AML/CTF Compliance Services for Australian Businesses

Any business that provides a "designated service" listed in the AML/CTF Act: banks and lenders, remitters, virtual asset (digital currency) service providers, bullion dealers, casinos and bookmakers, and, from 1 July 2026, real estate agents, property developers, lawyers, conveyancers, accountants, trust and company service providers, and dealers in precious metals and stones. The test is the service you provide, not your industry label, so a scoping check is always the first step.

The Act passed in late 2024 and reforms the regime in two stages. Existing reporting entities moved to simplified, outcomes-based obligations on 31 March 2026, including new AML/CTF policies, a reformed tipping-off offence and virtual asset rules. Tranche 2 sectors (real estate, legal, conveyancing, accounting, trust and company services, precious metals and stones) are regulated from 1 July 2026 and were able to enrol from 31 March 2026.

Under the reformed Act it is a documented set of AML/CTF policies built on a written money-laundering and terrorism-financing risk assessment. It must cover customer due diligence, ongoing monitoring, reporting, record keeping, staff training and employee screening, name an AML/CTF compliance officer at management level, be approved by a senior manager and overseen by your governing body, and be independently evaluated periodically. It must be proportionate to your size and risk, not a copy of a bank's.

Threshold transaction reports for physical cash of $10,000 or more within 10 business days; suspicious matter reports within three business days, or 24 hours for terrorism financing; international funds and value transfer reports for remitters and banks, phased in for virtual asset providers; and an annual compliance report to AUSTRAC each year, lodged in the window AUSTRAC sets after the end of the reporting period (currently 1 July to 30 September for the financial year just ended).

Seven years. Customer identification records are kept for seven years after the relationship ends; transaction records for seven years after the transaction; and your AML/CTF policies, risk assessments and evaluation reports for seven years after they stop being used. Records can be electronic but must be retrievable for AUSTRAC on request, which is why we set up a simple filing structure from day one.

AUSTRAC can issue infringement notices, remedial directions and enforceable undertakings, and can seek civil penalties in the Federal Court. For a body corporate the maximum per contravention is 100,000 penalty units, which is tens of millions of dollars at the current penalty unit value, and 20,000 units for individuals. Failing to enrol on time is a civil penalty matter; criminal offences apply to providing remittance or virtual asset services without registration, and to tipping off.

We confirm whether you provide a designated service, complete AUSTRAC enrolment or registration, write the risk assessment and AML/CTF policies, set up customer identification, monitoring and reporting procedures that fit your workflow, train staff, and arrange the independent evaluation; because the evaluator must not have built the program, we evaluate only programs we did not write. Fees are fixed and quoted in advance. This page is general information, not legal advice.