AML for accountants in Australia: what Tranche 2 covers and what to do first

Which accounting services are designated services

The AML/CTF Act 2006, as amended by the AML/CTF Amendment Act 2024, added nine professional services in table 6 of section 6(5B). These reforms are usually called Tranche 2. Your firm’s obligations depend on whether it provides one of these services, not on being an accounting firm.

Work that usually isn’t a designated service

• Tax returns, BAS and annual accounts. None of them is among the nine items.
• Tax advice on a decision the client hasn’t made. In AUSTRAC’s own example, advising on the tax effect of selling a company isn’t a designated service. Acting on the sale once there’s a buyer is.
• Advice after the event, such as whether a restructure that’s already finished was done properly.
• Changes that don’t alter legal form. AUSTRAC reads “restructuring” as a change to the legal structure, so reorganising staff or systems isn’t covered.
• Routine bookkeeping payments made under fixed instructions, as long as the firm provides no other designated service. That exception is tested across the whole firm, not one team.
• Work for entities in your own business group.

In a practice of 5 to 100 people, check entity set-ups and registered office addresses first. They’re the items an accounting firm is most likely to provide without thinking of them as regulated.

A worked example: the Schurr group’s restructure

The Schurr family group has been a client for years. Schurr Pty Ltd trades, the Schurr Family Trust holds its 1,000 shares, and Dean Schurr is the trust’s trustee and appointor. In August 2026 Dean asks for the usual 2025–26 returns, and whether he should put a holding company between the trust and the trading company.

Neither job is a designated service. In October, Dean says go ahead. From the moment the firm acts on that instruction, it’s creating a company (item 6) and moving a controlling interest in Schurr Pty Ltd (item 2). If the new company uses the firm’s address as its registered office, that’s item 9, with the company as the customer.

The group has only ever had tax and accounting work, so it isn’t a pre-commencement customer. Before anything goes to ASIC, the firm completes initial due diligence:

• Dean, as the person instructing the firm, identified and verified as an individual.
• The proposed directors and beneficial owners of Schurr Holdings Pty Ltd, who are also customers when a firm creates a company.
• The ownership chain: the new company’s shares will be held by the trust, and Dean controls the trust as trustee and appointor, so Dean is a beneficial owner.
• Melissa is a named beneficiary with no shares and no control role. On these facts we’d record her as a beneficiary, not a beneficial owner, and write down why.
• Politically exposed person and sanctions checks on each person, and the purpose of the restructure in Dean’s words.

A current structure diagram of the group answers most of the ownership question. AUSTRAC doesn’t require a chart, but it does require a record of how you established each matter.

Enrol with AUSTRAC within 28 days of starting

The law requires you to enrol no later than 28 days after the day you start providing a designated service. For a firm that started on 1 July 2026, that was 29 July. Accountants enrol through AUSTRAC Online; registration is a separate process for remitters that accountants generally don’t need.

Keep your enrolment details current within 14 days of a change, including the list of designated services you provide. By 17 September 2026, 13,780 newly regulated accounting and professional services businesses had enrolled. In August 2026 AUSTRAC began issuing notices to businesses, including accountants, that appear to provide designated services without enrolling.

The AML/CTF program and who approves it

Your program has two parts: a money laundering and terrorism financing risk assessment, and the policies, procedures and controls that manage those risks. It must be in writing, approved by a senior manager and in place before your first designated service.

AUSTRAC publishes an accountant program starter kit with a risk assessment, policies, processes and forms. It’s designed for practices with 15 or fewer personnel, admin staff included, that mostly act for Australian individuals. A larger firm can’t rely on it as it stands; AUSTRAC says larger practices are highly likely to face more complex risks and need stronger controls.

Review the risk assessment at least every three years. A significant change you control, such as offering a new designated service or taking on a new kind of client, needs a review before it happens. An independent evaluation is due at least every three years, and AUSTRAC suggests newly enrolled firms consider doing the first one earlier.

The AML/CTF compliance officer

Appoint a compliance officer within 28 days of starting to provide designated services, and tell AUSTRAC within 14 days of the appointment. Newly regulated firms had until 29 July 2026, or 14 days after enrolling if that’s later.

• They must be at management level, a fit and proper person, and an Australian resident if the firm provides its services through an Australian office.
• They don’t need to be an employee, but an external compliance officer needs the authority, resources and expertise to do the job.
• They report to the governing body at least once every 12 months. In most firms, that’s the partners or the board.

AUSTRAC’s starter kit says that in an accounting practice this will typically be the office manager. In a firm of 50, we’d suggest the practice manager as compliance officer and a partner as senior manager, so the person approving the program isn’t the person running it.

Customer due diligence and beneficial owners

Initial customer due diligence must be finished before you start the designated service. If you can’t establish the required matters on reasonable grounds, the law says you must not start. You must establish:

• who the customer is, and who is acting for them and with what authority
• anyone the customer is acting for, such as a trust’s beneficiaries or each class of them
• the customer’s beneficial owners, if the customer isn’t an individual
• whether any of these people is a politically exposed person or designated for targeted financial sanctions
• the nature and purpose of the work

For a trust, AUSTRAC lists individual trustees, the owners of a corporate trustee, settlors, appointors, guardians, protectors and anyone else with control, and in some cases beneficiaries. You needn’t keep copies of documents you check; recording their details is enough. Proof-of-identity steps that meet AUSTRAC’s requirements are generally accepted by the TPB, so our client onboarding checklist can carry one identity check for both.

Existing clients and the pre-commencement rule

A pre-commencement customer is one you were providing a designated service to on 1 July 2026, or one whose business relationship with you involved a designated service before that date. You don’t need initial due diligence on them unless a suspicious matter report obligation arises, or the relationship changes enough to make them medium or high risk.

The trap is the tax-only client. A family you’ve done returns for since 2010 has never received a designated service, so on our reading of AUSTRAC’s guidance they aren’t pre-commencement. The first restructure needs full initial due diligence, however well you know them.

Ongoing due diligence and suspicious matter reports

Ongoing due diligence means monitoring for unusual transactions and behaviour and, for continuing relationships, reviewing each customer’s risk rating and identity details at the frequency your policies set. Low-risk customers can get lighter monitoring if your policies allow it.

You must lodge a suspicious matter report through AUSTRAC Online within 3 business days after the day you form a suspicion on reasonable grounds, or within 24 hours if it concerns terrorism financing. The suspicion can concern tax evasion, or a customer who isn’t who they say they are. It applies even if you never provide the service.

Telling anyone that you’ve lodged a report, or are about to, can be the offence of tipping off: up to two years’ imprisonment, 120 penalty units or both. Keep reports and the working behind them where only the compliance officer and the people who need them can see them.

What records to keep, and for how long

Keep records of your program, your due diligence on each customer and the transactions behind each designated service, usually for seven years. They must be enough to show how you met your obligations and to reconstruct a transaction.

• Program records: the risk assessment and policies with version history, approval dates and the approving senior manager.
• Due diligence records: what you collected and verified, and how you reached each conclusion on reasonable grounds.
• Compliance officer records: the appointment, and how you assessed them as fit and proper.
• Training records: who was trained, on what and when.

Keep records in their original format. A reporting entity is covered by the Privacy Act 1988 even if it would otherwise be exempt as a small business.

A first-year plan for a firm of 5 to 100 people

If you’re reading this in late 2026, some of the start-up deadlines have passed. This is the order we’d suggest for catching up, then keeping on top of it.

1. 01

   List every service the firm has provided since 1 July 2026.

   Sort each against the nine items. Include registered office addresses you lend and any client money that passes through the firm’s accounts.

2. 02

   If anything is designated and you haven’t enrolled, enrol now.

   Then appoint the compliance officer and notify AUSTRAC. Its Contact Centre is on 1300 021 037.

3. 03

   Write the risk assessment, then the policies.

   Up to 15 people, start from the starter kit. Above that, use it as a reference and document where your risks differ, for example more company and trust clients, or several partners taking instructions.

4. 04

   Get the program approved and train the people who take instructions.

   A senior manager signs it off. Record who was trained and when, at induction and then on a schedule.

5. 05

   Put due diligence at the front of every designated job.

   We’d suggest a rule that no ASIC form, deed or sale contract goes out until the customer’s due diligence is signed off.

6. 06

   Set the recurring dates.

   The compliance officer’s yearly report, identity reviews at the frequency your policies set, and the first compliance report by 30 September 2027.

Mistakes a reviewer will look for

• Treating a long-standing tax client as known. If they’ve never had a designated service, the first one needs initial due diligence.
• Forgetting the registered office. Lending your address to a client company is item 9 even when it’s free.
• Relying on the bookkeeping exception while doing restructures. The exception only holds if the firm provides no other designated service.
• Stopping at the first company in the chain. Beneficial owners are individuals, so follow corporate shareholders and trustees until you reach people.
• Using the starter kit unchanged at 30 people. AUSTRAC says you can’t rely on it outside its criteria.
• Starting the work before due diligence is finished. Drafting the constitution and lodging the ASIC form are preparatory steps, so each one counts as starting.

Where AccountKit helps, and where it doesn’t

AccountKit doesn’t verify identity, screen names against politically exposed person or sanctions lists, or lodge anything with AUSTRAC. You’ll need an identity verification provider or your own manual process for that, and AUSTRAC Online for enrolment and reports.

It helps with the work around those checks. The client mapping tool shows a group’s ownership and control on one diagram, with client details kept in sync with Xero Practice Manager. The correspondence register keeps file notes against the client with practice-wide templates. Workflow puts recurring reviews on someone’s list with a due date, and the Knowledge Centre holds your AML procedures where those tasks link to them. The professional development register can hold training records alongside CPD.

Keep suspicious matter working papers out of shared client notes, in the restricted place your policies name.