Tranche 2 is here: what the AML/CTF changes mean for Australian accountants

For twenty years, Australia's anti-money-laundering regime applied mainly to banks, casinos and remitters. That changed on 1 July 2026: the Tranche 2 reforms to the Anti-Money Laundering and Counter-Terrorism Financing Act extend the regime to lawyers, conveyancers, real estate professionals — and accountants.

If your practice provides certain designated services (structuring transactions, managing client money, assisting with entity formation, and similar), you are now a reporting entity with obligations to AUSTRAC, Australia's financial intelligence agency.

The dates that matter

• 1 July 2026 — the new regime commenced for Tranche 2 entities.
• 29 July 2026 — deadline for existing providers to enrol with AUSTRAC.
• Ongoing — customer due diligence, suspicious matter reporting, and an AML/CTF program appropriate to your practice's size and risk.

What customer due diligence actually requires

The core obligation is knowing who your customer is before you provide a designated service. In practice that means verifying identity against reliable, independent sources, understanding who ultimately owns or controls an entity client, and screening for politically exposed persons and sanctions where your risk assessment calls for it.

The TPB's requirement is separate, and it applies to every registered agent whether or not you provide a designated service. The two regimes, side by side sets out the different legal bases, triggers and record clocks.

For most suburban practices the biggest change is procedural: identity verification can no longer be an informal glance at a driver licence during tax season. It needs to be documented, repeatable, and producible if AUSTRAC asks.

Practical first steps

• Enrol with AUSTRAC if you haven't — the window closed on 29 July 2026, so treat this as urgent if it's outstanding.
• Appoint an AML/CTF compliance officer (in a small practice, usually a principal).
• Write a risk assessment for your client base — who you act for, what services carry risk, how you'll verify identity.
• Choose a verification method that doesn't leave photocopies of passports in your filing cabinet — retaining identity documents is itself a privacy risk.
• Keep records: what you checked, when, and the outcome.

Where e-signing fits

Your engagement letter is usually the first document a new client signs — which makes the signing moment the natural place to anchor client verification. Siggy already gives every signed engagement letter a tamper-evident certificate recording who signed, when, and from where.

Identity verification is now live in Siggy: check a client's identity against official government records with their consent, with a biometric face match and PEP & sanctions screening included in every check. Your client verifies in about two minutes on their phone, and your practice receives a verification outcome for its records instead of a copy of their passport. Siggy Australia is an accredited Australian Identity Service Provider.

Running a practice? Here is how accountants use Siggy ›