For the first time since the regime was built in 2006, Australia’s anti-money-laundering and counter-terrorism-financing obligations now reach the professions. The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, which received Royal Assent on 10 December 2024, extended the regime to a group the sector has come to call the Tranche 2 entities, and the substantive obligations for those entities commenced on 1 July 2026. If your firm practises law or conveyancing, provides accounting or trust and company services, deals in real estate, or trades in precious metals and stones, the questions AUSTRAC now asks are no longer someone else’s compliance problem.
Who is now in scope, and by when
The reform brings an estimated seventy thousand additional businesses into the net, roughly doubling the population of reporting entities to around ninety thousand. Existing reporting entities saw their obligations reshaped from 31 March 2026, and the newly regulated professions came under the full weight of the regime from 1 July 2026. Enrolment with AUSTRAC opened on 31 March 2026 and the window to enrol closed on 29 July 2026, so the firms reading this should already be inside the system rather than contemplating entry. AUSTRAC published its core guidance on 16 October 2025 and has continued to release sector starter kits through 2026, and while the regulator has signalled an education-first posture in the opening period, the obligations themselves are live and enforceable now.
What the obligations actually require
The regime is not a single form to be filed and forgotten. A regulated firm must enrol and register with AUSTRAC, appoint an AML/CTF compliance officer, and adopt a two-part compliance program. Part A covers the firm’s money-laundering, terrorism-financing and proliferation-financing risk assessment together with the governance and processes that manage it, and it must be independently evaluated. Part B covers the customer-facing controls, meaning the identification and verification of clients, the resolution of beneficial ownership behind the entities a firm acts for, and the screening of politically exposed persons and sanctions exposure. On top of that sits an obligation of ongoing customer due diligence, alongside the duty to submit suspicious matter reports and threshold transaction reports as they arise.
The change that matters most is quieter than any single control. The Act places an explicit duty on the governing body, meaning the partners, the board, or senior management, to take reasonable steps to ensure these risks are identified, assessed and managed. Accountability now attaches to named people rather than to the firm as an abstraction, which moves AML from an administrative task delegated downward into a matter of personal and professional exposure at the top of the practice.
The harder truth beneath the checklist
It is tempting to read the new obligations as a heavier onboarding form, a longer questionnaire completed once when a client is taken on. That reading will not survive contact with the regime as written, because two features make it genuinely demanding for professional services firms in particular.
The first is beneficial ownership. A firm is required to see through the entity in front of it to the natural persons who ultimately own or control it, and the structures that most warrant scrutiny are precisely the ones engineered to obscure that answer, layered across trusts, holding companies and offshore vehicles that span jurisdictions and languages. Establishing true ownership to an evidentiary standard is not a clerical exercise, it is an intelligence exercise, and it is exactly the kind of work a busy practice is least equipped to do reliably from a desk.
The second is continuity. The obligation is ongoing customer due diligence, not a snapshot taken at onboarding. A client who was clean on the day they were engaged can acquire a sanctioned counterparty, a politically exposed relationship, or an adverse ownership change the following quarter, and the regime expects the firm to know. A point-in-time check, however diligent, is stale almost as soon as it is signed. The obligation, put plainly, is no longer to hold a policy, it is to prove a position, and to keep proving it.
What a defensible response looks like
The firms that come through this well will be the ones that treat AML as a live, evidence-led position rather than a folder of completed forms. That means resolving beneficial ownership from primary evidence rather than accepting a client’s own attestation, screening for politically exposed and sanctions exposure continuously rather than once, and holding the whole picture in a form that can be put in front of an AUSTRAC reviewer, a professional indemnity insurer, or the firm’s own risk committee and stand up to examination. The distinction that matters is between attestation and evidence, between a report generated on a date and a position maintained over time, and between a questionnaire and genuine tradecraft.
Where this capability comes from
Most professional services firms have capable people. What they do not have, and cannot reasonably build in the months a compliance deadline allows, is the intelligence tradecraft required to resolve ownership and control to a standard that holds, and to read what that resolution surfaces. That capability is the scarce thing, not headcount.
This is where BayRisk, as the Australian partner for Tracery, brings something a firm’s existing team cannot easily replicate. Tracery is intelligence-grade Enterprise Trust, a capability born inside the defence and national security world where trust in a counterparty has to be proven rather than asserted, and it applies that same tradecraft to the ownership, exposure and continuous-diligence questions the Tranche 2 regime now demands. It resolves entities across jurisdictions, maps ownership and control through the layers built to obscure it, screens politically exposed and sanctions exposure, and maintains all of it as a single, continuously recalculated position rather than a point-in-time report. For a professional services firm now answerable under the new regime, the result is the one thing the regime ultimately asks for, an ownership and due-diligence position the firm can prove.
BayRisk makes that capability available to a select number of regulated firms by introduction. If your practice is working through what Tranche 2 now requires, and wants the ownership question answered to a standard that will hold, that is the conversation to have.
BayRisk, Australian partner for Tracery.