Tranche 2 is here: what accountants must do now

Where things stand in November 2026

The AML/CTF Amendment Act 2024 extended Australia's anti money laundering and counter terrorism financing regime to a range of professional services, often called Tranche 2 ^[1][2]. For newly regulated businesses, obligations for the relevant designated services commenced on 1 July 2026 ^[2][3]. AUSTRAC announced at that date that the laws now cover thousands more businesses ^[3].

Two other dates matter. Businesses that were already providing a newly regulated designated service when the obligations commenced had until 29 July 2026 to enrol with AUSTRAC ^[3]. That date has passed, and it was not a rolling deadline for everyone. If you start providing a designated service now, check AUSTRAC's current enrolment guidance for when you need to enrol ^[2]. Separately, entities that were already regulated before the reforms became subject to updated obligations from 31 March 2026, unless a transitional deferral applies to them ^[2].

So the practical question for an accounting practice is not whether to prepare for Tranche 2. It is whether you are already providing a designated service, and if so, whether your enrolment, program and customer checks are in place.

Is your practice in scope?

Scope under the reforms is service based. AUSTRAC lists the professional designated services and explains each one ^[4]. Being a registered tax agent, a chartered accountant or a bookkeeper does not by itself bring you into the regime. What matters is whether you provide one of the listed services, in the course of carrying on a business, with the required geographical link to Australia, and whether an exemption applies ^[1][4].

AUSTRAC's professional services guidance focuses on activities such as assisting with buying or selling real estate or businesses, managing a client's money or other property, creating or restructuring companies and trusts, acting as or arranging for someone to act as a nominee or company officer, and providing a registered office or business address ^[4]. Preparing an individual tax return or a set of annual financial statements is not, by itself, one of those listed services. However, a practice that does both kinds of work needs to look at each engagement type separately.

If you are unsure, document your reasoning. A short written scope assessment, reviewed against AUSTRAC's guidance, is far more useful than a general view that accountants are or are not covered.

• List every service line your practice offers, including occasional work done by one partner.
• Compare each one to AUSTRAC's professional designated services guidance ^[4].
• Note any exemption you are relying on, and the source.
• Record who made the assessment and when, and revisit it when you add new services.

Enrolment and your AML/CTF program

If you provide a designated service, you need to be enrolled with AUSTRAC ^[3]. Enrolment is different from registration. Registration applies to certain remittance and virtual asset service providers, and most accounting practices only need to think about enrolment ^[3].

You also need an AML/CTF program. Under the reformed regime, this means assessing the money laundering and terrorism financing risks of your business, then putting in place policies, procedures, systems and controls that manage those risks, with oversight from senior management and a designated AML/CTF compliance officer ^[1][2]. AUSTRAC has published program starter kits to help smaller businesses build a program that fits their size and risk ^[5].

A program starter kit or a template is a starting point. Your program needs to reflect how your practice actually works, who your clients are and which services carry most risk. The InvestPass templates are not AUSTRAC approved and are not a compliant program by themselves. Adapt them to your business and seek advice where needed.

Customer due diligence before you provide the service

Initial customer due diligence is generally completed before you provide a designated service, with limited exceptions and specific rules for delayed customer due diligence and for existing customers ^[6]. In plain terms, you need to establish who the customer is, who ultimately owns or controls them, who is acting for them and whether they have authority, whether the service is being received on behalf of someone else, and the nature and purpose of the relationship ^[6].

You also check whether any of those people are politically exposed persons or subject to targeted financial sanctions, and you assess the customer's money laundering and terrorism financing risk ^[6][7]. You verify the key information using reliable and independent sources suited to that risk ^[6]. A beneficial owner is an individual who ultimately owns 25% or more of the customer, or who otherwise controls it ^[1].

Enhanced customer due diligence is required in some situations, for example for foreign politically exposed persons and for customers assessed as high risk ^[8]. In prescribed politically exposed person cases, AUSTRAC guidance requires senior manager approval and steps to establish source of funds and source of wealth ^[7]. Those are legal requirements in the specified cases, not optional extras.

What to do this month

If you have not started, the order below keeps the work manageable. It does not replace AUSTRAC's guidance or legal advice for your circumstances.

• Complete and record your service by service scope assessment.
• If you provide a designated service, confirm your enrolment position with AUSTRAC's current guidance ^[2].
• Appoint an AML/CTF compliance officer and confirm senior management oversight.
• Complete a business risk assessment and draft your program, using AUSTRAC's starter kits ^[5].
• Set up a customer due diligence process and checklist that covers every relevant person, not just the client in front of you ^[6].
• Train staff who deal with in scope clients, and keep a training log.
• Decide how you will keep records. Customer due diligence records are generally kept for 7 years after the business relationship ends or after the last occasional transaction, and other record types can have different triggers ^[1].

Where identity checks fit

Digital identity verification can make one part of customer due diligence faster and more consistent. It does not decide whether you are in scope, write your program, assess beneficial ownership on its own, or replace your judgement about risk. Treat any identity check, including InvestPass Verify, as one input into your process rather than the process itself.

InvestPass is not endorsed by AUSTRAC. This article is general information, not legal advice. If your position is unclear, get advice from a lawyer or adviser with AML/CTF experience.