100,000 Businesses Just Became Money Laundering Gatekeepers

As of 1 July 2026, every accountant, lawyer, conveyancer, and real estate agent in Australia who provides certain designated services is a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act. AUSTRAC estimates between 80,000 and 100,000 businesses are now caught by the Tranche 2 reforms — and most have had less than four months to prepare.

The obligations are not optional and not light. You must enrol with AUSTRAC by 29 July 2026, conduct a money laundering and terrorism financing risk assessment, implement a written AML/CTF program, appoint a compliance officer at management level, perform customer due diligence on every client before providing designated services, screen against sanctions lists, submit suspicious matter reports, and keep records for seven years. That is eight new regulatory obligations for businesses that, until yesterday, had zero.

The Australian Government's own Regulatory Impact Statement puts the average ongoing compliance cost at $23,250 per business per year, with upfront setup costs of up to $28,650. For a five-partner accounting firm or a mid-sized law practice, that is a meaningful hit to the bottom line — and the figure assumes you already know what you are doing.

If you are building your AML/CTF program from scratch using templates and DIY guidance, expect 40 to 80 hours of work before you are compliant, according to compliance consultancy estimates. Hiring a boutique AML/CTF consultant to develop the program runs $5,000 to $15,000. Ongoing advisory retainers add $3,000 to $8,000 per year. The bulk of the ongoing cost, though, is not the program itself — it is the daily operational burden of customer due diligence, transaction monitoring, and record-keeping.

Here is what makes the Tranche 2 burden different from most regulatory expansions: the obligations that consume the most staff time — customer due diligence, identity verification, sanctions screening, ongoing monitoring — are precisely the tasks AI handles well. AI-powered KYC platforms can verify a client's identity, check beneficial ownership structures, screen against sanctions and PEP lists, and flag anomalies in seconds. The manual equivalent takes 20 to 45 minutes per client onboarding.

The UK's Financial Conduct Authority reported in 2024 that 75 per cent of financial services firms were already using AI in their compliance operations. Australian professional services firms are starting from zero on AML obligations, which means they have an unusual opportunity: rather than retrofitting AI onto legacy compliance processes, they can build AI-native compliance workflows from day one.

Compliance software platforms built for Tranche 2 entities are already on the market, ranging from $59 to $999 per month depending on firm size and complexity. At the lower end, a sole practitioner accounting firm can automate CDD, sanctions screening, and suspicious matter reporting for less than $720 a year — against the government's $23,250 estimate for manual compliance. The gap between doing this manually and doing it with AI is not incremental. It is an order of magnitude.

Not every service an accountant or lawyer provides is caught. The Act specifies designated services — and the list is narrower than many firms fear. For lawyers, the triggers include assisting with property purchases or sales, entity restructuring, financing transactions, shelf company transfers, and acting as a nominee shareholder or providing a registered office address. General legal advice, litigation, and probate work are excluded. For accountants, the triggers centre on trust and company formation, managing client funds, and facilitating financial transactions.

The practical step is to map your service lines against AUSTRAC's designated services table and identify which clients and engagements require CDD. Many firms will find the obligations apply to a subset of their work — but for that subset, the requirements are absolute. You cannot provide the designated service until CDD is complete.

First, enrol with AUSTRAC before 29 July. The enrolment portal has been open since 31 March. Businesses continuing to provide designated services without enrolling risk enforcement action, with financial penalties applying for each day you remain unenrolled after the deadline.

Second, do not build your AML/CTF program manually. Evaluate compliance software that automates CDD, sanctions screening, and suspicious matter reporting. The cost difference between manual and automated compliance is stark — and the risk of human error in manual processes is exactly what regulators will scrutinise.

Third, train your staff now. Every person in your firm who interacts with clients providing designated services needs to understand what triggers a suspicious matter report and how to escalate without tipping off the client. AUSTRAC requires ongoing AML/CTF training, and the compliance officer you appoint must be at management level with genuine oversight of the program.

Key takeaways

Need to figure out what this means for your firm?

Book a call and we will map your services against the new obligations, identify where AI can automate the compliance burden, and help you build an AML/CTF program that does not consume your staff's billable hours.