You Cannot Provide Designated Services Without a Program
From 1 July 2026, it is unlawful to provide designated services without a compliant AML/CTF program. This is not simply about "breaching the Act" or risking penalties. You are prohibited from providing the service at all until you have a compliant program in place.
The 28-Day Enrolment Rule
New reporting entities have 28 days from when they first provide a designated service to enrol with AUSTRAC. But you must have a compliant AML/CTF program in place before you start providing designated services. The 28 days is for enrolment only, not for getting your program ready.
Financial Penalties
The AML/CTF Act provides for significant civil penalties for non-compliance:
Penalty Framework
-
Failure to have an AML/CTF program
Significant civil penalties per breach for corporations (amounts are indexed to penalty units and change periodically)
-
Failure to comply with program requirements
Varies by specific requirement breached
-
Failure to enrol
Additional penalties for failing to register with AUSTRAC
Note: Penalties are calculated per contravention. Multiple breaches can compound quickly.
Enforcement Actions
Beyond financial penalties, AUSTRAC has a range of enforcement tools:
- Infringement notices - for less serious breaches
- Enforceable undertakings - requiring specific remediation actions
- Civil penalty proceedings - through the Federal Court
- Remedial directions - requiring you to take specified actions
- Injunctions - preventing you from conducting certain activities
Professional and Business Consequences
Non-compliance can trigger consequences beyond AUSTRAC enforcement:
Professional Risks
- Professional licensing: Regulators like law societies and accounting bodies may take action
- Insurance coverage: Non-compliance may void professional indemnity coverage
- Client relationships: Sophisticated clients may require compliance evidence
- Referral networks: Other professionals may avoid referring to non-compliant businesses
- Reputation: Enforcement action is public and can damage business reputation
- Due diligence: Potential acquirers or partners will identify non-compliance
What AUSTRAC Looks For
AUSTRAC's compliance approach focuses on:
- Whether you have a documented AML/CTF program
- Whether the program is appropriate for your designated services
- Whether you're actually following the program
- Whether you're meeting reporting obligations
- Record keeping compliance
Common Misconceptions
"It's just a fine if I get caught"
Wrong. Without a compliant program, you are not permitted to provide the designated service. This isn't about penalties. It's about whether you can lawfully operate at all.
"Small businesses won't be targeted"
AUSTRAC takes a risk-based approach to enforcement, but has demonstrated it will take action across business sizes. The introduction of Tranche 2 will likely see a period of heightened compliance activity.
"I'll just deal with it if they contact me"
By then you've already been operating unlawfully. Remediation after a compliance notice is more expensive and stressful than preparing in advance. You may also face penalties for the entire period of non-compliance.
"I can claim I didn't know"
Ignorance of the law is not a defence. AUSTRAC has conducted extensive consultation and publicity about Tranche 2. Reporting entities are expected to be aware of their obligations.
What You Should Do
If you're a Tranche 2 entity:
- Develop or obtain an AML/CTF program appropriate to your services now
- Complete your risk assessment
- Implement customer due diligence procedures
- Train yourself and staff on minimum training requirements
- Enrol with AUSTRAC when enrolment opens (31 March 2026)
- Be ready to operate compliantly from 1 July 2026