A section 167 notice is AUSTRAC's statutory information-gathering power, not a finding of breach and not a routine reminder. It compels information or documents so the regulator can test whether a business has been providing a designated service without enrolling. Receiving one starts two pieces of work at once: an accurate statutory response, and an honest scope review.
What is a section 167 notice, and what is it not?
On 28 August 2026 AUSTRAC said it had begun issuing section 167 notices to businesses that appeared to be providing designated services without being enrolled, naming real estate, accounting, legal services and jewellery among the sectors receiving them.
Section 167 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 lets an authorised officer require information or documents where the officer reasonably believes a person has material relevant to compliance with, or enforcement of, an offence or civil penalty provision. In the Tranche 2 context that means testing whether a designated service was provided and whether an enrolment obligation arose.
The distinction that matters for a governance team is that the notice proves nothing on its own. It is a step in gathering evidence. The business still has to establish its own position from its own records, and it has to do that quickly enough to answer within the period the notice sets.
What can the notice require you to produce?
A written notice can require a person to give specified information, to produce documents, or to make and produce copies of documents, within the period and in the manner stated. It must also set out the consequences of not complying, and the provisions dealing with false or misleading information and documents.
That wording is broad, and in practice it reaches ordinary commercial records rather than anything exotic. The response should therefore trigger controlled evidence preservation rather than an improvised search across inboxes and file shares, because an incomplete first answer is harder to correct than a slower, accurate one.
Two practical points follow. The period stated in the notice is the period you have, so the first decision is whether it is achievable and, if it is not, who raises that and when. And the notice defines its own scope: answering more widely than asked creates work and risk without improving the response, while answering more narrowly than asked is a compliance failure in itself.
Which records should you preserve first?
Preservation should run in order of how likely a record is to be both relevant and alterable. Engagement records establish what was agreed; ledger and trust-account records establish what actually happened.
| Record | What it establishes | Preserve because |
|---|---|---|
| Engagement letters and scope documents | What the firm agreed to do, and when | Fixes the start date of a possible designated service |
| Matter descriptions and invoices | What was actually delivered | Delivery can differ from the engagement letter |
| Trust-account and ledger activity | Whether funds or property were handled | Central to several designated services |
| Service catalogues and price lists | What the business offers generally | Shows whether a service is routine or exceptional |
| Customer files and corporate authorisations | Who the customer was, and who acted | Supports the customer identification position |
| Prior scope assessments | Whether the question was considered before | A dated earlier assessment is strong evidence either way |
Legal professional privilege can apply to some of this material, and the Act includes a specific process for asserting it. Privilege should be handled through legal review and that process, not by quietly leaving documents out of a response.
How do you establish whether a designated service was provided?
Tranche 2 coverage is service-based. A professional title does not decide whether a business is a reporting entity, which is why two firms on the same street can reach different answers. The review has to map what the firm actually did for customers against the designated services in the Act and AUSTRAC guidance.
For legal and accounting networks that means separating ordinary professional work from activity that directly advances a transaction, or that involves forming, managing, buying or selling legal structures, or handling property or funds in circumstances the regime covers. The same discipline applies in real estate and conveyancing: start from the regulated service and its connection to Australia, not from an assumption about the profession as a whole.
A defensible scope record shows, for each service, the customer type, the start date, the legal entity providing it, the office or branch involved, and the reasoning used to decide whether it is designated. Our Tranche 2 checklist sets out that mapping as a sequence you can work through and evidence.
How should the response be governed?
A section 167 response should run on two tracks that stay coordinated but do not get confused with each other.
The statutory track is the answer itself. Assign a single senior owner, involve legal counsel where appropriate, preserve relevant records, keep a response register, and check every statement against a source document before it is supplied. Where contemporaneous evidence exists, do not build a narrative from memory.
The remediation track addresses the underlying position. If the scope review indicates the business should have enrolled, completing enrolment, confirming the AML/CTF compliance officer, reviewing the risk assessment and programme, testing customer due diligence and preparing for reporting are all part of putting the position right. Keep evidence of that work as you do it.
Remediation can show that management identified and addressed a control gap. It does not erase an earlier contravention, and it never changes the need for an accurate response.
What is the exposure for the notice itself?
Section 167 makes failure to comply both an offence and a civil penalty matter. The Act sets a criminal penalty of up to six months imprisonment or 30 penalty units, or both, for omitting to do an act the notice requires, and separate provisions deal with false or misleading information and documents.
This is the part that gets underestimated. The exposure created by a careless response sits alongside, and is separate from, whatever the original enrolment question turns out to be. A business that answers late or inaccurately can add a contravention to the one being investigated.
It is also why a notice should not be handled as an ordinary regulator questionnaire delegated to whoever has capacity. Response governance should include legal review, version control of what was said and when, a clear evidence trail, and executive oversight proportionate to the significance of the notice.
What does AUSTRAC say it is actually pursuing?
AUSTRAC's regulatory expectations say it does not expect newly regulated businesses to be perfect at identifying and controlling money laundering risk from day one, but that it does expect honest efforts to meet obligations and report suspicions. Its stated enforcement focus after 1 July 2026 is on entities that wilfully ignore the obligation to enrol, and those it suspects are complicit with, or wilfully blind to, money laundering.
Read against that, a notice to an unenrolled business is consistent with the position the regulator published rather than a departure from it. An imperfect but enrolled and honestly operated programme is not the stated target. Not enrolling is.
Where does technology fit, and where does it not?
A section 167 response is a governance, legal and evidence exercise. No system answers the legal question of whether a particular service is designated, and MemberCheck does not replace that judgement.
Where remediation or ongoing operations need structured customer and entity screening, risk assessment, monitoring and retrievable records, that is the operational control layer. A consistent workflow means screening decisions, the reviewer and the date are recorded as the work happens, so evidence can be produced when compliance is tested rather than reconstructed afterwards. The Tranche 2 hub routes to the sector guidance and the readiness sequence behind that.
Important information
This article provides general information about Australia's AML/CTF framework and does not constitute legal advice. Whether an obligation applies depends on the designated services provided and the circumstances of the business, so the same facts can produce different answers for two firms in the same sector.
If your business has received a notice, or believes it may have provided a designated service without enrolling, take your own legal advice on your specific services before responding. Reporting entities remain responsible for meeting their obligations under the AML/CTF Act, the Rules and applicable AUSTRAC guidance.
