Not every practice is captured. Here’s how to know, and what to do.

Not every accounting practice is captured. The AML/CTF Amendment Act 2024 only pulls you in if you provide specific designated services — forming companies or trusts, arranging nominee directors, managing client funds, or running a registered office. Ordinary tax returns, bookkeeping, and financial statements sit outside the definition entirely, no matter how large the client or the fee.

If even one designated service applies, your whole practice enrols through AUSTRAC Online — your ABN, business details, and a description of the designated services you provide. The historical transitional enrolment deadline for applicable newly regulated entities passed on 29 July 2026; standard ongoing enrolment timing is separate.

Up to $36,400,000 (100,000 penalty units × $364) for bodies corporate

This isn't optional paperwork — it's been a legal requirement since obligations commenced on 1 July 2026, and it has to actually reflect your practice. Your program needs a documented risk assessment methodology, customer due diligence procedures, staff training obligations, ongoing transaction monitoring, and the process your firm follows to lodge a suspicious matter report.

Someone in your practice has to own this — overseeing the program, managing AUSTRAC reporting, running staff training, and conducting the annual review. In a sole practice, that's you. Either way, the appointment needs to be documented inside the program itself, not just understood informally.

Before providing a designated service, you need current AUSTRAC-approved identification on file — individual and company details, beneficial ownership behind any trust or corporate structure, and a closer look wherever risk factors are present. This has to happen at the start of the relationship, not retrofitted once a transaction is already underway.

Everyone touching a designated service needs AML/CTF awareness training, refreshed on an ongoing basis, with records kept as part of your compliance file. This is one of the areas AUSTRAC checks first in a review, because it's the easiest to evidence — or the easiest to be caught without.

At least once every three years — more often if your practice's size or complexity calls for it — someone outside your firm needs to evaluate the whole program: the risk assessment, the policy design, whether you're actually following your own procedures, and how well they're mitigating risk. The findings go to your governing body or a responsible senior manager in writing. This is separate from, and in addition to, your annual internal review.

Distinct from your annual internal program review