MemberCheck, a Nexiant brand
Contact us

Tranche 2 hub

Tranche 2 AML Compliance in Australia

Obligations for the newly regulated sectors commenced on 1 July 2026. The preparation phase is over, which changes what matters: enrolment if you are still outside the regime, and evidence of ongoing compliance if you are inside it.

Last updated

Talk to our teamBook a demo
Curved glass office towers seen from street level against a blue sky
30 days
Free trial, no credit card
<3 min
Setup time
1,000+
Global watchlists screened
24h
Watchlist refresh cycle

Where this now stands

Tranche 2 extended Australia's AML/CTF regime to professions that had never been reporting entities. The dates have passed:

DateWhat happened
31 March 2026Enrolment with AUSTRAC opened
1 July 2026Obligations commenced for the newly regulated sectors
29 July 2026Enrolment deadline

That changes the question. Until 1 July the work was preparation, and being mid-build was a reasonable position. It is not one now. A firm providing a designated service is a reporting entity whether or not it has enrolled, and whether or not it has a programme.

If you are still outside the regime

Being late is recoverable. Being late and undocumented is harder, because the first thing you will be asked is when you established your scope and what you did about it.

  1. Work through your services one at a time against AUSTRAC's designated services, and write down the reasoning, including for the services you conclude are not caught
  2. If any are caught, enrol with AUSTRAC
  3. Appoint an AML/CTF compliance officer at management level
  4. Complete the risk assessment before designing controls, because it is what justifies them
  5. Start customer due diligence on new customers immediately, then plan the existing book

The readiness workflow sets out that sequence in full, and the checklist is the version you can work through and tick off.

Two dates follow from enrolling rather than from the commencement calendar, so they are easy to miss. Your compliance officer must be notified to AUSTRAC by the later of 14 days after you enrol or 29 July 2026. Your first independent evaluation is due between 30 June 2029 and 31 December 2030 depending on the last two digits of the AUSTRAC account number you are issued on enrolment, and the checklist sets out which pairing gives which date.

What ongoing compliance looks like

Setup had deadlines and an end. The two obligations that replaced it have neither, and between them they carry almost all of the standing cost.

Ongoing customer due diligence. Not a periodic refresh cycle. The obligation is to keep customer information current and to review when something changes, which makes the trigger an event rather than a date. A customer who becomes a politically exposed person, an entity whose beneficial ownership changes, a counterparty added to a sanctions list overnight: each of those is a review, and none of them arrives on schedule. That is why perpetual KYC replaces the annual review as the operating model.

Suspicious matter reporting. Within the statutory timeframes, every time, with the tipping-off prohibition attached. For a firm that has never reported, this is an entirely new muscle, and the failure mode is not refusing to report but not recognising what needed reporting.

Screening is the part that changes most often, because what moves is the data rather than the rule. Sanctions lists change without notice, so a check that was clean at onboarding is not evidence of anything a month later. Ongoing monitoring against current data is what keeps the position defensible.

What AUSTRAC has said it will enforce

AUSTRAC has published its position, and it is more specific than a general warning. Its regulatory expectations state that it does not expect newly regulated businesses "to be perfect at identifying and controlling for money laundering risks from day one", but that it does expect "honest efforts to meet your obligations and report suspicions to AUSTRAC".

⚠️ It then names what it will pursue. After 1 July 2026 AUSTRAC said it would focus enforcement in the newly regulated sectors on entities "who wilfully ignore the obligation to enrol" and those it suspects are "complicit with, or wilfully blind to, money laundering in their business". Its 2026 to 2027 priorities keep the same shape: effort rather than perfection, with enforcement aimed at non-enrolment and complicity.

Read together, those two statements are the practical guide. An imperfect programme that is enrolled, staffed and honestly operated is not the target. Not enrolling is. So is a programme that exists on paper while the business declines to look at what it is being told.

That is also why the record matters more than the intention. The exposure for a newly regulated firm is rarely a deliberate breach, it is having accepted a customer for good reasons and having no record of what those reasons were. In practice:

  • Every screening decision needs a retained result, not just an outcome
  • Every alert needs a named reviewer and a dated rationale
  • Every risk rating needs the methodology that produced it
  • Every exception needs whoever authorised it

⚠️ Two published deadlines do not apply to you, and mistaking them is easy. AUSTRAC's transitional rules set a compliance officer notification date of 30 May 2026 and allow initial customer due diligence to continue under the old procedures until 31 March 2029. Both are conditional on having been enrolled as a reporting entity on 30 March 2026, so both belong to businesses that were already regulated. A newly regulated firm has no such transition: new customers get the new initial CDD framework from the start, and its officer notification runs from its own enrolment date.

Guidance by sector

The newly regulated categories concentrate in five sectors, and each has its own version of the problem:

The four pages, and what each answers

If you are...Start here
Working out what the reforms wereWhat is Tranche 2?
Working out whether you are caught, and what to buildReadiness workflow
Working through it step by stepTranche 2 AML checklist
Choosing toolingSoftware buyer's guide

Where MemberCheck fits

MemberCheck screens customers, entities and beneficial owners against global sanctions, PEP, watchlist and adverse-media data, verifies identities, and monitors continuously, with an audit trail behind each decision. Bringing an existing client book up to a standard it was never opened against is a remediation programme rather than an intake process, and it is the piece most firms underestimated.

If you would rather talk it through, get in touch and say which sector you are in and whether you have enrolled.

Questions

Common questions about tranche 2 aml compliance in australia.

Is there a free trial?
Yes. MemberCheck offers a 30-day free trial with no credit card required, and setup takes under three minutes. The trial covers instant PEP, sanctions and adverse-media screening against 1,000+ watchlists. Ask for it through the contact form and the team will set the account up.
Have Tranche 2 obligations already started?
Yes. Enrolment with AUSTRAC opened on 31 March 2026, obligations for the newly regulated sectors commenced on 1 July 2026, and the enrolment deadline was 29 July 2026. A firm that provides a designated service and has not enrolled is not preparing late, it is operating outside the regime.
We think we might be caught but never enrolled. What now?
Establish scope first, because the answer decides everything else. Work through your services one at a time against AUSTRAC's designated services and record the reasoning. If any are caught, enrol, appoint a compliance officer and start the risk assessment, in that order. Keep the dated record of when you established scope, because the sequence and its timing are what you will be asked about.
What does ongoing compliance actually involve?
Two obligations that never end. Ongoing customer due diligence, driven by what changed about a customer rather than by a review date, and suspicious matter reporting within the statutory timeframes every time. Everything else in the regime was setup with a completion date. These two carry the standing cost and are what supervision examines.
What does a supervisor look at?
The record, not the intention. Once a regime is live the question shifts from whether a programme exists to whether each decision can be evidenced: why this customer was accepted, what the screening returned, who reviewed the alert, and when. A programme that works but cannot explain itself is the common failure among newly regulated firms.
Is AUSTRAC enforcing against newly regulated businesses?
AUSTRAC has published a specific position rather than a general warning. It says it does not expect newly regulated businesses to be perfect at identifying and controlling money laundering risks from day one, but that it does expect honest efforts to meet obligations and report suspicions. It also says that after 1 July 2026 it would focus enforcement in the newly regulated sectors on entities that wilfully ignore the obligation to enrol, and on those it suspects are complicit with, or wilfully blind to, money laundering in their business. An imperfect but enrolled and honestly operated programme is not the target; not enrolling is.
When is our first independent evaluation due?
It depends on the AUSTRAC account number you receive when you enrol. Under AUSTRAC's transitional rules the first independent evaluation for a newly regulated business is due by 30 June 2029 if the last two digits are both odd, 31 December 2029 if the second-last is odd and the last is even, 30 June 2030 if both are even, and 31 December 2030 if the second-last is even and the last is odd.