Australia’s Tranche 2 anti-money laundering reforms are now in effect. From 1 July 2026, businesses providing certain designated services in real estate, legal, accounting, trust and company services, and precious metals or stones must comply with Australia’s expanded Anti-Money Laundering and Counter-Terrorism Financing framework.
This guide explains what Tranche 2 AML means, which businesses may be regulated, what must be done, and how StartKYC can support customer screening, PEP checks, sanctions screening, adverse media searches and ongoing monitoring.
Important: This article provides general information and is not legal advice. Whether your business is regulated depends on the specific services it provides and their connection to Australia. Use AUSTRAC’s official guidance and obtain professional advice where necessary.
What is Tranche 2 AML in Australia?
“Tranche 2” is the commonly used name for the extension of Australia’s AML/CTF regime to certain professional and commercial sectors that were not previously covered in the same way as banks, remittance providers, casinos and other traditional reporting entities.
The reforms are intended to reduce the risk that criminals use professional advisers, property transactions, companies, trusts, precious metals or other structures to launder money, finance terrorism or conceal the proceeds of crime.
The new obligations apply from 1 July 2026 to businesses that provide one or more regulated designated services. The professional title alone is not decisive: an accountant, lawyer or real estate professional is regulated only where the activities performed fall within the statutory definitions.
Who is covered by Australia’s Tranche 2 AML rules?
The reforms potentially cover businesses operating in the following sectors:
- Real estate: real estate agents, buyer’s agents and certain property developers.
- Legal services: lawyers, solicitors, conveyancers and other legal-service providers when carrying out designated activities.
- Accounting and professional services: accountants and advisers involved in specified transactions or structures.
- Trust and company services: businesses establishing, restructuring, managing or providing services to companies, trusts and other legal arrangements.
- Precious metals and stones: dealers providing regulated services involving precious metals, precious stones or qualifying products.
A business may be within scope where it assists with activities such as:
- buying, selling or transferring real estate;
- buying, selling or transferring a company or legal arrangement;
- creating or restructuring a company, trust or similar arrangement;
- receiving, holding, controlling or managing client property in connection with a transaction;
- arranging equity or debt financing for a company or legal arrangement;
- selling or transferring shelf companies;
- providing registered-office or principal-place-of-business services;
- acting, or arranging for another person to act, in specified company or trust roles.
AUSTRAC provides a dedicated tool and sector guidance to help businesses determine whether their services are regulated. Businesses should assess each service they offer rather than assuming that their entire profession is automatically covered.
What are the key Tranche 2 AML deadlines?
- 31 March 2026: enrolment opened for newly regulated businesses.
- 1 July 2026: AML/CTF obligations commenced for Tranche 2 entities.
- Generally within 28 days of first providing a designated service: a newly regulated business must enrol with AUSTRAC. For businesses already providing a newly regulated service on 1 July 2026, AUSTRAC indicated a typical enrolment deadline of 29 July 2026.
Businesses should verify the deadline that applies to their circumstances directly with AUSTRAC, particularly where they started providing a designated service after 1 July 2026.
What must a Tranche 2 business do?
A regulated business must establish a risk-based AML/CTF compliance framework. The precise controls should reflect the nature, size and complexity of the business and the money-laundering, terrorism-financing and proliferation-financing risks it faces.
1. Confirm whether your services are designated services
Map every service your business provides and identify which services fall within the AML/CTF Act. Record the reasoning behind your assessment, including any applicable exclusions or exemptions.
This should not be treated as a one-time exercise. Review the assessment when the business launches a new service, enters a new market or changes how it handles client funds, property, companies or trusts.
2. Enrol with AUSTRAC
If your business provides a newly regulated designated service, it must enrol through AUSTRAC Online within the applicable deadline. Enrolment information must subsequently be kept accurate and updated when relevant details change.
3. Appoint an AML/CTF compliance officer
The business must appoint an appropriate person to oversee AML/CTF compliance. The compliance officer should have sufficient authority, knowledge and access to senior management to perform the role effectively.
Responsibility cannot be reduced to a purely administrative appointment. The officer should oversee the risk assessment, policies, customer due diligence, reporting, training, record keeping and remediation of compliance weaknesses.
4. Conduct an ML/TF risk assessment
Your risk assessment should consider how criminals could misuse your business. Relevant factors may include:
- the types of customers you serve;
- countries and geographic areas involved;
- the products and designated services you provide;
- how services are delivered, including remote or non-face-to-face onboarding;
- the size, complexity and purpose of transactions;
- the use of companies, trusts, nominees or intermediaries;
- cash, virtual assets, offshore payments or unexplained third-party funding;
- politically exposed persons and sanctions exposure;
- adverse media or law-enforcement information associated with a customer.
5. Develop and maintain an AML/CTF program
The AML/CTF program should translate the risk assessment into practical policies, procedures, systems and controls. It should explain:
- how customers are risk-rated;
- what identification and verification information is required;
- how beneficial owners and persons acting on behalf of customers are identified;
- when PEP, sanctions and adverse media screening is performed;
- when enhanced customer due diligence is required;
- how ongoing customer due diligence and monitoring are conducted;
- how unusual activity is escalated and investigated;
- who decides whether a suspicious matter report should be filed;
- how staff are trained;
- how records are retained;
- how the program is independently evaluated.
6. Perform customer due diligence before providing a designated service
Before beginning a regulated service, the business must understand who the customer is and take reasonable steps to verify the customer’s identity.
Depending on the customer and risk level, this may include:
- identifying and verifying an individual customer;
- verifying a company, partnership, trust or other legal arrangement;
- identifying beneficial owners and controllers;
- identifying people acting on behalf of the customer;
- understanding the nature and purpose of the relationship;
- understanding the source of funds or source of wealth where risk requires it;
- checking whether relevant persons are PEPs, sanctioned or associated with material adverse information.
7. Screen customers and beneficial owners
Screening is a central component of a defensible AML process. A business should determine, according to its risk assessment and policies, which customers, beneficial owners, directors, trustees, settlors, beneficiaries, representatives or connected parties must be screened.
A comprehensive screening process may include:
- Politically exposed person screening: identifying domestic, foreign and international-organisation PEPs, as well as relevant family members and close associates.
- Sanctions screening: checking names against applicable national and international sanctions data.
- Adverse media screening: identifying credible negative information connected with financial crime, fraud, corruption, organised crime, terrorism or other relevant risk.
- Law-enforcement and regulatory screening: identifying enforcement, wanted-person, disqualification or regulatory information where available and relevant.
StartKYC’s AML screening solutions allow businesses to screen individuals and organisations against PEP, sanctions, adverse media and other relevant compliance datasets.
8. Apply enhanced customer due diligence when risk is higher
A simple identity check may not be sufficient for a high-risk relationship. Enhanced measures may be appropriate where, for example:
- the customer or beneficial owner is a PEP;
- the customer is connected with a high-risk jurisdiction;
- the ownership structure is unnecessarily complex or opaque;
- funds are provided by an unexplained third party;
- the transaction has no clear economic or lawful purpose;
- the customer is reluctant to provide ownership or source-of-funds information;
- screening identifies sanctions, law-enforcement or serious adverse-media concerns.
Enhanced due diligence may involve obtaining additional documentation, establishing source of wealth and source of funds, securing senior-management approval, increasing review frequency or declining the relationship.
9. Conduct ongoing customer due diligence
AML compliance does not end after onboarding. A customer’s risk profile can change after the first check: a person may become a PEP, a company may acquire a sanctioned beneficial owner, or new adverse media may emerge.
Businesses should keep customer information current and re-screen relevant persons at a frequency proportionate to risk. Higher-risk relationships generally require more frequent review.
StartKYC supports ongoing monitoring, enabling customers or organisations to be screened automatically and generating alerts when potential new matches are identified. Screening activity is retained in the platform history, helping businesses maintain an audit trail.
10. Report suspicious matters and other reportable activity
Where the legal test is met, reporting entities must submit suspicious matter reports to AUSTRAC. Internal escalation procedures should ensure that unusual facts are reviewed promptly and confidentially by appropriately authorised personnel.
Depending on the services provided, other reporting obligations may also apply. Screening software can help identify risk indicators, but the reporting entity remains responsible for investigating the circumstances and deciding whether a statutory report is required.
11. Keep records and evidence your decisions
A strong AML process must be demonstrable. Businesses should retain the customer information, verification evidence, screening results, risk assessments, investigation notes, approvals, monitoring alerts and reporting records required by law and their AML/CTF program.
It is also important to document false-positive decisions. Where a possible PEP or sanctions match is dismissed, the file should explain why the business concluded that the record did not relate to its customer.
12. Train staff and independently evaluate the program
Employees involved in onboarding, client management, transactions or compliance should understand the risks relevant to their role. Training should cover escalation procedures, confidentiality, red flags and the practical use of compliance systems.
The AML/CTF program must also be independently evaluated according to the applicable rules and the timetable set out in the business’s program.
Australia Tranche 2 AML compliance checklist
- List all services provided by the business.
- Determine which services are designated services.
- Confirm the relevant geographic connection to Australia.
- Enrol with AUSTRAC within the applicable deadline.
- Appoint and notify the AML/CTF compliance officer.
- Complete a documented ML/TF risk assessment.
- Adopt an AML/CTF program tailored to the business.
- Define customer identification and verification procedures.
- Identify beneficial owners, controllers and representatives.
- Implement PEP, sanctions and adverse media screening.
- Define enhanced due diligence triggers.
- Implement ongoing customer due diligence and monitoring.
- Establish suspicious-matter escalation and reporting procedures.
- Train relevant employees.
- Retain records and maintain a clear audit trail.
- Arrange independent evaluation of the AML/CTF program.
How can StartKYC help with Tranche 2 AML compliance?
StartKYC provides a practical screening solution for Australian law firms, conveyancers, accountants, real estate professionals, trust and company service providers, and dealers that need to introduce AML screening without committing to a costly enterprise platform.
The service can support the screening element of an AML/CTF program in several ways.
Immediate PEP, sanctions and adverse media checks
Users can search an individual or organisation and review potential PEP, sanctions, adverse media, law-enforcement and regulatory matches. A single check can be performed through the instant AML search tool, while registered users can purchase lower-cost packages for repeated screening.
Pay-as-you-go pricing with no monthly fee
Many newly regulated businesses do not need thousands of checks every month. StartKYC’s pay-as-you-go AML screening packages allow firms to purchase the checks they need without setup fees, long-term commitments or mandatory monthly subscriptions.
This can be particularly useful for small and medium-sized legal practices, accounting firms, conveyancers, real estate agencies and company-service providers whose onboarding volumes fluctuate.
Screen individuals and organisations
Tranche 2 due diligence may require checks on more than the contracting customer. Depending on the structure and risk, a firm may need to screen companies, directors, shareholders, beneficial owners, trustees, settlors, beneficiaries, authorised representatives and other connected persons.
StartKYC supports screening of both natural persons and legal entities, helping compliance teams build a more complete view of the relationship.
Ongoing monitoring and alerts
A one-off check only shows information available at that point in time. StartKYC monitoring can repeat screening and alert users to potential new matches, supporting ongoing customer due diligence and risk-based periodic review.
Audit trail and screening history
Screening records and monitoring activity are retained in the platform history. This helps the reporting entity demonstrate when a check was conducted, what information was considered and how potential matches were handled.
CSV upload and API integration
Businesses with larger customer populations can use bulk processing or discuss an API integration to automate checks within an onboarding or case-management workflow. More information is available through the StartKYC solutions page.
Multi-user access
Where several employees need to conduct or review checks, StartKYC can support a shared organisational workflow rather than leaving screening results in individual email accounts or unstructured files.
How to use StartKYC for an Australian Tranche 2 customer
- Identify the parties to be screened. Begin with the customer and add relevant beneficial owners, directors, trustees, representatives or other connected persons required by your AML/CTF program.
- Collect accurate identifiers. Obtain the person’s full name, date or year of birth, nationality and country of residence where available. For organisations, obtain the correct legal name, registration details, jurisdiction and ownership information.
- Run the screening search. Use the instant search for an individual check or create an account to access packages, monitoring and account features.
- Review potential matches. Do not treat every name match as confirmation. Compare identifiers such as date of birth, nationality, location, occupation, company connections and other profile details.
- Document the decision. Record why a match was confirmed, excluded or escalated. Where risk is material, obtain further evidence and follow the enhanced due diligence procedure in your AML/CTF program.
- Activate monitoring where appropriate. Use ongoing monitoring for relationships that continue after onboarding, particularly where the risk profile warrants periodic or continuous re-screening.
- Retain the result. Keep the screening output, review notes and supporting documentation in accordance with your AML/CTF record-keeping obligations.
Does StartKYC make a business fully Tranche 2 compliant?
No screening provider can, by itself, make a business fully compliant. StartKYC supports an important operational component of customer due diligence, but the reporting entity remains responsible for:
- determining whether it is regulated;
- enrolling with AUSTRAC;
- conducting its own risk assessment;
- adopting and maintaining its AML/CTF program;
- verifying identity and beneficial ownership;
- reviewing and resolving screening matches;
- conducting enhanced due diligence;
- monitoring transactions and customer behaviour;
- submitting required reports;
- training staff, retaining records and independently evaluating the program.
StartKYC should therefore be used as part of a broader risk-based compliance framework.
Frequently asked questions about Tranche 2 AML in Australia
When did Tranche 2 AML start in Australia?
The substantive AML/CTF obligations for newly regulated Tranche 2 entities started on 1 July 2026. Enrolment opened on 31 March 2026.
Do all Australian lawyers and accountants have AML obligations?
No. Coverage depends on whether the business provides a designated service with the required connection to Australia. A professional title alone does not determine whether the AML/CTF Act applies.
Are Australian real estate agents covered by Tranche 2?
Real estate agents, buyer’s agents and certain property developers may be covered when they provide designated real-estate services. Each business should assess its specific activities using AUSTRAC guidance.
What is a designated service?
A designated service is a service listed in the AML/CTF legislation. For Tranche 2 businesses, it can include specified real-estate transactions, company and trust formation or restructuring, handling client property in connection with transactions, registered-office services and other regulated professional activities.
What customer checks are required under Tranche 2?
A reporting entity must apply customer due diligence appropriate to the customer and risk. This can include identifying and verifying the customer, identifying beneficial owners and representatives, understanding the purpose of the relationship, and applying PEP, sanctions and adverse media screening where required by the business’s risk-based controls.
Is PEP and sanctions screening mandatory?
Reporting entities need controls capable of identifying and managing relevant PEP and sanctions risks. The exact screening process, parties screened and review frequency should be defined within the business’s risk assessment and AML/CTF program.
How often should customers be re-screened?
There is no single frequency suitable for every customer. Re-screening should be risk-based. Higher-risk customers may require more frequent review, while monitoring can help identify changes between scheduled reviews.
Can a small firm use pay-as-you-go AML screening?
Yes. A pay-as-you-go platform can be suitable where screening volumes are low or variable, provided the service meets the firm’s documented risk and compliance requirements. StartKYC offers screening packages without mandatory monthly fees.
Can StartKYC screen beneficial owners?
Yes. Once a business has identified the relevant beneficial owners, it can use StartKYC to screen those individuals and, where appropriate, associated organisations against relevant compliance datasets.
Can StartKYC replace identity verification?
No. AML screening and identity verification are related but distinct controls. Screening checks whether a person or organisation may appear in risk-related data; identity verification establishes that the customer is who they claim to be. A complete customer due diligence process may require both.
What should I do when StartKYC identifies a potential match?
Compare the result with reliable customer identifiers and determine whether it relates to the same person or organisation. Escalate credible matches under your internal procedure, conduct enhanced due diligence where required, document the decision and consider whether a report to AUSTRAC is legally required.
Start preparing your Tranche 2 screening process
Australian Tranche 2 entities need a practical process for screening customers, beneficial owners and connected parties without creating unnecessary cost or administrative friction.
With StartKYC, businesses can perform immediate PEP, sanctions and adverse media checks, monitor relevant customers, retain a screening history and scale through packages, CSV processing or API integration.
Start with an immediate check: use the StartKYC AML search tool.
Need multiple checks or ongoing monitoring? Review the pay-as-you-go packages or create a StartKYC account.
Official Australian resources