What is the AML legal framework in Australia, and which legal instruments apply?
On 31 March 2026 AUSTRAC said the number of businesses it regulates would grow from around 19,000 to close to 100,000 on 1 July 2026, as the Tranche 2 sectors came in.
The key legal instruments start with the AML/CTF Act of 2006 and its 2024 Amendment Act, which reformed it in two main steps: 31 March 2026 for current reporting entities and 1 July 2026 for the Tranche 2 sectors. The AUSTRAC CEO makes the AML/CTF Rules 2025, which set what CDD collects, what each report contains and the reporting periods.
As a FATF member, Australia is assessed against the FATF Recommendations, the standard behind AML regulations in every other member country.
| Instrument | In force or latest dated change (November 2026) | What it does for AML |
|---|---|---|
| Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act, No. 169, 2006) | Assent 12 December 2006; compilation of 1 October 2026 | Designated services (s. 6), programs (Part 1A), customer due diligence (Part 2), reports (Part 3), records (Part 10), civil penalties (s. 175) |
| AML/CTF Amendment Act 2024 (No. 110, 2024) | Assent 10 December 2024; Schedules 1 to 3 from 31 March 2026; Tranche 2 duties from 1 July 2026 (Sch. 3 item 11) | The reform; repeal of the Financial Transaction Reports Act 1988 (Sch. 11, 7 January 2025) |
| AML/CTF Rules 2025 | Registered 29 August 2025; in force 31 March 2026, with the amendment of 24 March 2026 | CDD detail, report contents, compliance report periods (the report forms are AUSTRAC's, approved by its CEO) |
| AML/CTF Transitional Rules 2026 | In force 31 March 2026; compilation of 14 May 2026 | Old identification procedures until 31 March 2029, IFTI reports until IVTS reporting starts, first evaluation dates |
| Criminal Code, Division 400 | Compilation of 30 June 2026 | Money laundering offenses, graded by value and by belief, recklessness or negligence (ss. 400.2B to 400.9) |
| Autonomous Sanctions Act 2011 | Compilation of 30 October 2026 | Sanctions offenses (s. 16); with the Charter of the United Nations Act 1945 (compilation of 14 September 2021), the basis of targeted financial sanctions |
| Crimes Act 1914, s. 4AA | Compilation of 27 August 2026; unit indexed on 1 July 2026 | Sets the dollar value of a penalty unit |
| Financial Transaction Reports Act 1988 | Repealed 7 January 2025 | The old cash reporting law, no longer in force |
Who regulates AML in Australia? AUSTRAC and the government's role in AML/CFT
AUSTRAC, the Australian Transaction Reports and Analysis Centre, is both the regulator and Australia's financial intelligence unit. The government and regulatory role in AML/CFT is split among four bodies:
- AUSTRAC. Through its CEO it analyzes and shares the reports it receives (s. 212(1)), monitors compliance (s. 190) and makes the AML/CTF Rules (s. 229). It enforces through external audits (s. 162), remedial directions (s. 191), enforceable undertakings (s. 197), infringement notices (s. 184) and civil penalty applications only the CEO may bring (s. 176).
- Department of Home Affairs. Administers the AML/CTF Act.
- DFAT's Australian Sanctions Office. Keeps the Consolidated List of sanctioned individuals, entities and vessels.
- Federal Court of Australia. Makes civil penalty orders (s. 175).
Which businesses must comply with the AML/CTF Act?
A business must comply once it provides a designated service listed in one of the six tables in s. 6 with the geographical link of s. 6(6), usually a permanent establishment in Australia; it is then a reporting entity. Table 1 covers financial services, including banking, remittance and virtual asset services; table 2 bullion and precious goods; table 3 gambling; table 4 prescribed services; table 5 real estate; table 6 professional services.
A law firm (illustrative) acting for a buyer in a house purchase provides item 1 of table 6, and the buyer is its customer. Remitters and virtual asset service providers offering registrable services must also be registered with AUSTRAC (ss. 74, 76A).
What changed for lawyers, accountants, real estate agents and dealers on 1 July 2026?
| Milestone | Current reporting entities (Tranche 1) | Tranche 2 businesses | Basis (in force, November 2026) |
|---|---|---|---|
| Reformed duties apply | 31 March 2026 | 1 July 2026 | Amending Act s. 2; Sch. 3 item 11 |
| Enrollment | Already enrolled | Apply by 29 July 2026 if serving before 1 July 2026 and providing no other designated service; otherwise within 28 days of the first service | Sch. 3 item 12; s. 51B |
| Compliance officer notice to AUSTRAC | By 30 May 2026 if enrolled on 30 March 2026 | If serving before 1 July 2026 with no other designated service: by the later of 14 days after entry on the Reporting Entities Roll and 29 July 2026; otherwise within 14 days of designation | Transitional Rules ss. 18, 19; Act s. 26M |
| First independent evaluation (on time if done before) | The later of 4 years after the last independent review and 31 March 2027, for entities enrolled on 30 March 2026 with at least one review done | If serving before 1 July 2026 with no other designated service: 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030, set by the last two digits of the "enrolment identifier"; otherwise as the entity's policies set, at least every 3 years (s. 26F(4)(f)) | Transitional Rules ss. 16, 17 |
| First annual compliance report | Period 1 July 2026 to 30 June 2027, lodged within 3 months | Same | Rules s. 9-9 |
Tranche 2 is the common name for three groups: dealers buying or selling precious metals, stones and products for A$10,000 or more in physical currency or virtual assets, single or linked (table 2 item 2); real estate (table 5); and professional services (table 6). Most are designated non financial businesses and professions in FATF terms. Table 6 also covers company formation, nominee roles and registered office addresses, the work of trust and company service providers. Barristers acting on a solicitor's instructions given for a designated service are outside (s. 6(6B)).
What are the AML requirements for businesses in Australia?
AML compliance in Australia starts before the first customer. A reporting entity must assess the money laundering, terrorism financing and proliferation financing risks it may reasonably face (s. 26C). It reviews that assessment on a significant change (before the change if it is within its control), when AUSTRAC sends risk information, and at least every 3 years (s. 26D), and it may not start a designated service without the assessment and its AML/CTF policies (ss. 26E, 26F(8)). A management level AML/CTF compliance officer oversees the program (ss. 26J, 26L). The last column marks what complead, formerly Sanction Scanner, can support and what stays with the entity.
| Obligation | Legal basis (in force, November 2026) | What a program must do | How complead does it |
|---|---|---|---|
| Enrollment | s. 51B; Amending Act Sch. 3 item 12 | Apply for entry on the Reporting Entities Roll within 28 days of the first designated service (Tranche 2 businesses already serving: by 29 July 2026); remitters and VASPs also register (ss. 74, 76A). | Outside the platform: enrollment is the entity's own filing. |
| ML/TF risk assessment | ss. 26C to 26E | Assess money laundering, terrorism and proliferation financing risk before serving; review on significant change, on AUSTRAC risk information and at least every 3 years. | Detection rules can be scoped per product, segment or jurisdiction to match the assessed risks. |
| AML/CTF policies | s. 26F | Policies, procedures, systems and controls in place before the first service, covering CDD, staff due diligence, training and independent evaluations. | Outside the platform: the policies are the entity's own documents. |
| Governing body | s. 26H | Ongoing oversight of the risk assessment and of compliance; reasonable steps to make sure risks are managed. | Each alert decision is stored with the name of the person who made it. |
| AML/CTF compliance officer | ss. 26J, 26K, 26M | Designate within 28 days a fit and proper officer at management level with enough authority, independence and resources, resident in Australia where services run through an Australian permanent establishment; notify AUSTRAC within 14 days. | Outside the platform: a staffing duty. |
| Independent evaluation | s. 26F(4)(f); Transitional Rules ss. 16, 17 | At least once every 3 years; first dates in the Tranche 2 table above. | An evaluator can read each rule's version history: who changed what, when and why. |
| Initial CDD | s. 28 | Before the service: identity, agents, beneficial owners, PEP and sanctions status, nature and purpose; verify as the risk requires. | Customer risk assessment and KYC puts each customer on one risk score. |
| Beneficial owners | ss. 5, 28(2)(d) | Identify every individual who owns 25% or more, directly or indirectly, or controls a customer that is not an individual. | KYB and UBO verification climbs the ownership chain, parent by parent, until it reaches natural persons; a layer it cannot resolve is flagged as unresolved. |
| Enhanced CDD | s. 32 | High risk customers, an SMR with continued service, foreign PEPs, people present in or entities formed in jurisdictions where the FATF called for enhanced due diligence, nested services, kinds named in the Rules. | Onboarding, screening and monitoring run on one engine, so the customer carries one score; the reviewer decides on any PEP or sanctions match. |
| Ongoing CDD | s. 30 | Monitor for unusual transactions and behaviors; review the customer's risk on significant change; update and reverify KYC as the risk requires and when its adequacy or veracity is in doubt. | Ongoing monitoring can be started and stopped per name through API triggers. |
| Suspicious matter report (SMR) | s. 41 | 3 business days after the suspicion forms; 24 hours for terrorism financing; 5 business days where part of the information may be privileged and the privilege is another person's. | Each alert shows which rule fired and which signals matched; the officer writes the grounds the SMR must state (s. 41(3)(c)). |
| Threshold transaction report (TTR) | ss. 5, 43 | Physical currency of A$10,000 or more; within 10 business days of the transaction. | A rule with an A$10,000 threshold can flag the transactions; the TTR itself is lodged with AUSTRAC. |
| International transfer reports | s. 46; Transitional Rules ss. 9, 10 | IFTI reports under s. 45 as in force on 30 March 2026 until 31 March 2029 (or, for eligible entities, a notified date up to 30 September 2029); then IVTS reports within 10 business days of passing on or receiving the transfer message. | Outside the platform: reports are lodged with AUSTRAC. |
| Travel rule | ss. 64 to 66A | Collect, verify where the Rules require, and pass on payer and payee information with each transfer of value under the travel rule, virtual assets included. | Sender and receiver are screened through the API while the transfer runs; the travel rule message itself stays with the entity. |
| Annual compliance report | s. 47; Rules s. 9-9 | First period 1 July 2026 to 30 June 2027; lodge within 3 months, by 30 September 2027. | Outside the platform: the report is the entity's own. |
| Records | ss. 107, 111 | Transaction records that allow each transaction to be reconstructed, kept 7 years from creation; CDD records, including risk analysis and decisions, kept 7 years after the relationship ends or the occasional transaction is completed. | Each screening search stays on record: the user, the search term, the time and the result, no matches included. |
| Tipping off | s. 123 | No disclosure of an SMR or certain AUSTRAC notices that could prejudice an investigation; exceptions for lawyers and accountants dissuading a client and for prescribed sharing between reporting entities. | Outside the platform: a policy duty of the entity. |
What does customer due diligence (CDD) require, including beneficial owners?
An AML check in Australia is the initial CDD of s. 28. Before the service starts, the entity establishes on reasonable grounds who the customer is, anyone acting for the customer and their authority to act, anyone for whom the customer receives the service, any beneficial owner of a customer that is not an individual, whether any of them is a politically exposed person or designated for targeted financial sanctions, and the nature and purpose of the business relationship or occasional transaction (s. 28(2)). Verification uses reliable and independent data, scaled to the customer's risk (s. 28(3)(d)).
A beneficial owner ultimately owns 25 percent or more, directly or indirectly, or controls the customer (s. 5). Enhanced due diligence adds measures in the six cases s. 32 lists, among them high risk customers, foreign PEPs and customers kept on after an SMR.
Suspicious activity monitoring: when are SMRs and TTRs due?
Australia's suspicious matter report (SMR) is the suspicious activity report (SAR) of other countries. The duty arises when an entity providing, proposing or asked about a designated service suspects on reasonable grounds a matter listed in s. 41(1), such as a false identity, information relevant to an offense or tax evasion, or a link to money laundering or terrorism financing.
The clock starts when the suspicion forms. Take a bookmaker (illustrative) whose compliance officer forms a suspicion on Wednesday 4 November 2026, two days after the alert. The SMR is due by Monday 9 November, 3 business days later; a terrorism financing suspicion needs a report within 24 hours (s. 41(2)).
| Line | Amount or time | Basis (in force, November 2026) |
|---|---|---|
| Threshold transaction report | Physical currency of A$10,000 or more; report within 10 business days | ss. 5, 43 |
| Precious goods dealers (Tranche 2) | Cash or virtual assets of A$10,000 or more, single or linked | s. 6, table 2 item 2 |
| Monetary instruments moved into or out of Australia | A$10,000 or more must be reported | s. 53 |
| Beneficial owner | 25% or more, direct or indirect, or control | s. 5 |
| Suspicious matter report | 3 business days; 24 hours for terrorism financing; 5 business days where part may be privileged and the privilege is another person's | s. 41(2) |
| IFTI, later IVTS report | 10 business days | s. 46(2); Transitional Rules s. 10 |
| Enrollment | Apply within 28 days after the first designated service | s. 51B |
| Compliance officer | Designate within 28 days; notify AUSTRAC within 14 days of designation | ss. 26K, 26M |
| Records | 7 years | ss. 107, 111 |
Financial sanctions compliance: must businesses screen against the DFAT Consolidated List?
The Act does not name the list. Initial CDD must establish whether the customer or any person around it named in s. 28(2)(e) is designated for targeted financial sanctions under regulations made under the Charter of the United Nations Act 1945 or the Autonomous Sanctions Act 2011 (s. 5). The AML/CTF policies must also keep assets away from such persons (Rules s. 5-3).
DFAT's Australian Sanctions Office keeps the Consolidated List of individuals, entities and vessels sanctioned by the UN Security Council (UNSC) or by the Foreign Minister and calls it "a key resource for due diligence checks". The XLSX was last updated on 2 November 2026. DFAT's list is among those complead client screening covers: OFAC, EU, UN, UK (HMT), DFAT and SECO lists plus 200+ national regimes.
What does ongoing monitoring require?
Where services run through an Australian permanent establishment, ongoing CDD means monitoring customers for unusual transactions and behaviors that may lead to an SMR, reviewing a customer's risk after significant changes or unusual activity, and updating and reverifying KYC as often as that risk requires and whenever the entity doubts the KYC information it holds (s. 30(2)). Unusual activity includes unusually large or complex transactions, odd patterns, activity with no apparent economic or lawful purpose and activity at odds with what the entity knows about the customer (s. 30(5)). complead transaction monitoring runs such checks as rules a team builds without code and backtests against real history in 30, 60 or 90 day windows.
What are the penalties for breaching Australia's AML laws?
The Act's core duties are civil penalty provisions (ss. 26E(2), 28(8), 41(4), 43(4)). If the Federal Court finds a contravention, it may order a body corporate to pay up to 100,000 penalty units and any other person up to 20,000, weighing the contravention's nature and extent, any loss and other matters (s. 175(3) to (5)). Conduct breaching several provisions attracts at most one penalty (s. 175(6)). Contraventions also multiply: each designated service given without initial CDD is a separate one (s. 28(9)), and so is each day after a missed "enrolment deadline" (s. 51B(2C)).
Tipping off carries 2 years or 120 penalty units, or both (s. 123): for an offense committed on or after 1 July 2026, 120 times A$364 is A$43,680; at the earlier A$330 it was A$39,600 (penalty unit instrument; Crimes Act s. 4AA(8)).
| Breach | Ceiling | Basis (in force, November 2026) |
|---|---|---|
| Civil penalty provision, body corporate | 100,000 penalty units, set by the Federal Court; one penalty for the same conduct | AML/CTF Act s. 175(4), (6) |
| Civil penalty provision, any other person | 20,000 penalty units | s. 175(5) |
| Tipping off | 2 years or 120 penalty units, or both | s. 123(1) |
| Structuring to avoid a TTR | 5 years or 300 penalty units, or both | s. 142(1) |
| Moving A$10,000 or more in monetary instruments across the border unreported | 2 years or 500 penalty units, or both; also a civil penalty provision | s. 53(1) to (3) |
| Breaching an AUSTRAC external audit notice | 12 months or 60 penalty units, or both; also a civil penalty provision | s. 162(7) to (9) |
| Money laundering, A$10 million or more | Life imprisonment where the money or property is, and the person believes it to be, proceeds of crime, or the person intends it to become an instrument of crime; 15 years or 900 penalty units, or both, if reckless; 6 years or 360, or both, if negligent | Criminal Code s. 400.2B |
| Money laundering, A$1 million or more | 25 years or 1,500 penalty units, or both (belief or intent); 12 years or 720 if reckless; 5 years or 300 if negligent | Criminal Code s. 400.3 |
| Sanctions offense, individual | Up to 10 years, a fine of the greater of 3 times the transaction value or 2,500 penalty units (2,500 units where the court cannot set the value), or both | Autonomous Sanctions Act s. 16(3), (4); Charter of the United Nations Act 1945 s. 27(3), (4) |
| Sanctions offense, body corporate | Fine of the greater of 3 times the transaction value or 10,000 penalty units (10,000 where the value cannot be set); strict liability, with a defense of reasonable precautions and due diligence | Autonomous Sanctions Act s. 16(5) to (9); Charter of the United Nations Act 1945 s. 27(5) to (9) |
Which businesses has AUSTRAC acted against since 2024?
AUSTRAC's dealings with Cryptolink, a crypto ATM operator, went from an infringement notice to a suspension in just over nine months. In October 2025 AUSTRAC issued it a A$56,340 infringement notice and accepted an enforceable undertaking over late threshold transaction reports and weak risk assessments. From 9 August 2026 it suspended Cryptolink's registration for three months after the company failed to submit TTRs and to answer a request for information.
The table lists selected actions from AUSTRAC's releases since June 2024. The largest amounts still come from the Federal Court: Westpac's A$1.3 billion penalty of 21 October 2020 covered over 23 million admitted contraventions.
| Date | Entity | Action | What AUSTRAC cited |
|---|---|---|---|
| 7 June 2024 | SkyCity Adelaide | Federal Court: A$67 million penalty plus A$3 million costs | Programs short of the Act; inadequate ongoing CDD |
| 16 December 2024 | Entain | Civil penalty proceedings filed | Alleged noncompliant program; risks not identified and assessed |
| 30 July 2025 | Mounties (Mount Pritchard District and Community Club) | Civil penalty proceedings filed | Alleged gaming services without a compliant program |
| 22 August 2025 | Binance Australia | External audit ordered (s. 162) | Serious concerns with AML/CTF controls |
| 2 September 2025 | Revolut Payments Australia | A$187,800 infringement notice | Late IFTI reports, self disclosed |
| 30 October 2025 | Cryptolink | A$56,340 infringement notice; enforceable undertaking | Late TTRs; weak risk assessments |
| 18 December 2025 | Bendigo and Adelaide Bank | Enforcement investigation, beside APRA action | Deficiencies found by an independent review of suspected laundering at a branch |
| 22 January 2026 | Airwallex | External audit ordered | Concerns about potential noncompliance |
| 27 May 2026 | Castra Licensee; Princeton Securities (NSW) | Federal Court: A$50,000 and A$45,000 | A$18,780 infringement notices left unpaid for missing 2023 compliance reports |
| 6 July 2026 | bet365 | Enforceable undertaking | Risk assessment; detecting and reporting suspicious transactions |
| 9 August 2026 | Cryptolink | Registration suspended for 3 months; 96 crypto ATMs offline | TTRs not submitted; no answer to a request for information |
| 1 September 2026 | Western Union | Investigation launched | Management of high risk payment channels, customers and affiliates |
| 7 September 2026 | 45 remitters and VASPs | Registrations cancelled, suspended or not renewed over the past year | Among them GetCoins, cancelled after customer complaints about investment scams |
Is Australia on a FATF list, and when is its next mutual evaluation?
No. Australia, a FATF member since 1990, is in enhanced follow up and was on neither FATF list of 19 June 2026.
For the October 2026 plenary, a FinCEN release dated 30 October reports four gray list removals and no change to the call for action list.
Australia's last mutual evaluation, by the FATF and the Asia/Pacific Group on Money Laundering (APG), came out on 21 April 2015. Since the fourth follow up report of 27 March 2024, Australia is compliant on 18 Recommendations, largely compliant on 12, partially compliant on 6 and non compliant on 4: R.22, R.23 and R.28 on designated non financial businesses and professions, and R.25 on beneficial ownership of legal arrangements such as trusts.
The FATF assessment calendar lists a possible onsite visit in November 2026 and a possible plenary discussion in June 2027.
How can AML screening and monitoring solutions help in Australia?
Picture a remitter (illustrative). Before its first transfer abroad it needs a risk assessment and policies (ss. 26C, 26F) and CDD with sanctions status (s. 28); each transfer then carries payer and payee data (s. 64), and monitoring feeds any SMR (ss. 30, 41).
Sanction Scanner, the screening product, is part of complead, an AI native platform for AML, KYC and fraud. For the remitter, payment screening runs sender and receiver checks through the API during each transfer. The remitter's client screening compares each name with 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes, DFAT's list among them.
Agents close the routine cases with the evidence, the narrative and the work log attached. Your AML/CTF compliance officer decides the rest and files any SMR through AUSTRAC Online. For regulatory compliance and reporting, complead gives reporting support within case management, and the case record shows who decided.
What changed in Australia's AML rules in 2025 and 2026, and what comes next?
- 7 January 2025. The Financial Transaction Reports Act 1988 (FTR Act) is repealed (Amending Act Sch. 11).
- 31 March 2025. The new tipping off offense in s. 123 starts (Sch. 5 item 2).
- 31 March 2026. The reformed Act and the new Rules apply to current reporting entities; new professions can enroll through AUSTRAC Online.
- 1 July 2026. Tranche 2 begins, new TTR and SMR forms go live, and the penalty unit rises to A$364 for offenses committed from that day.
- 28 August 2026. AUSTRAC begins s. 167 notices to businesses that seem to provide designated services without enrolling.
Next come the possible FATF onsite visit (November 2026) and IVTS reports from 31 March 2029, or a notified later date for eligible entities.
This week, confirm that the business is enrolled and that AUSTRAC has the compliance officer's name. Put the compliance report due 30 September 2027 in the reporting calendar. Rescreen customers each time DFAT updates the Consolidated List.
The 2026 PDF for Australia. Every rule, date and penalty stays readable on this page. The download beside it packs five working files for the compliance desk: a Tranche 2 start checklist, an SMR decision log (alert, suspicion formed, clock, filed), a reporting calendar for SMRs, TTRs, IFTI and IVTS reports and the compliance report, a beneficial owner worksheet at 25 percent and an independent evaluation date finder keyed to the enrolment identifier. Every section of the Act, the Rules and the Transitional Rules cited here was read in the legislation.gov.au compilation in force on 5 November 2026, and every enforcement row in AUSTRAC's own release.
