AUSTRAC Tranche 2 AML Compliance Guide
Tranche 2 is the expansion of Australia’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act, which brings real estate agents, conveyancers, accountants, lawyers, trust and company service providers, and digital asset businesses under the same reporting-entity obligations banks have followed for years. If your business provides one of these designated services, you must be AUSTRAC-enrolled, run a documented AML/CTF program, verify customer identity, monitor transactions, and report suspicious activity, or face civil penalties.
What is Tranche 2 and AML/CTF?
Tranche 2 is not a new law. It is the second phase of Australia’s existing AML/CTF Act, extending obligations that banks and financial institutions already carry to a second group of regulated entities, referred to as “Tranche 2 entities.” AML Smart Guard builds and maintains AUSTRAC-aligned AML/CTF programs for these Tranche 2 entities using LexisNexis RiskNarrative’s screening engine, so the business does not have to interpret the Act itself.
Who may have Tranche 2 obligations?
AML/CTF obligations depend on the particular services a business provides. Being part of one of these industries does not automatically mean every business is regulated.
| Sector | Designated service that triggers Tranche 2 |
| Real estate | Buying, selling, or arranging property transactions on a client’s behalf |
| Conveyancing | Settlement and property transfer services |
| Accounting and corporate services | Structuring entities, managing trusts, holding client money |
| Legal and advisory | Managing client funds, structuring transactions, company formation |
| Digital assets and payments | Exchanging, transferring, or safekeeping virtual assets |
| High-value dealers, gaming, pubs and clubs | Cash transactions over the reporting threshold |
| Funds and trustees | Managing pooled investment vehicles or trust structures |
Who needs to comply, and when?
Every business delivering one of the seven designated services above needs to comply, regardless of size. Whilst enrolment opened 31 March 2026, full compliance was required from 1 July 2026, and AUSTRAC allowed a practical grace period to 29 July 2026 for enrolment completion.
Now that AUSTRAC’s grace period has passed, if you have not enrolled, you are already non-compliant.
Does Tranche 2 apply to small businesses?
Yes. Size does not exempt a business, only the absence of a designated service does.
What if I only do this work occasionally?
AUSTRAC assesses by service provided, not by how often. Providing a designated service even occasionally can bring you into scope.
Is there a transition period left?
No. 1 July 2026 was the compliance date and the informal enrolment allowance closed 29 July 2026.
What is required under Tranche 2?
AML Smart Guard’s platform covers all seven obligations below inside one workflow, rather than requiring a business to stitch together a spreadsheet, an external screening tool, and a manual training log:
- AUSTRAC enrolment, confirming which designated services apply
- A named compliance officer with board-level accountability with appropriate senior management oversight.
- A written, risk-based AML/CTF program, built from a documented ML/TF risk assessment.
- Customer due diligence (CDD) and enhanced CDD for higher-risk customers, with records retained for 7 years.
- Ongoing account, customer and financial transaction monitoring, detecting unusual patterns against a risk-rated baseline to identify changes in customer risk and unusual activity.
- Suspicious matter reporting (SMR) support and evidence for AUSTRAC within statutory timeframes.
- Independent program review, checked periodically for effectiveness.
Confirming which designated services apply
With board-level accountability with appropriate senior management oversight.
Built from a documented ML/TF risk assessment.
- Carry out customer due diligence (CDD) and enhanced CDD (ECDD): Identify and verify customers and beneficial owners before or at the time of providing designated services, understand the purpose and nature of the relationship, and apply additional checks for higher‑risk situations (for example PEPs, high‑risk countries, complex or opaque structures, unusual transactions).
- Keep records: Make and retain records of CDD, transactions, risk assessments, program documents, training and AUSTRAC reports for at least 7 years, in a form that can be produced promptly on request.
- Monitor customers and transactions on an ongoing basis: Monitor business relationships and transaction activity to detect unusual or suspicious patterns, update risk ratings when circumstances change, and use that monitoring to decide when to apply ECDD or exit relationships.
- Report to AUSTRAC: Lodge suspicious matter reports (SMRs) when you suspect a person or transaction may be linked to crime or terrorism financing, and submit any other required reports (for example threshold transactions, international funds transfers or sector‑specific returns) within statutory timeframes.
What happens if you do not comply?
AUSTRAC has a range of regulatory and enforcement powers where businesses fail to meet their AML/CTF obligations. Depending on the circumstances, this can include remedial directions, infringement notices and civil penalty proceedings.
More importantly, businesses should be able to demonstrate that they have appropriate AML/CTF systems, controls and records in place and that their program is operating effectively.
AUSTRAC states that penalties may be as high as 100,000 penalty units for a company, and 20,000 penalty units for a person other than a company. Based on the penalty-unit value of $313 that applied from 01/07/26, this equates to maximum penalties of approximately $36.4 million and $7.28 million respectively.
The penalty that applies, will depend on the particular obligation, conduct and circumstances of the contravention.
Confirming which designated services apply
With board-level accountability with appropriate senior management oversight.
Built from a documented ML/TF risk assessment.
- Carry out customer due diligence (CDD) and enhanced CDD (ECDD): Identify and verify customers and beneficial owners before or at the time of providing designated services, understand the purpose and nature of the relationship, and apply additional checks for higher‑risk situations (for example PEPs, high‑risk countries, complex or opaque structures, unusual transactions).
- Keep records: Make and retain records of CDD, transactions, risk assessments, program documents, training and AUSTRAC reports for at least 7 years, in a form that can be produced promptly on request.
- Monitor customers and transactions on an ongoing basis: Monitor business relationships and transaction activity to detect unusual or suspicious patterns, update risk ratings when circumstances change, and use that monitoring to decide when to apply ECDD or exit relationships.
- Report to AUSTRAC: Lodge suspicious matter reports (SMRs) when you suspect a person or transaction may be linked to crime or terrorism financing, and submit any other required reports (for example threshold transactions, international funds transfers or sector‑specific returns) within statutory timeframes.
Where Businesses Trip Up
One of the most common mistakes is treating customer verification as the end of the AML process. Completing an initial KYC or KYB check is only one part of compliance. Customer risk can change throughout the relationship, so businesses also need processes to identify and respond to changes in risk, unusual activity and relevant red flags.
Ongoing monitoring goes beyond the initial customer check. It means continuing to assess customer risk throughout the relationship and responding when circumstances or activity change. Transaction monitoring forms part of this process, using relevant financial transaction information to identify unusual activity or risk indicators that may require review, investigation or escalation.
Confirming which designated services apply
With board-level accountability with appropriate senior management oversight.
Built from a documented ML/TF risk assessment.
- Carry out customer due diligence (CDD) and enhanced CDD (ECDD): Identify and verify customers and beneficial owners before or at the time of providing designated services, understand the purpose and nature of the relationship, and apply additional checks for higher‑risk situations (for example PEPs, high‑risk countries, complex or opaque structures, unusual transactions).
- Keep records: Make and retain records of CDD, transactions, risk assessments, program documents, training and AUSTRAC reports for at least 7 years, in a form that can be produced promptly on request.
- Monitor customers and transactions on an ongoing basis: Monitor business relationships and transaction activity to detect unusual or suspicious patterns, update risk ratings when circumstances change, and use that monitoring to decide when to apply ECDD or exit relationships.
- Report to AUSTRAC: Lodge suspicious matter reports (SMRs) when you suspect a person or transaction may be linked to crime or terrorism financing, and submit any other required reports (for example threshold transactions, international funds transfers or sector‑specific returns) within statutory timeframes.
What does Tranche 2 compliance actually cost?
Businesses building a compliance program without a managed platform report an average ongoing cost of $23,250 per year, covering admin time, screening software, professional consultation, staff training, and policy drafting.
| Path | Indicative monthly cost | What is included |
| Build it yourself | ~$1,938/mth equivalent ($23,250/yr) | Staff time, separate screening tool, manual policy drafting, ad hoc training |
| AML Smart Guard, Flex/Bespoke | From $99/mth + pay-as-you-go screening | Platform, guidance, expert support |
| AML Smart Guard, Standard | $349/mth | ~20 CDD screens, 3 training packs |
| AML Smart Guard, Scaled | $549/mth | ~40 CDD screens, 5 training packs |
| AML Smart Guard, Enterprise | $949/mth | Unlimited users, ~80 CDD screens, 10 training packs, dedicated account manager |
What to look for in an AML solution
Still unsure whether AML Smart Guard is the best AML solution for you?
| Criterion | Generic template or point tool | AML Smart Guard |
| AUSTRAC alignment | Often generic, not Tranche-2-specific | Built specifically for the seven Tranche 2 sectors |
| Coverage | Usually covers one obligation (e.g. screening only) | Risk assessment through reporting, end to end |
| Record retention | Manual, easy to lose | 7-year retention built in |
| Ongoing monitoring | Rarely automated | ~100 AUSTRAC-aligned rules, continuous |
| Support | Self-serve | Local Australian team, 15+ years AML/CTF experience |
A note from our founder
It’s easy to assume a customer will simply click an email link and breeze through ID verification. In practice, that’s rarely how it goes. We use LexisNexis IDVerse, which is best in class and used by 9 of the world’s top 10 banks, but even with that in place, our clients and their customers still trip up on the basics. What’s made the difference is the change support we’ve put around it, backed by real global compliance experience. In the two months since rollout, our clients have gone from blissful ignorance to brimming confidence. We’re only just out of the gates, but the numbers already back it up: 10,000+ proof points, 1,200 practitioners and 1,000 referrals, with more data coming in every week.
– Eddie Bailey, Founder and COO, AML Smart Guard
Frequently asked questions
Can’t find the answer that you’re looking for? Get in touch with us.
Tranche 1 already covers banks, casinos, and financial institutions. Tranche 2 extends the same AML/CTF Act obligations to real estate, legal, accounting, digital assets, and other professional services from 1 July 2026.
Yes, if a sole trader delivers a designated service (for example, a sole-practitioner conveyancer), the same obligations apply regardless of business size or structure.
AML Smart Guard’s platform can have a program designed and enabled within 48 hours of enrolment. Full embedding into daily workflow takes a little longer and depends on how quickly staff complete training, but most clients are running live monitoring within days.
Identity verification records, risk assessments, and transaction monitoring decisions must be retained for 7 years under the AML/CTF Act.
Technically yes, but AUSTRAC still expects a documented, risk-based program and monitoring capability; a spreadsheet rarely satisfies an audit.
AUSTRAC conducts reviews and can request evidence of your program at any time; independent program review is itself a Tranche 2 obligation.
Let us worry about AML compliance while you focus on your business.
Compliance as a Service. Our in-house experts manage every aspect of compliance, from KYC and ECDD to regulatory reporting.
Navigation
Who we protect
© 2026 AML Smart Guard. All rights reserved.