AML/CTF Tranche 2 extends Australia's anti-money laundering regime to "gatekeeper" professions: real estate agents, conveyancers, lawyers, accountants, trust and company service providers, and dealers in precious metals and stones. Their obligations commenced on 1 July 2026. AI can carry much of the document-heavy due diligence, monitoring and reporting work, provided a qualified person approves every regulated decision.
Key takeaways
- The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 brings tens of thousands of professional firms under AUSTRAC regulation.
- Scope depends on whether you provide a "designated service", assessed service by service.
- Core obligations: enrolment, an AML/CTF program, customer due diligence, reporting and record keeping.
- AI suits identity document extraction, screening support, monitoring, report drafting and audit trails.
- AUSTRAC obligations sit with the reporting entity and its officers. A person decides on every client approval and every report.
What is AML/CTF Tranche 2?
Australia introduced its AML/CTF regime in 2006 but deferred coverage of the gatekeeper professions. Tranche 2, enacted through the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, closes that gap because lawyers, accountants and real estate agents sit where illicit funds can enter the legitimate economy: property settlements, company formations, trust structures and client monies.
Government estimates put the number of newly captured businesses at roughly 80,000 to 90,000. AUSTRAC opened enrolment on 31 March 2026, and obligations for Tranche 2 entities commenced on 1 July 2026. Firms must enrol within 28 days of first providing a designated service.
For most of these firms it is their first experience of a financial crime regulator. The question for a mid-sized practice is whether due diligence, monitoring and reporting can carry the load without burying fee earners in administration.
What obligations does Tranche 2 create for professional firms?
Providing a designated service makes you a reporting entity, regardless of matter size. A conveyancing file, an SMSF setup, a company incorporation or a property sale can each be a designated service. The obligations fall into five groups:
- Enrolment with AUSTRAC.
- An AML/CTF program: documented policies, procedures and controls, including a money laundering and terrorism financing (ML/TF) risk assessment for your business.
- Customer due diligence (CDD), or know your customer (KYC): identifying and verifying customers, beneficial owners and politically exposed persons, plus ongoing due diligence through the relationship.
- Reporting: suspicious matter reports (SMRs), threshold transaction reports (TTRs) for cash transactions of AUD 10,000 or more, and international funds transfer reports where relevant.
- Record keeping for the legislated periods, in a form that survives an AUSTRAC inspection.
Tranche 2 also interacts with the Privacy Act. AML/CTF requires you to collect and keep more personal information, which then carries its own privacy and security obligations.
Is your firm in scope for AML/CTF Tranche 2?
"We do not handle client money" is not the test. The test is whether you provide a designated service as defined in the legislation. Use this as a first filter, then confirm against AUSTRAC guidance and legal advice.
Does your firm provide any of these services to clients?
- Real estate sales, leasing or property settlementsIn scope: real estate sector obligations apply
- Company formation, trusts, or acting as nominee directorIn scope: trust and company service provider obligations
- Legal services involving property, money handling or structuresLikely in scope: assess each designated service
- Accounting, tax structuring or managing client fundsLikely in scope: assess each designated service
- Pure advisory with no designated servicesMay be out of scope: document the assessment anyway
Document the scope assessment for every service line. AUSTRAC expects firms to show their reasoning as well as their conclusion. New service lines, client types and jurisdictions reopen the question.
What does Tranche 2 readiness look like in phases?
- Phase 1Scope and enrolConfirm designated services, enrol with AUSTRAC, appoint an AML/CTF compliance officer
- Phase 2Risk assessmentDocument the ML/TF risk assessment across customer types, services, channels and jurisdictions
- Phase 3Build the programWrite the AML/CTF program, CDD procedures and reporting workflows; connect them to practice systems
- Phase 4Operate and monitorRun CDD, monitor matters, lodge SMRs and TTRs, retain records
Phases 1 to 3 are a project. Phase 4 is permanent, and its running cost decides whether compliance drags on billable hours or runs in the background. That steady state is where AI helps most.
Where does AI reduce the AML/CTF compliance burden?
AML/CTF compliance is document-heavy, repetitive and exception-driven, which suits AI assistance when a qualified person stays accountable.
1. Customer due diligence and identity verification
Onboarding means collecting identity documents, verifying them, identifying beneficial owners, screening against sanctions and politically exposed persons lists, and forming a risk rating. Done by hand it is slow and error-prone under deadline pressure.
AI handles the mechanical steps: extracting data from identity and entity documents, cross-checking it against the application, flagging mismatches and pre-populating the risk profile. Verified data flows into your practice management system instead of a spreadsheet.
- CollectClient submits ID and entity documents
- ExtractAI reads documents and structures the data
- ScreenCheck sanctions, PEP and adverse media lists
- Risk rateDraft a risk rating for officer review
- DecideCompliance officer approves or escalates
The last step is fixed. AI drafts the rating, a person with authority approves it, and the system records who approved what and when. The same principle runs through our AI governance framework.
2. Ongoing monitoring
You must monitor relationships for activity inconsistent with what you know about the client. Across hundreds of matters a year, manual monitoring rarely happens consistently. AI can surface anomalies, such as a sudden change in transaction size, structuring around the AUD 10,000 cash threshold, or a settlement that does not fit the client's profile, and route them to a person.
3. Suspicious matter report preparation
SMRs have strict timeframes once a suspicion is formed. The bottleneck is assembling the narrative, records and chronology. AI can draft the factual narrative from the matter file. The compliance officer verifies it and makes the judgement about suspicion.
4. Record keeping and audit readiness
AI can index CDD records, link them to matters and keep a timestamped trail, the kind of automated compliance reporting that turns an inspection into a query.
How does manual AML/CTF compliance compare with AI-assisted?
The purpose is to let one compliance officer supervise the volume Tranche 2 creates without a proportional increase in compliance headcount.
| Manual process | AI-assisted, person-approved | Impact | |
|---|---|---|---|
| Client onboarding | Officer keys every field | Officer reviews a pre-filled profile | Faster |
| Document data errors | Common under pressure | Flagged at source | Fewer |
| Ongoing monitoring coverage | Ad hoc | Continuous | Full coverage |
| SMR drafting | Assembled by hand | Draft narrative for officer review | Faster |
| Audit trail completeness | Variable | Complete by default | Defensible |
- Onboardings per year (assumption)600
- Minutes saved per onboarding (assumption)40
- Officer hours returned per year400
- Late or missed report riskLower
Run a short time-and-motion study on your own onboarding before sizing any investment. AUSTRAC has pursued large civil penalties in already-regulated sectors, so weak controls carry real downside.
Where does AI add AML/CTF risk instead of removing it?
Legal professional privilege. For law firms, AML/CTF obligations interact with privilege. Any AI system touching matter files must respect privilege boundaries and professional conduct rules. That is one reason firms choose private AI infrastructure over public tools.
Data sovereignty and security. Tranche 2 means holding more sensitive personal information. Sending identity documents to an offshore AI service may breach privacy expectations and client agreements. Keep regulated data onshore, as set out in our data sovereignty guide and cyber security requirements guide.
The accountability gap. An AI that auto-approves a client or decides not to report is a liability. The obligation sits with the reporting entity and its officers. Every regulated decision needs a qualified person in the loop with the rationale recorded.
When evaluating tools, use our AI vendor selection questions: where data is processed, who can access it, how the audit trail is kept and whether the vendor can support an inspection.
What does AUSTRAC expect to see from newly regulated firms?
AUSTRAC's guidance and enforcement record in regulated sectors point to three expectations.
A genuinely risk-based program. A rebranded template will not do. The program should reflect your client base, services, channels and jurisdictions. AI can analyse matter data to surface risk patterns, but risk appetite and controls remain a decision for leadership.
Evidence the program operates. Records should show CDD was performed, monitoring ran and suspicious matters were escalated and assessed. A program that lives only in a PDF is a red flag, which is the strongest argument for automating the evidence trail.
Timely reporting. SMRs and TTRs have legislated timeframes, and late reports are a common enforcement trigger. Reducing drafting effort lowers the risk of a timing breach.
Common scoping mistakes
- Treating the whole firm as "in" or "out" when scope is assessed service by service.
- Treating the assessment as a one-off when it must be revisited as services change.
- Assuming professional conduct compliance satisfies AML/CTF. They are separate regimes with separate regulators.
How should a firm sequence AML/CTF automation?
Enrol and appoint your compliance officer, document the risk assessment, design CDD and reporting workflows on paper, then add AI to the steps that are repetitive and high volume. Connecting AML workflows to the practice management and document systems your team already uses is usually a system integration and process automation exercise, with no rip-and-replace. The same foundation often supports wider professional services automation.
How Solve8 can help
Our consultants and engineers build AI-assisted due diligence, monitoring and reporting workflows connected to your practice systems, running on your infrastructure in Australia, with a person approving every regulated decision. See our professional services work or talk to us about your Tranche 2 operating model.
General information, not legal advice. Confirm your obligations against current AUSTRAC guidance and qualified advice.
