AUSTRAC Tranche 2 guide for Australian businesses

For newly regulated entities already providing an applicable new designated service before 1 July 2026, the transitional enrolment deadline was 29 July 2026 and has passed. Under the standard rule, a person must apply to enrol no later than 28 days after the day they start providing a designated service.

A reporting entity must undertake an ML/TF risk assessment that identifies and assesses the risks it may reasonably face in providing its designated services. It must review the assessment when specified events occur and, in any event, at least once every 3 years, subject to the applicable statutory framework.

An AML/CTF program comprises the reporting entity's ML/TF risk assessment and AML/CTF policies. The policies must appropriately manage and mitigate the identified risks, support compliance with the Act and Rules, and be appropriate to the nature, size and complexity of the business. The reporting entity remains responsible for adapting, approving and implementing any starter-kit or generated material.

Where the compliance-officer obligations apply, the reporting entity must designate an eligible individual at management level with sufficient authority, independence and access to resources and information. The individual must meet the applicable residency and fit-and-proper requirements. The standard rule requires AUSTRAC to be notified within 14 days after designation; the historical transitional rule for newly regulated entities was the later of 29 July 2026 or 14 days after enrolment.

A reporting entity must undertake initial and ongoing CDD in accordance with the Act and Rules, subject to applicable exceptions. Initial CDD includes establishing the customer's identity, relevant representative authority, beneficial ownership for a non-individual customer, applicable PEP and targeted-financial-sanctions status, and the nature and purpose of the relationship or occasional transaction. Enhanced CDD applies in the circumstances specified by section 32.

Where the ongoing CDD obligation applies, the reporting entity must monitor the customer relationship and transactions in accordance with the Act, Rules and its risk-based AML/CTF policies. The appropriate controls depend on the circumstances and assessed ML/TF risk.

A suspicious matter reporting obligation arises when the statutory conditions in section 41 are met. The standard SMR deadline is 3 business days after the suspicion is formed, or 24 hours where it relates to terrorism financing. Section 123 applies to covered information where disclosure would or could reasonably be expected to prejudice an investigation, subject to statutory exceptions. A threshold transaction report is required where the conditions in section 43 apply, including an applicable transaction involving physical currency of at least $10,000.

Where the Part 1A program obligations apply, AML/CTF policies must provide for independent evaluations at a frequency appropriate to the nature, size and complexity of the business and at least once every 3 years. The evaluator must not have been involved in undertaking the risk assessment or developing, maintaining or implementing the policies being evaluated. Transitional rules stagger the first evaluation deadline for newly regulated entities.

Different AML/CTF record categories have different retention rules and triggers. AML/CTF program records must be retained until 7 years after they cease to be relevant to demonstrating compliance with Part 1A. CDD and transaction records must be retained for their applicable statutory periods. A reporting entity should classify each record and apply the relevant rule rather than using one start date for every record.