Depuis le 1er juillet 2026, avocats, comptables et immobilier doivent s’inscrire, évaluer les risques et documenter leur programme.
Most newly regulated firms do not fail AML on intent. They fail on sequence and evidence: services provided before enrolment, a programme written after the work, checks done but never recorded.
What did Tranche 2 change, and who is now regulated?
Australia’s AML/CTF reforms extend the regime beyond the financial sector to higher-risk designated services provided by real estate professionals, lawyers, accountants, and other professional service providers — the long-debated “Tranche 2” population. The reforms were expected to bring roughly 90,000 new reporting entities into scope. Enrolment with AUSTRAC opened ahead of commencement, changes for existing reporting entities took effect from 31 March 2026, and AML/CTF obligations for Tranche 2 entities commenced on 1 July 2026. For a professional firm, the scoping question is service-based: which of the services it actually provides are designated services, and from when?
Enrolment is a deadline, not an administrative afterthought
Newly regulated businesses were required to enrol within the prescribed window after first providing a designated service. AUSTRAC has since moved from reminders to enforcement, issuing information-gathering notices and then infringement notices to businesses it identified as providing designated services without enrolling. The lesson for late starters is that the regulator is testing the simplest obligation first — and it is the one with the clearest paper trail.
What does a first AML/CTF programme actually require?
The programme is the documented system that connects the firm’s money-laundering and terrorism-financing risk assessment to the controls it operates: customer due diligence before designated services are provided and on an ongoing basis, an AML/CTF compliance officer, staff training, reporting of suspicious matters and certain transactions, and record-keeping. The redesigned CDD obligations are risk-based, which gives firms proportionality — and removes the excuse that a generic template fits. A programme that does not reflect the firm’s own clients, services, delivery channels, and geographies is evidence against itself.
- A documented, firm-specific ML/TF risk assessment that the programme visibly answers.
- Initial CDD before providing a designated service, plus ongoing due diligence through the relationship.
- Beneficial-ownership identification for companies and trusts, not just the individual giving instructions.
- A named AML/CTF compliance officer and trained staff who know their escalation path.
- Suspicious-matter and threshold reporting processes that work before the first reportable event occurs.
- Records retained and retrievable for the required periods, per client and per decision.
Where do first programmes usually break?
The weak points are predictable because they sit at handoffs. Client intake captures identity documents but not beneficial owners. A risk rating is assigned but the reasoning is not recorded, so a later reviewer cannot tell a considered judgement from a default. Screening is performed at onboarding and never refreshed when ownership, services, or risk change. Matter files hold the work product while the CDD evidence lives in email. None of these are exotic failures; they are what happens when obligation-level requirements are implemented as disconnected tasks rather than one client record.
“We checked” is not a record
Supervision tests artefacts: the enrolment confirmation, the approved risk assessment, the CDD file with source documents, the screening result with its disposition, the training log. Where a check happened but left no artefact, the firm carries the burden of reconstructing it months later, usually less convincingly. Designing the artefact at the same time as the check is the cheapest control a new reporting entity can buy.
In what order should a newly regulated firm build?
Sequence matters because each layer is evidence for the next. A practical build order for a firm still standing up its programme:
- Enrol and scope: Confirm which services are designated services, enrol with AUSTRAC if not already done, and record the scoping decision and its date.
- Assess risk on paper: Write the ML/TF risk assessment for the firm’s actual client base and services before drafting procedures it must justify.
- Adopt the programme and owner: Approve the AML/CTF programme at the appropriate level, appoint the compliance officer, and train the staff who touch intake and matters.
- Run CDD as one record: Operate intake, beneficial-ownership identification, screening, and risk rating as a single client file with named reviewers and retrievable evidence.
How does this compare with what EU and UK firms already run?
Firms with EU or UK exposure will recognise the architecture: risk-based CDD, beneficial-ownership identification, ongoing monitoring, and record-keeping, soon to be tightened further in the EU under the single rulebook. The Australian difference is the starting point. Many Tranche 2 firms are building their first programme while already serving the clients it must cover, under a supervisor that has demonstrated it will enforce the threshold obligations. That argues for boring, well-evidenced fundamentals over sophistication: complete enrolment, an honest risk assessment, CDD files that a stranger could follow, and decision records that survive staff changes.
What will a supervisor ask a new reporting entity for first?
Expect the first requests to be the simplest to answer well and the hardest to improvise: proof and date of enrolment, the approved ML/TF risk assessment, the adopted programme, the identity of the compliance officer, training records, and a sample of client files showing initial CDD completed before the designated service was provided. Each item tests a different layer — status, judgement, system, ownership, competence, and execution. A firm that can produce that set in one pass, with dates that line up in the right order, has demonstrated the programme exists as an operating system rather than a policy folder. A firm that assembles it under deadline pressure usually reveals the gaps it was trying to hide: risk assessments written after procedures, CDD evidence dated after the matter opened, screening results without a recorded disposition. Building the supervisor’s pack is therefore a useful self-test long before any notice arrives. If the pack cannot be produced from the ordinary client record, the record — not the pack — is the thing to fix.
Practical takeaways
- Tranche 2 extends the AML/CTF regime to designated services from lawyers, accountants, real estate, and other professionals; obligations commenced 1 July 2026.
- Enrolment with AUSTRAC is the first gate — enforcement for non-enrolment has already begun.
- A defensible first programme is a chain of records: risk assessment, programme, compliance officer, CDD, reporting, and retention.
Conclusion
Tranche 2 asks professional firms to run, for the first time, controls that banks have operated for years — but the standard AUSTRAC will test is recognisably the same: can the firm show, from its own records, that it understood its risk, designed controls proportionate to it, and actually applied them to real clients? Firms that build the evidence chain as they go — enrolment, assessment, programme, CDD file, decision record — will find supervision a document-production exercise. Firms that treat the programme as a template to be back-filled will discover that an unrecorded check and an undone check look identical to a regulator.
Explore related KYCONSOLE capabilities
Sources
- Norton Rose Fulbright — Tranche 2 and AML/CTF Reforms Hub (Australia)
- AUSTRAC — AUSTRAC begins issuing infringement notices to non-enrolled businesses
See how KYCONSOLE supports evidence-led KYC, screening, and compliance records for professional firms. Explore capabilities