You Checked Every Client. AUSTRAC Also Expects You To Check Your Own People.
There is a due diligence obligation in the AML/CTF Act that points at your own staff rather than your clients, and most firms have not read it. It asks you to assess the skills and the integrity of everyone who performs an AML/CTF function, before you engage them and for as long as they stay. Here is who it covers, what AUSTRAC's own worked example does, and the two parts of it almost nobody has written down.
The Client Won't Hand Over ID. The Act Has Already Decided What Happens Next.
If you cannot establish who your customer is on reasonable grounds, you must not provide the designated service. That is the whole rule, and it is short. What it does not tell you is the difference between a client who will not prove who they are and one who cannot, which are two different situations that look identical from your side of the desk. Here is how to tell them apart, and what has to be in the file either way.
The Deadlines Are Done. Your Next AUSTRAC Date Is 1 July 2027.
Enrolment closed on 29 July 2026. For most Tranche 2 firms the next date AUSTRAC actually puts in your calendar is 1 July 2027, when the first annual compliance report window opens. Everything in between runs on triggers you have to notice yourself, not dates anyone reminds you about. Here is what those triggers are, and what should be in your file by the end of August.
How to Rate a Client's Risk: The Step Most Firms Skip
Most Tranche 2 firms nail the business risk assessment and skip the other one: rating each client low, medium or high. It is a separate AUSTRAC obligation, and it decides whether you can use simplified CDD or must do enhanced. Here is the method AUSTRAC expects, the four factor categories, the low/medium/high examples, and a worked conveyancer example.
How to Find a Company Client's Beneficial Owners: The ASIC Extract
You've enrolled with AUSTRAC and a company walks in as a client. The rules say identify its beneficial owners, but the free ASIC search won't tell you who owns it. Here is exactly which ASIC product actually carries the ownership data, the free one that looks right but isn't, how to read directors and shareholders off it, and where the extract stops and you take over.
What Actually Happens if You Miss the 29 July AUSTRAC Deadline?
Eight days out, every Tranche 2 firm that hasn't enrolled is quietly asking the same question: what happens if I just don't? Here is the honest answer. The theoretical penalties, the realistic enforcement ladder, why enrolment is the cheapest genuine-effort evidence you will ever buy, and what to do if the date has already passed by the time you read this.
CDD on a Family Trust: Who Do You Actually Have to Identify?
Half the client files in an Australian accounting or legal practice have a discretionary trust in them, and trusts are where Tranche 2 CDD gets genuinely hard. AUSTRAC rated trusts a high national money laundering risk, and the new rules ask for more than the trustee's driver licence. Here is who you actually have to identify on a family trust file, what verifies what, and the discretionary trust wrinkle that trips people up.
Filed Zero Suspicious Matter Reports? AUSTRAC Now Treats That as a Red Flag
AUSTRAC's CEO told the non-bank lending sector that suspicious matter reporting is rising, but many businesses still file none. The real message for every Tranche 2 firm: a clean sheet of zero SMRs is no longer read as proof you are low-risk. It is something AUSTRAC now reverse-checks.
1 July Didn't Just Add AML. It Removed Your Privacy Act Exemption.
Most Tranche 2 coverage stops at AUSTRAC. But the same law that made you a reporting entity also stripped away the Privacy Act small business exemption for your CDD data. From 1 July 2026, a solo accountant or one-agent real estate office is bound by the Australian Privacy Principles regardless of turnover. Here is what actually changed, what you now have to have, and the one scope nuance that keeps it from being as big as it sounds.
FATF Grey List 2026: The High-Risk Countries That Trigger Enhanced Due Diligence
The FATF updated its grey list on 19 June 2026, adding Iraq and Bosnia and Herzegovina and removing Algeria and Namibia. Here is the full current list, what a high-risk jurisdiction actually means for your Tranche 2 obligations, and when a country connection pushes a client into enhanced due diligence.
Your Client Matched a PEP or Sanctions List. Now What?
Screening a client and getting a hit is the moment most firms dread. But a match is not a verdict. Here is how to tell a false positive from a real one, what a PEP match actually requires, why a sanctions match is different, and when a match becomes a report to AUSTRAC.
AML/CTF Record Keeping: What to Keep, and What You Now Have to Destroy
Under the amended AML/CTF rules, keeping every scanned ID on file is no longer the safe option. It can be a privacy breach. Here is what a Tranche 2 firm must retain for seven years, and what it should now destroy once identity is verified.
Does an ID Check Make You AML/CTF Compliant? What Tranche 2 Actually Requires
Since 1 July 2026, accountants, lawyers and real estate agents are reporting entities. A client identity check is one small part of that, not the whole of it. Here is what AUSTRAC actually requires, and why 'my software already does AML' can leave you exposed.