AML/CTF Tranche 2 brought accounting firms that provide designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 from 1 July 2026. Firms must enrol with AUSTRAC, appoint a compliance officer, run customer due diligence, screen clients, report suspicious matters and keep records for seven years. AI can carry the collection, screening and record-keeping, while people make every reportable decision.
The reforms come from the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024. Alongside accountants and bookkeepers, they capture lawyers, conveyancers, real estate agents, dealers in precious metals and stones, and trust and company service providers. For firms newly in scope, it is the largest regulatory addition to practice management in a generation.
AUSTRAC opened enrolment on 31 March 2026. A firm providing a designated service must enrol before 29 July 2026, and must appoint an AML/CTF compliance officer and notify AUSTRAC by the later of 29 July 2026 or 14 days after enrolment.
This guide is for practice principals, compliance leads and operations managers in mid-sized and multi-office accounting firms who now need a working AML/CTF program across a full client book without building a compliance department.
Key takeaways
- Obligations attach to specific designated services, not to accounting as a whole. Scope decides everything.
- Tranche 2 is a data collection, verification, screening and record-keeping regime repeated for every captured client.
- Manual checklists hold for a handful of clients and fail quietly at scale.
- AI can collect, screen, monitor and record. The compliance officer decides what is suspicious and reportable.
- Build AML steps into onboarding and existing systems, not a separate process staff have to remember.
Which accounting services trigger AML/CTF Tranche 2 obligations?
Tranche 2 does not capture everything an accountant does. General tax return preparation, standard bookkeeping and routine advisory work are not, on their own, designated services.
What brings a firm in is providing services the legislation treats as higher risk for money laundering, such as:
- assisting a client to plan or carry out the buying or selling of a body corporate or real estate
- managing a client's money, accounts or assets
- helping to create, operate or manage a company or trust, or acting as a formation agent.
A firm that assumes it is out of scope while providing even one designated service carries serious regulatory risk. A firm that assumes every engagement is captured buries itself in work it does not owe. Confirm your position against AUSTRAC guidance and, where needed, legal advice.
Does your firm provide any of these services to clients?
- Managing client money, accounts or assetsLikely a designated service, confirm and enrol
- Assisting with buying or selling a business or real estateLikely a designated service, confirm and enrol
- Creating or managing companies or trustsLikely a designated service, confirm and enrol
- Only tax returns, bookkeeping and general adviceGenerally not captured on those services alone
What does an accounting firm have to do once it is in scope?
The core obligations will be familiar to anyone who has been through bank onboarding:
- Customer due diligence: know who the client is and the nature and purpose of the relationship.
- Ongoing due diligence: keep that understanding current.
- Screening: check clients against sanctions and politically exposed person (PEP) lists.
- Reporting: report suspicious matters to AUSTRAC.
- Records: keep them for seven years.
- Program and officer: maintain a documented, risk-based AML/CTF program overseen by an accountable compliance officer.
None of this is conceptually hard. The weight comes from volume, repetition and the evidence standard, sustained across the whole client book.
Why do manual AML processes break at scale?
The instinct is to treat Tranche 2 like most new compliance: a template, a checklist and a diligent staff member. That fails here because the regime is built on volume and consistency.
Due diligence must be collected and verified for every captured client. Screening must be repeated as lists change. Monitoring must actually be ongoing. Every step must be recorded to a standard that survives scrutiny years later. A manual system collapses quietly, until an audit exposes the gaps.
| Manual and Ad Hoc | Structured and Automated | Impact | |
|---|---|---|---|
| Identity verification | Emailed documents, retyped | Structured capture and verification workflow | Consistent |
| Sanctions and PEP screening | Done once, rarely repeated | Screened and re-screened automatically | Ongoing |
| Ongoing due diligence | Forgotten after onboarding | Scheduled and prompted | Sustained |
| Record-keeping | Scattered across systems | Centralised, seven-year retention | Provable |
| Suspicious activity | Depends on who notices | Flagged for human assessment | Systematic |
AUSTRAC is an active enforcement regulator with a record of very large penalties against major institutions for program failures. The reforms extend that reach to professional services.
Tipping-off is the other sharp edge. A firm must not alert a client that a suspicious matter report has been or may be made. Any workflow has to route a concern to the compliance officer discreetly, never surfacing it where a client could see it.
Where does AI help with AML compliance, and where must a person decide?
Let AI carry the volume and vigilance. Keep every consequential decision with an accountable person.
- CollectCustomer due diligence data captured in a structured, consistent form
- ScreenSanctions and PEP checks run and repeated as lists change
- MonitorOngoing due diligence and unusual patterns flagged for review
- RecordEvery step retained to the seven-year evidentiary standard
- Collect. AI turns emailed documents and retyped details into structured intake, so no field is skipped.
- Screen. Checking clients against sanctions and PEP lists, then re-checking as lists change, is tireless repetitive work software does well.
- Monitor. A system watching every relationship in the background surfaces unusual patterns a busy accountant would miss.
- Record. A complete, retrievable seven-year audit trail becomes a by-product of the work.
The line not to cross is decision-making. AI can flag a matter as unusual; deciding it is suspicious and reportable belongs to the compliance officer, because that decision carries legal weight and personal accountability. AI can assemble the information behind a risk rating; the rating is a professional decision. AI can draft program documentation; the program must reflect the firm's real assessment of its risk.
We set out how to draw that boundary in our guide to AI agent governance, data access and human override. Client identity documents are sensitive, so the AI should run on your infrastructure in Australia, in your cloud or on your own servers.
How do you build AML into the practice instead of bolting it on?
Firms that handle Tranche 2 well treat it as part of onboarding and ongoing service, not a separate silo. You already collect client information, onboard clients and keep records. Extend those workflows so due diligence, screening and monitoring happen inside the systems you already run.
Compliance that lives inside the normal flow of work gets done. Compliance in a separate system gets skipped under deadline pressure.
The reconciliation and data hygiene behind AI automation for accounting firms and tax compliance is the same foundation that makes AML monitoring practical. A firm that has already modernised its Xero and MYOB automation has much of the data plumbing in place.
- Manual: onboarding due diligence per clientHours, every engagement
- Manual: periodic re-screening across the bookRarely done at all
- Automated: structured intake and screeningMinutes, consistent
- Automated: continuous monitoring and audit trailRuns in the background
Automation does not make a firm compliant by itself, replace the compliance officer, or remove the need to understand your money-laundering risk. A tidy AML report on top of a hollow program is a liability, because a regulator looks straight through it. The same logic is driving automation in banking and telecommunications fraud detection, which we cover in the Scams Prevention Framework and AI detection.
What should accounting firms do about Tranche 2 now?
Certainty about scope and enrolment comes first, because enrolment, officer appointment and notification obligations are already live.
- ImmediatelyConfirm scope and enrolDetermine designated services, enrol with AUSTRAC, appoint and notify the compliance officer
- First weeksDocument the programBuild a genuine risk-based AML/CTF program reflecting the firm's real risk
- Next quarterAutomate the workflowStructured due diligence intake, automated screening, continuous monitoring, central records
- OngoingMonitor and proveRe-screen as lists change, keep seven-year records, review the program regularly
Tranche 2 is a capability the firm now owns. Handled manually, it drags on chargeable time and remains a standing risk. Handled with disciplined automation, it runs quietly in the background and frees accountable people for the judgements the law reserves for them. The same data discipline helps with other 2026 changes, such as the Division 296 super tax.
How Solve8 can help
Our consultants and engineers build AML intake, screening, monitoring and record-keeping into the practice systems you already run, on your infrastructure in Australia, with the compliance officer making every reportable decision. See our professional services work and process automation service, or contact us to scope the first phase.
