AUSTRAC transaction monitoring enforcement has a long and expensive record. The Commonwealth Bank paid A$700 million in 2018, Westpac was ordered to pay A$1.3 billion in 2020, and the Federal Court ordered Crown to pay A$450 million in 2023. With Tranche 2 now bringing lawyers, accountants, real estate agents and other professions under the AML/CTF regime, newly regulated businesses are entering a regime whose regulator has shown it will litigate.
This article sets out what AUSTRAC's published actions say about transaction monitoring failures, and what those patterns mean for businesses building a monitoring programme for the first time.
What the record shows
AUSTRAC's own enforcement register lists the main civil penalty outcomes. The Federal Court ordered the Commonwealth Bank to pay A$700 million on 20 June 2018, after AUSTRAC alleged more than 53,000 failures to report threshold cash deposits. On 21 October 2020 the Court ordered Westpac to pay A$1.3 billion after Westpac admitted more than 23 million contraventions, including failing to report over 19.5 million international funds transfer instructions worth more than A$11 billion. AUSTRAC's chief executive said at the time that Westpac's failure to implement effective transaction monitoring programs had left AUSTRAC and law enforcement without critical intelligence.
Earlier and later actions cover gambling and entertainment. Tabcorp was ordered to pay A$45 million in 2017, the Federal Court ordered Crown to pay A$450 million in 2023, and in June 2024 the Court ordered SkyCity Adelaide to pay A$67 million, plus A$3 million towards AUSTRAC's costs, after AUSTRAC applied for orders in December 2022. Across these five concluded actions the penalties total roughly A$2.5 billion. AUSTRAC applied for orders against Entain in December 2024, with a hearing reported as scheduled for November 2026, and began proceedings against Mount Pritchard and District Community Club (Mounties) in July 2025, alleging weaknesses in ongoing customer due diligence including its transaction monitoring program. Neither matter had concluded in the sources reviewed.
The failure patterns that recur
Reading across the actions, the same weaknesses recur. Monitoring was not designed around the entity's actual risks, so scenarios missed the behaviours that mattered. Systems were not adequately tested or maintained, so known gaps persisted. Alerts were not reviewed, escalated or documented consistently, so suspicious matters were reported late or not at all. And governance was thin: boards and senior management did not receive, or did not act on, information showing the programme was failing.
These are programme failures, not just technology failures. A well-configured system with unreviewed alerts fails the same way as a poorly configured one, which matters for smaller entities that may buy a tool and assume the problem is solved.
Why Tranche 2 entities should pay attention
Clubs and pubs have already seen how quickly AUSTRAC's concerns reach beyond major banks, and the Mounties case turned on a smaller venue's monitoring program. Newly regulated professions face the same statutory requirements for a risk-based AML/CTF programme, ongoing customer due diligence and reporting, even if their scale and products differ. Real estate and professional services were identified as higher-risk in Australia's national risk assessments precisely because transactions can be large and infrequent, which makes monitoring design harder, not easier.
Entities should also expect AUSTRAC to look at programme operation, not just existence. That is consistent with the direction of regulators elsewhere, including the move toward effectiveness-based supervision in the United States.
A self-assessment drawn from the cases
Five questions turn the enforcement record into a practical test. Does the monitoring programme describe the entity's own customer, service and channel risks, or a generic template? Is there evidence that scenarios and thresholds have been tested and revisited? Can the entity show who reviewed each alert, when, and why it was closed or escalated? Do suspicious matter reports and threshold reports meet their deadlines with complete information? And does senior management receive regular information on monitoring performance, including backlogs and overdue reviews?
An honest no to any of these is a design task for the first year of obligations. AUSTRAC's guidance and the AML/CTF Rules remain the authority on what is required, and entities should take specialist advice on their own circumstances. Taken together, AUSTRAC transaction monitoring enforcement shows that the regulator judges how programmes operate, not merely whether they exist.
