what changed from 1 July 2026
- AML/CTF for trust and company service providers in Australia
- Beneficial ownership verification for multi-layer trusts with offshore owners
- KYC versus AML: the differences
Cited sources
- Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (No. 110, 2024), Federal Register of Legislation
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006, Federal Register of Legislation
- AUSTRAC, Professional designated services
- AUSTRAC, Enrol with us overview
- Explanatory Memorandum, Anti-Money Laundering and Counter-Terrorism Financing Amendment Bill 2024
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.