A firm that has enrolled with AUSTRAC, written an AML/CTF program and briefed its board understandably feels like the hard part is done. Two things AUSTRAC has done this year to two long-established payments businesses say otherwise, and the timeline between them is worth sitting with.
An audit order that didn’t end the story
In July 2025, AUSTRAC ordered an established international remittance business operating in Australia to appoint an external compliance auditor, after identifying concerns in its customer due diligence, its suspicious matter reporting and its AML/CTF program more broadly. This wasn’t a new entrant building a program from scratch. It was a business that had operated in Australia for years, with a program already in place and already being audited.
Fourteen months later, in September 2026, AUSTRAC didn’t treat that audit as the end of the matter. It opened a full enforcement investigation into the same business and its overseas parent. The audit order was not a substitute for ongoing scrutiny. It was a step on the way to more of it.
A smaller case, the same lesson
A separate, smaller case makes the same point. In September 2025, AUSTRAC issued a digital payments provider operating in Australia a $187,800 infringement notice, for late reporting of international funds transfer instructions, the IFTI reports the Act requires within strict timeframes. The business self-disclosed the failure and paid the notice in full. There was no allegation of concealment, no dramatic breach, just a reporting deadline missed.
AUSTRAC fined it anyway.
Two established payments businesses, each already running a compliance program, both still hearing from AUSTRAC well after that program was in place.
What AUSTRAC has actually said it’s testing for
None of this is guesswork about AUSTRAC’s intent. Its own regulatory priorities for 2026-27 say plainly that it will scrutinise AML/CTF programs that are not applied in daily operations, not simply whether a program exists on paper. Suspicious matter reporting quality gets the same treatment: AUSTRAC has said it will engage directly with entities whose reports are consistently poor, not just the ones that are late.
Tranche 2 professions, the trust and company service providers, accountants and tax practitioners, lawyers, conveyancers and real estate agents who came inside the regime on 1 July 2026, are named as a specific focus of that same scrutiny. This isn’t a warning aimed at remittance and payments businesses alone.
The first compliance report isn’t the first checkpoint
It’s worth being precise about the calendar here, because it’s easy to read it the wrong way. The enrolment window for Tranche 2 entities closed on 29 July 2026. The enrolment checklist itself isn’t due until 30 June 2027. The first compliance report window runs from 1 July to 30 September 2027, still the best part of a year away.
It would be reasonable to look at that calendar and conclude there’s time before anything is actually tested. Both cases above argue against that reading. AUSTRAC didn’t wait for a scheduled report from either business. It acted on its own timeline, off its own evidence, in the middle of the cycle. There’s no reason to expect Tranche 2 supervision will wait for July 2027 either.
What this actually asks of a newly enrolled firm
The enrolment checklist and the written program are the starting point, not the proof. What AUSTRAC’s own priorities and its own conduct this year both point to is whether a firm can show, on an ordinary day and not just on the day a report is due, that it actually knows who it’s dealing with: beneficial ownership resolved from real evidence rather than a client’s own word, political exposure and sanctions checked on an ongoing basis rather than once at onboarding, and a position that stays current as clients and structures change.
That’s an intelligence capability, not a filing exercise, and it’s exactly the gap between a program that exists and a program that’s been proven to work.
We wrote about what Tranche 2 actually asks of professional services firms back in August, and this is the sharper version of that same point: AUSTRAC’s own year shows it isn’t treating enrolment as the finish line, and there’s little reason to assume the firms it hasn’t looked at yet get treated any differently. If it would help to talk through where your own program stands on that test, before AUSTRAC asks rather than after, get in touch: hello@bayrisk.com.au.
References
- AUSTRAC, “Our regulatory priorities for 2026-27.” https://www.austrac.gov.au/about-us/policies-and-governance/our-policies/our-regulatory-expectations-and-priorities/our-regulatory-priorities-2026-27
Note: the two enforcement cases above are drawn from AUSTRAC’s own July 2025, September 2025 and September 2026 releases, dates and figures verified directly against them and against independent secondary reporting. Those specific releases aren’t linked here because their titles name the businesses involved.