Anti Money Laundering Compliance in Australia

By Panbo Ye, CFP^®, FCPA, SMSF Specialist Advisor · Founder of Everglow · Updated 1 September 2026

A Sydney accounting principal is preparing a settlement statement for a Chinese migrant buying property when a routine software prompt raises an uncomfortable question: does the conveyancing work now count as a designated service under Australia's expanded regime? If it does, the firm may need to enrol with the Australian Transaction Reports and Analysis Centre (AUSTRAC), build an anti money laundering compliance program, and change how staff handle client onboarding and suspicious activity.

The practical answer is that AML compliance is a workflow, not a policy document. A first-time reporting entity needs to identify the services that trigger obligations, understand its customer and transaction risks, establish controls, train staff, and meet strict reporting deadlines. The 2026 reform wave makes that work especially important for accountants, lawyers, conveyancers, real estate professionals and other newly regulated businesses.

Who this article is for: Australian accountants, advisers, lending and capital teams, property professionals, medical practices, not-for-profits, fund managers, Chinese companies, new migrants and other businesses that may provide designated services.

Currency note: This article reflects Australian rules, thresholds and regulator guidance current as at 09/2026.

A Real Moment That Made AML Suddenly Personal

The principal in this example has always treated compliance as part of good accounting practice. Her team verifies identities, keeps tax records and asks clients about unusual payments. The new issue is more specific. A service that previously sat outside the firm's ordinary AML process may now fall within the expanded Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act).

Anti money laundering compliance is the legal and operational discipline used to identify, prevent and report suspected money laundering and terrorism financing. It can involve customer identification, beneficial ownership checks, transaction monitoring, internal escalation and reporting to AUSTRAC. It isn't limited to banks. Coverage depends on the designated service a business provides.

The principal doesn't need a theoretical explanation. She needs to know:

• Scope: Which services make the firm a reporting entity?
• People: Who owns the program and who makes escalation decisions?
• Timing: When must reports be lodged?
• Evidence: What records demonstrate that the firm acted reasonably?
• Workflow: How do tax, advisory, lending and property matters move through the controls?

A multi-service firm may need to separate tax advice from a service connected with property settlement, trust administration, financing or movement of funds. That distinction can be difficult where the same client receives several services from the same team. The firm's approach to cross-border transactions should therefore connect client identity, beneficial ownership, source-of-funds information and transaction activity rather than treating each engagement as an isolated file.

Practical rule: Start with the service provided, not the label on the firm's letterhead.

Australia's regime is supervisory and data-driven. AUSTRAC's annual report records show that the system received 398.6 million reports in 2023–24, more than one million per day, compared with 91,136,306 financial transaction reports in 2013–14, a rise of more than fourfold across that period (AUSTRAC annual reports). That scale explains why monitoring, records and reporting are now core infrastructure.

What Anti Money Laundering Compliance Actually Means in Australia

A useful way to understand the regime is to separate the substantive duty from the procedural duty.

The substantive duty concerns what the business does with customer and transaction information. It identifies customers, verifies relevant details, understands ownership and control, monitors activity, and escalates concerns. Where a suspicion is formed after appropriate checks, the business may need to submit a Suspicious Matter Report (SMR) to AUSTRAC. The process should support consistent decisions, not just individual staff judgement.

The procedural duty creates the operating structure around those decisions. A reporting entity generally needs an AML/CTF program, an appointed AML/CTF officer, staff training, records retained for seven years, internal controls and annual compliance reporting. Customer due diligence is therefore more than a one-off identity check. The business needs to keep its information current enough to understand whether later activity remains consistent with the customer profile.

This is different from ordinary know your customer work and different again from tax compliance. Tax records help establish income, deductions, liabilities and transactions. AML compliance asks whether the business understands the customer, the service risk and the indicators that may require reporting to AUSTRAC. A client may have accurate tax returns and still present an AML concern.

The know your customer requirements should sit inside the wider AML program, not operate as a disconnected onboarding form.

A short table helps locate the regulated-activities layer.

For a first-time reporting entity, the central question is simple: what service do we provide, what risks arise from that service, and what evidence shows that our controls address those risks?

The Legal Framework and Who AUSTRAC Regulates

The legal foundation is the AML/CTF Act, supported by the AML/CTF Rules Instrument. AUSTRAC administers the regime, supervises reporting entities, receives financial intelligence and uses reporting information to support action against money laundering, terrorism financing and related offences.

A business becomes a reporting entity because it provides a designated service listed in section 6 of the AML/CTF Act. The business type alone doesn't answer the question. An accounting firm may provide services that are outside the regime in one engagement and designated services in another. The analysis needs to focus on the actual service, the customer and the way funds or assets are handled.

Australia's 2024 reforms expand the framework to additional designated-service providers. AUSTRAC says newly captured sectors include real estate professionals, lawyers, accountants, conveyancers, and dealers in precious metals and stones, with enrolment opening from 31 March 2026 and compliance starting 1 July 2026 (AUSTRAC reform update).

The same framework may intersect with financial advice and licensing questions. Businesses should assess whether their service model also raises AFS licence requirements, rather than assuming one regulatory analysis answers every issue.

AUSTRAC reads an AML program as one system. KYC, customer due diligence, transaction monitoring, reporting, officer oversight, records and training should reinforce each other. A policy that says staff must identify beneficial owners won't help if the onboarding form doesn't capture them, the reviewer can't interpret the information, or the escalation process has no clear owner.

The Building Blocks of a Risk-Based AML Program

A risk-based program begins with the customer and service, then follows the risk through the relationship. The controls should be proportionate to the business model, but proportionate doesn't mean informal.

Customer identification and due diligence establish who the customer is, who controls an entity or trust, and why the customer needs the service. For a company, that may include ownership and control information. For a trust, the firm may need to understand the trustee, beneficiaries and people who exercise control. The documentation standards should make it clear what staff must collect, how they verify it and where they record the decision.

Transaction monitoring then asks whether activity matches the customer profile. A medical practice may face identity and payment questions around patient or payer information. A not-for-profit may need to understand overseas donors and the purpose of incoming funds. A fund manager may focus on source-of-funds evidence, investor ownership and trust-account activity.

An AML/CTF officer needs enough authority to investigate alerts, seek further information and escalate matters. Training must reach the people who see transactions first, not just senior management. Records should preserve the rationale for decisions, including why the business accepted a customer, requested more information or decided that a suspicion had formed.

The reporting component is time-sensitive. AUSTRAC guidance states that an SMR must be lodged within 24 hours for terrorism-financing suspicions and within 3 business days for money laundering or other offences (AUSTRAC SMR reference guide). Those deadlines affect staffing, alert triage and management availability.

A firm serving Chinese companies or new migrants may need a careful process for identity documents, beneficial ownership, offshore funds, translated information and communication barriers. The point isn't to treat a nationality or language as a risk conclusion. The point is to ensure staff can understand the facts, test inconsistencies and document a fair decision.

Where Your Industry Sits Inside the AML Regime

AML exposure has a different texture across industries. The same rule can create very different operational pressure.

Consider the Nguyen family in Parramatta. The family uses a property trust to acquire an investment property, with a professional adviser coordinating accounting, finance and parts of the transaction process. The adviser should first identify the trustee, the people who control the trust and the beneficiaries relevant to the risk assessment. The adviser should also understand the commercial purpose of the acquisition and the expected source of funds.

Suppose the trust is expected to make a $10,000 or more physical-currency transfer in connection with a designated service. A threshold transaction report (TTR) may be required, and AUSTRAC says the report is due within 10 business days of the transaction (AUSTRAC TTR guide). The amount alone doesn't prove wrongdoing. It does, however, create a reporting event that staff must recognise.

If the team sees inconsistent ownership information, unexplained changes in funding instructions or activity that doesn't fit the customer's stated purpose, the AML/CTF officer should review the facts. If a suspicion is formed, the SMR clock begins. Staff should preserve relevant evidence, restrict unnecessary disclosure and record who made the decision and when.

The right response to an alert is neither automatic rejection nor casual acceptance. It's a documented, risk-based decision.

How a Reporting Workflow Plays Out in Practice

A policy and an annual compliance report cannot show whether staff handle a live matter correctly. AUSTRAC's annual compliance process examines how reporting entities operate and improve their controls. In the 2024–25 cycle, 10,511 reporting entities had to submit CR24 by 31 March 2025, while 8,752 submitted on time, an 83% on-time rate above the 81% target (AUSTRAC annual compliance reports).

For the Nguyen family matter, the workflow should run as follows:

1. Gather information: Confirm the trust, trustee, controllers, beneficiaries and transaction purpose.
2. Verify and assess: Check identity details and whether the proposed activity fits the customer profile.
3. Monitor activity: Compare payment instructions, counterparties and funding behaviour with the expected pattern.
4. Escalate: Send an alert to the AML/CTF officer when facts remain inconsistent or concerning.
5. Decide: Record whether the information creates a suspicion and the reasons.
6. Report: Lodge an SMR within the applicable statutory period if suspicion forms.
7. Review: Update the risk rating, controls or training where needed.

Each step needs an owner, evidence and a clear escalation route. Staff can use a due diligence checklist to keep required information together, but the checklist does not replace judgment. A multi-service firm should also ask which service created the exposure. Tax advice alone may not create the same AML reporting question as a connected lending, property or payment service.

The business must check for separate reporting obligations. A TTR concerns physical currency of $10,000 or more, while an SMR concerns suspicion. A transaction may be reportable because of its type, its circumstances, or both.

The annual calendar needs a named owner. AUSTRAC's current guidance says the 2025 reporting cycle opens on 1 January 2026 and closes at 11:59pm AEDT on 31 March 2026. It also states that an entity must file if it provided designated services for any part of the relevant year, even one day (AUSTRAC 2025 compliance report guidance).

Common Pitfalls, Timing Traps and When to Seek Advice

The first mistake is treating AML compliance as a document exercise. A policy may describe customer checks, but it won't resolve a service-scoping question, identify a missing beneficial owner or alert the business when an SMR deadline is approaching.

The second mistake is allowing different service lines to operate separate risk assumptions. A tax team may know a client well, while a lending or property team sees new counterparties and funds flows. Without a shared customer record and escalation path, the firm may miss the connection between ordinary-looking activities.

Current AUSTRAC guidance describes annual reporting through a calendar-year process, while other current industry guidance discusses a financial-year cycle and a lodgement window from 1 July to 30 September for some entities (current compliance-reporting guidance). Because reporting arrangements can change, the entity should confirm its applicable cycle directly with AUSTRAC rather than relying on an old internal calendar.

The 2026 expansion creates particular pressure for firms with lower AML maturity. Accountants, lawyers, conveyancers and property professionals may need to map each service line, update existing-client procedures, document risk assessments and train staff before compliance begins on 1 July 2026. Cross-border structuring, complex beneficial ownership, mixed tax and advisory work, or correspondence from AUSTRAC justify specialist review before action is taken.

The core answer is that anti money laundering compliance requires a risk-based operating system, not just an annual filing. The right scope, controls and reporting workflow depend on the services provided, customer profile, transaction pattern and business structure.

If you would like clarity on how these principles may apply to your own circumstances, contact Everglow on 1300 913 929 or email contact@everglow.au.

To book directly: Book a meeting with Panbo.

Tags: anti money laundering compliance, AML/CTF Australia, AUSTRAC, suspicious matter reports, customer due diligence, reporting entities, 2026 AML reforms