AML/CTF Tranche 2: Onboarding Real Estate, Legal and Accounting Firms by 1 July 2026

For real estate, legal and accounting firms newly captured by Australia’s AML/CTF regime, 1 July 2026 was never a finish line. It was the day the operating obligation switched on, and for most of these businesses the system that has to satisfy it did not yet exist.

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 passed Parliament on 29 November 2024. It extends the regime that has governed banks, remitters and casinos since 2006 to a second tranche of professions: real estate agents, conveyancers, lawyers, accountants, trust and company service providers, and dealers in precious metals and stones. AUSTRAC’s own estimates put the number of newly captured businesses at around 90,000. Enrolment opened on 31 March 2026, and the substantive obligations commenced on 1 July 2026. That date is now behind us. What is not behind most of these firms is the build.

What actually switched on

The obligations that now apply to a Tranche 2 entity are not a code of conduct. They are a set of things the business must be able to do, repeatedly, and evidence on demand:

• Enrol with AUSTRAC and appoint a suitable AML/CTF compliance officer.
• Complete an enterprise-wide money laundering and terrorism financing risk assessment, and keep it current.
• Maintain an AML/CTF programme that meets the reformed requirements.
• Perform customer due diligence before providing a designated service, and ongoing due diligence thereafter.
• Monitor transactions and behaviour for the indicators the risk assessment identified.
• Lodge suspicious matter reports and threshold transaction reports within statutory deadlines, and keep records for seven years.

Read that list as an engineer rather than a lawyer and the shape of the problem is obvious. Every item is a workflow with a record at the end of it. “Perform customer due diligence” is a pipeline that collects identity evidence, verifies it, screens against sanctions and politically-exposed-person lists, scores risk, and stores the result against a customer file. “Lodge a suspicious matter report” is a capture form, an approval step and a clock. None of this is satisfied by a policy document sitting in a shared drive.

This is a customer-onboarding and case-management build

The firms that adapted best to the existing regime treated it as an operational-capability problem, not a legal one. That is the lesson worth carrying across. A conveyancing practice does not become compliant by writing that it will conduct CDD; it becomes compliant when a new matter cannot progress to settlement without the CDD record existing, complete and dated, on the file. The obligation has to be wired into how work actually moves through the business.

That makes this an onboarding build first and a reporting build second. Where the real exposure sits is almost always at intake, because that is where the customer relationship is established and where the risk is either captured or lost. It is the same lesson the gaming sector learned about where the real onboarding risk actually sits: the control that matters is the one at the point of entry, not the report generated after the fact. Get intake right and monitoring has clean data to work with. Get it wrong and every downstream report inherits the gap.

Existing reporting entities faced their own reformed programme uplift landing on 31 March 2026, and the two efforts share most of their plumbing. If you are standing up from nothing, the work the incumbents had to do to refresh their programmes is a fair map of the components you now need to own outright.

The record is the deliverable

Two statutory clocks decide whether your reporting capability is real. A suspicious matter report must be lodged within three business days of forming the suspicion, and within 24 hours where the suspicion relates to terrorism financing. A threshold transaction report, triggered by a cash transaction of A$10,000 or more, must be lodged within ten business days. A system that cannot capture a suspicion, route it for approval and produce a lodgeable record inside those windows is not a system a supervisor will accept.

The way to avoid building the wrong thing is to design the record you have to produce first, then build the workflow backwards from it. Here is a minimal, technology-neutral schema for the two artefacts that matter — the CDD outcome and the suspicious matter report — written so the obligation, not the tooling, drives the design.

{
  "cdd_record": {
    "customer_id": "uuid",
    "designated_service": "real_estate_agency | conveyancing | legal | accounting",
    "cdd_level": "standard | enhanced",
    "risk_rating": "low | medium | high",
    "identity_verified": true,
    "verification_method": "document | electronic | reliance",
    "beneficial_owners": [{ "name": "str", "verified": true }],
    "pep_screen": { "hit": false, "list_version": "YYYY-MM-DD" },
    "sanctions_screen": { "hit": false, "list_version": "YYYY-MM-DD" },
    "completed_at": "ISO-8601",
    "approved_by": "compliance_officer_id",
    "next_review_due": "ISO-8601"
  },

  "smr_record": {
    "smr_id": "uuid",
    "linked_customer_id": "uuid",
    "suspicion_type": "ml | tf | proceeds_of_crime",
    "suspicion_formed_at": "ISO-8601",
    "lodgement_due_at": "ISO-8601",
    "grounds": "free_text",
    "internal_approved_by": "compliance_officer_id",
    "lodged_at": "ISO-8601 | null",
    "austrac_reference": "str | null",
    "tipping_off_controls_applied": true
  }
}

The two fields firms most often forget are lodgement_due_at, which turns the statutory clock into something the system can alert on, and tipping_off_controls_applied, because disclosing that a report has been made is itself an offence. If your intended platform cannot represent these fields cleanly, it is the wrong platform.

Where the late starters are exposed

A three-year transitional arrangement softens some initial CDD obligations, but it does not soften ongoing due diligence, monitoring or reporting, and it does not push back the commencement date. The firms most at risk now are not the ones that missed the date entirely — those are visible and will be dealt with. They are the ones that enrolled, appointed an officer, adopted a template programme, and declared themselves done, while the actual onboarding and case-management system is still a spreadsheet and a folder of scanned licences.

That gap between the paper programme and the operating capability is a governance debt, and it accrues quietly. It is the same pattern I have described elsewhere as the governance debt that becomes a 2026 constraint: an obligation that is documented but not built, carried on the books at zero until a supervisor, an audit or an actual suspicious matter forces it to be paid at full price. The difference here is that the creditor is a regulator with civil-penalty powers and a public enforcement posture.

If you are a newly captured firm reading this after commencement, the honest question is not whether you have a programme. It is whether a new customer can complete onboarding today without the CDD record existing, and whether a suspicion formed this morning would produce a lodgeable report inside three days. If the answer to either is no, the date has passed but the build has not started.