AML/CTF compliance questions, answered

Tranche 2 obligations commenced on 1 July 2026 and are now in force. Accountants, tax agents, lawyers, conveyancers, real estate agents, and dealers in precious metals/stones (jewellers) who provide "designated services" must comply. That covers work like managing trust accounts, conveyancing, company and trust formation, and buying or selling real estate. A separate threshold applies to reporting: physical cash transactions of $10,000 or more trigger a Threshold Transaction Report.

Civil penalties under the AML/CTF Act can reach up to $36.4 million per contravention for companies (100,000 penalty units) and $7.28 million for individuals (20,000 penalty units), calculated at $364 per penalty unit (from 1 July 2026). Penalties apply per contravention and can stack. AUSTRAC can also issue infringement notices, enforceable undertakings, and remedial directions.

Enrol now rather than waiting. The deadline for businesses already providing designated services on 1 July 2026 was 29 July 2026, so enrolling late does not remove the obligation, but the gap stops growing the day you enrol. If you only started providing a designated service more recently, the ongoing rule applies instead: you must apply to enrol no later than 28 days after the day you start. AUSTRAC's stated position on the first compliance cycle is that it does not expect perfection immediately, but does expect to see genuine effort to comply. Enrolling, appointing your compliance officer, and having an AML/CTF program in place is what that effort looks like. AML Mate's registration tracker assembles the exact details AUSTRAC asks for, and the program generator produces the plan you need alongside it.

No. AUSTRAC explicitly states that businesses can create their own AML/CTF program using the free Starter Kits they provide. AML Mate automates this process using AUSTRAC's official guidance, so you don't need expensive consultants. However, we recommend having a compliance professional review your program for complex situations.

AML Mate uses a deterministic rules engine based on AUSTRAC's official Starter Kits, not AI hallucinations. You answer questions about your business, services, and risk factors. Our engine maps your answers to AUSTRAC's framework and generates a tailored AML/CTF program with CDD procedures, risk assessment, and EDD triggers. Every recommendation cites its AUSTRAC source.

CDD is the process of identifying and verifying your clients before providing designated services. It includes collecting government-issued photo ID, verifying identity (optionally via Electronic Identity Verification), identifying beneficial owners for companies/trusts, and screening against PEP and sanctions lists. AML Mate walks you through the entire CDD process step by step.

No, and you generally should not. The record-keeping obligation was narrowed in the amended Act: what you must keep for 7 years is the record — the information taken from the document, the verification method and its outcome, and your risk assessment — not a scan of the licence or passport itself. Because the Act does not require you to hold the image, privacy law then requires you to destroy or de-identify copies once they are no longer needed. A folder of scanned IDs kept just in case is a data-breach liability, not a compliance safeguard. AML Mate keeps the verification record and never holds more image than it has to: images captured by the hosted electronic verification stay with the verification provider and never reach us at all, and a document you upload to a client file yourself is purged automatically once it is no longer needed.

Yes. Every reporting entity must appoint an AML/CTF compliance officer responsible for overseeing your AML/CTF program, ensuring staff training, and managing reporting obligations. For small businesses this is typically the business owner or managing partner. You must also notify AUSTRAC of who that person is. For Tranche 2 entities that notification was due by 29 July 2026, the same date as enrolment, so if you have not done it yet it is outstanding rather than upcoming — notify as part of enrolling.

No, and there is no fixed catch-up deadline for them. Clients you already had an ongoing relationship with on 1 July 2026 are pre-commencement customers, so initial CDD is trigger-based rather than scheduled: you must complete it before the next designated service if a suspicious matter reporting obligation arises, or if a significant change in the relationship pushes their risk to medium or high. Ongoing CDD — monitoring their transactions and keeping their details current — applies from day one regardless. Note that the three-year transitional window ending 30 March 2029 belongs to pre-existing reporting entities such as banks; it is not a deadline for a Tranche 2 firm's client base.

AML Mate starts at $49/month, a fraction of the $3,000-$8,000/year that traditional compliance consultants charge. The free compliance check requires no signup. We offer a 14-day free trial on all paid plans so you can generate your compliance plan before committing.

No. AML Mate is an information tool based on AUSTRAC's publicly available guidance and Starter Kits. It does not constitute legal or compliance advice. We recommend consulting a licensed compliance professional before submitting your AML/CTF program to AUSTRAC, especially for complex business structures.

Tranche 2 is the expansion of Australia's AML/CTF regime to cover designated non-financial businesses and professions: accountants, lawyers, conveyancers, real estate agents, and dealers in precious metals and stones. Introduced by the AML/CTF Amendment Act 2024, the obligations commenced on 1 July 2026, bringing an estimated 90,000+ businesses under AUSTRAC supervision for the first time.

If you provide a designated service you must be on the AUSTRAC Reporting Entities Roll. Enrolment opened on 31 March 2026 and Tranche 2 entities were required to be enrolled by 29 July 2026, so that date has now passed. If you are not enrolled yet, do it now. If you start providing a designated service from here on, the standing rule is that you must apply to enrol no later than 28 days after the day you start. Enrolment is free. AML Mate includes a step-by-step registration tracker that assembles the exact details AUSTRAC asks for.

A designated service is a specific activity listed in the AML/CTF Act that triggers your obligations — for example, a real estate agent selling or managing property, a lawyer handling conveyancing or forming a company or trust, or an accountant managing client money. You are only regulated to the extent you provide one or more designated services. AML Mate's free compliance check tells you whether yours are covered.

A Suspicious Matter Report (SMR) is filed when you form a reasonable suspicion about a customer or transaction — due within 3 business days, or 24 hours if it relates to terrorism financing. A Threshold Transaction Report (TTR) is filed for any physical cash transaction of $10,000 or more, regardless of suspicion — due within 10 business days. AML Mate pre-fills both from your client data.

The compliance report now runs on financial years. The first reporting period covering Tranche 2 entities is 1 July 2026 to 30 June 2027, and reports are submitted within 3 months of the period ending — so the submission window is 1 July to 30 September 2027, not this year. After that it repeats annually on the same cycle. You lodge it through AUSTRAC Online, and you need to be listed as an administrator on the account to do so. AML Mate aggregates the year's activity so the report is assembled rather than reconstructed from memory.

Yes. There is no size exemption — if you provide a designated service you are a reporting entity, whether you are a sole trader or a large firm. AUSTRAC has said small practices are a focus of the first compliance cycle, not an afterthought. Obligations are risk-based, so a small, low-risk practice has a simpler program than a large one, but it still needs one.

For a small firm, the core setup — enrolling with AUSTRAC, generating your AML/CTF program and risk assessment, appointing a compliance officer, and setting up client CDD — can be completed in a day. AML Mate generates a tailored program in about 15 minutes. The ongoing work is applying CDD to clients and monitoring over time, since compliance is a continuing obligation, not a one-off project.

Every client record you create in AML Mate counts, including clients you have offboarded, because that record has to survive the seven-year retention period anyway. What does not count is the rest of your client base. You only create a record for clients you provide a designated service to, which for most firms is a fraction of the total, so a practice with 600 clients on the books may have far fewer to bring into AML Mate. Essentials covers 50 client records, Professional 200, and Business is unlimited.

AUSTRAC requires training for personnel who perform functions relevant to your AML/CTF obligations, which is not necessarily everyone on the payroll, and it must be given when a person is engaged and on an ongoing basis afterwards. AUSTRAC also expects the training to suit the functions that person actually performs. AML Mate includes eight modules: five core modules that must all be completed before training counts as complete, and three optional modules you can assign on top. Staff are invited by email and complete their modules without an account, so the number of people you train does not affect your plan.

AML/CTF records generally have to be kept for seven years, and AML Mate holds them on that basis. CDD records run seven years from the end of the client relationship, after which personal details and documents are destroyed automatically and only a skeleton record remains so reports stay intact. Identity document images from the hosted electronic verification are never stored by AML Mate at all: they stay with the verification provider and we keep only the outcome and a reference to it. A document you upload to a client file yourself is destroyed 90 days after you complete CDD, while the record that the check happened is kept for the full period. Where the Act requires you to keep a record, that obligation governs how long you hold it, so a deletion request does not simply override it. We cannot advise on any specific request, and you should take that to your own adviser.

No. Plans are monthly and you can cancel at any time from your billing portal. If you cancel, access continues to the end of the period you have already paid for. There is no annual contract, no minimum term and no exit fee.

Yes. The AUSTRAC guidance behind the platform and the in-app assistant is refreshed from AUSTRAC's own published pages, and the DFAT sanctions list used for screening updates automatically rather than by hand. Client review dates are set on a risk basis, so higher-risk clients come up for review sooner than lower-risk ones. Product changes are listed on our What's New page.

Electronic identity verification runs as a hosted check: your client is sent to a secure page to photograph their identity document and take a selfie, with liveness detection, and the result lands back on their file. Clients and beneficial owners are also screened against sanctions and politically exposed person lists, and company clients are verified against the Australian Business Register. AML Mate does not currently do DVS document data matching. Verifications are included per plan at 5 a month on Essentials, 20 on Professional and 50 on Business.