The last piece on this was about firms that enrolled under Tranche 2, wrote a program, and assumed that was the hard part done. AUSTRAC’s own conduct this year said otherwise: it tested whether those programs actually worked, not just whether they existed. This piece is about a different group. AUSTRAC is now looking for the businesses that never enrolled in the first place, and before getting to what that means, it’s worth being precise about exactly who the regime actually captures, because that’s where most of the genuine risk in this group sits.

A basic requirement, checked on

The Tranche 2 regime expanded on 1 July 2026. The enrolment window for businesses already caught by the change closed on 29 July 2026.

In the weeks since, AUSTRAC has said it has begun issuing section 167 notices to entities that appear to be providing a newly captured designated service but never enrolled. AUSTRAC’s chief executive, Brendan Thomas, put it plainly: enrolment is a basic requirement, and a business providing a designated service needs to be enrolled, full stop.

Enrolment is a basic requirement. If a business is providing designated services, it needs to be enrolled with AUSTRAC.

What a section 167 notice actually does

A section 167 notice is a compulsory information-gathering power, not a fine. It requires the business it’s sent to produce specified information or documents to AUSTRAC, on a deadline, about whether and how it’s providing a designated service. It doesn’t accuse the recipient of anything. It tests whether an assumption the business has been operating on, that what it does doesn’t count, or that enrolment doesn’t apply to a business its size, actually holds up when AUSTRAC asks the question directly.

What happens next depends entirely on the answer. A business that genuinely isn’t providing a designated service can usually demonstrate that and the matter ends there. A business that is, and wasn’t enrolled, moves from an information request into an actual compliance gap, with AUSTRAC already holding the paper trail of when it first asked.

Who Tranche 2 actually captures, service by service

AUSTRAC doesn’t define the regime by job title. It defines it by designated service: a specific list of activities that, once a business performs any one of them in the course of carrying on a business, makes that business a reporting entity regardless of what the business calls itself. That distinction matters, because it’s the reason firms end up genuinely unsure whether they’re caught, not because the list is unclear, but because so much depends on exactly what a given engagement actually involves.

Lawyers, conveyancers and insolvency practitioners

A legal or conveyancing practice provides a designated service when it assists in planning or executing a transaction to buy, sell or transfer real estate, or to buy, sell or otherwise transfer a controlling interest in a company or a legal arrangement such as a trust. It’s also captured when it receives, holds, controls or manages a client’s property, money, accounts, securities or virtual assets to help carry out such a transaction, when it helps create or restructure a company or legal arrangement (drafting constitutions, trust deeds or ASIC filings), or when it acts, or arranges for someone else to act, as a director, secretary, power of attorney, partner or trustee. Testamentary trusts and anything done under a court or tribunal order are excluded.

Insolvency practitioners sit inside the same framework rather than a separate one. The designated services that most commonly apply to insolvency work are the same real estate, property-holding, financing and restructuring items listed above. The line AUSTRAC draws is between advice and action: a practitioner giving general advice about a client’s options isn’t providing a designated service, but one who takes steps to actually help carry a transaction out is.

Accountants and trust and company service providers

The same creation, restructuring and fiduciary-position items that capture lawyers also capture accountants and dedicated trust and company service providers, plus two further services that sit squarely in this space: assisting in organising, planning or executing equity or debt financing for a company or legal arrangement, and selling or transferring a shelf company in the course of carrying on a business. Providing a company’s registered office address or principal place of business address is its own separate designated service, which is why it specifically captures firms that offer registered-office or company secretarial services as a standing product, not only firms doing one-off company formations.

Real estate agents and property developers

Real estate is captured two ways. The first is brokering the sale, purchase or transfer of real estate on behalf of a buyer, seller, transferor or transferee in the course of carrying on a business, which is the ordinary buyer’s agent and selling agent role. The second, easier to overlook, is selling or transferring real estate directly, in the course of a business that sells real estate, where the sale isn’t brokered by an independent agent. That reaches property developers and house-and-land, off-the-plan or new-subdivision sellers using their own in-house sales staff rather than an external agency. Both need a geographical link to Australia and apply to freehold interests, leasehold interests over 30 years, and certain land-use entitlements.

Dealers in precious metals, stones and products

This one runs on a dollar threshold rather than a type of transaction. A business buying or selling precious metals, stones or precious products in the course of carrying on a business provides a designated service when the purchase involves physical currency, virtual assets, or a combination of the two, worth $10,000 or more, whether as a single transaction or a series of transactions that appear linked. A sale paid for entirely by card or bank transfer, with no cash or virtual asset component, isn’t a designated service under this item. That exclusion is precisely why a business just under the line can genuinely believe it’s out of scope while a near-identical one a few transactions later is in it.

A separate track: virtual asset service providers

Virtual asset service providers were already partly regulated before this reform and have had their own designated services modified rather than newly created by it. They’re a distinct category from the five professional, real estate and precious-metals groups above, not an extension of them, so a Tranche 2 compliance program built for a law firm or an accounting practice shouldn’t be assumed to transfer across to a crypto exchange or custody provider without its own separate check.

This isn’t the same test as the last one

The firms the last post was about had a program AUSTRAC could poke at. These ones don’t show up at all. A section 167 notice isn’t a penalty in itself, it’s the step before one: AUSTRAC asking a business to explain, on the record, why it’s operating in a Tranche 2 profession without being enrolled. For a business that assumed the reform somehow didn’t apply to it, or simply hadn’t gotten around to it, that’s the moment the assumption gets tested.

Why the uncertain cases are the real exposure

Deliberate avoidance is almost certainly the smaller part of this group. The larger part is businesses sitting close enough to one of the definitions above that the honest answer is “probably, but we’re not certain.” A conveyancer who occasionally holds trust money as part of a settlement. A small accounting practice that also sets up company structures for a handful of clients each year. A jeweller whose cash sales cross $10,000 only a few times a year, and who has never worked out whether those occasions are frequent enough to matter. An insolvency practitioner who has always thought of their role as advisory and never mapped which specific steps in an engagement cross into assisting a transaction. None of these are edge cases invented for effect. They’re the ordinary shape of a professional services business operating close to a line it has never been asked to draw precisely.

The firms clearly caught by the 1 July expansion, the ones running a dedicated conveyancing or company-formation practice, have had a visible deadline to work against. The ones genuinely unsure whether they’re caught at all have had no deadline to focus the question, which is exactly the group AUSTRAC’s section 167 notices are now designed to find.

What being a reporting entity actually commits a business to

It’s worth being concrete about what’s actually being asked for, because “enrol” undersells the size of the obligation. A reporting entity has 28 days from first providing a designated service to enrol with AUSTRAC. It then needs an AML/CTF program containing a documented risk assessment and policies fitted to how the business actually operates, with a named compliance officer and sign-off from senior management and the governing body, not a template downloaded and filed. Customer due diligence has to run before a designated service is provided and continue afterwards, not as a one-off check at onboarding. And three separate reporting obligations sit on top of all of that: suspicious matter reports, due within 24 hours where terrorism financing is suspected and three business days otherwise, threshold transaction reports within 10 business days, and cross-border movement reports, alongside an annual compliance report to AUSTRAC. Records covering the program, customer information, transactions and staff training all need to be kept for seven years.

None of that is a reasonable thing to stand up in the weeks after a section 167 notice arrives. It’s the reason the question of whether a business is caught at all is worth answering now, on its own timeline, rather than for the first time in a reply to AUSTRAC.

Two different problems, the same underlying gap

Put the two posts together and the shape of AUSTRAC’s year becomes clearer. For firms that enrolled, the test is whether the program is real: beneficial ownership resolved on evidence, due diligence that runs continuously rather than once at onboarding, a position that stays current as clients and structures change. For firms that didn’t enrol, the test is simpler and more binary: are you providing a designated service or not, and if you are, why aren’t you in the system.

Neither question waits for a scheduled report. Both are being asked now, in the ordinary course of AUSTRAC’s year, well before the first Tranche 2 compliance report window opens in mid-2027.

If there’s genuine uncertainty in your business about whether something you do counts as a designated service under the Tranche 2 reforms, that’s worth resolving on your own terms rather than AUSTRAC’s. Happy to talk through where the line actually sits for your business: hello@bayrisk.com.au.

References

AUSTRAC, “AUSTRAC issues notices to non-enrolled businesses.” https://www.austrac.gov.au/news-and-media/article/austrac-issues-notices-non-enrolled-businesses

AUSTRAC, “Designated services for newly regulated entities.” https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities

AUSTRAC, “Professional designated services.” https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/professional-designated-services

AUSTRAC, “Real estate designated services.” https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/real-estate-designated-services

AUSTRAC, “Precious metals, stones and products designated services.” https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/precious-metals-stones-and-products-designated-services

AUSTRAC, “How designated services apply to insolvency practitioners.” https://www.austrac.gov.au/new-austrac/designated-services-newly-regulated-entities/how-designated-services-apply-insolvency-practitioners

AUSTRAC, AML/CTF obligations factsheet for Tranche 2 reporting entities. https://www.austrac.gov.au/sites/default/files/2025-07/AMLCTF_obligations_factsheet_for_tranche_2_REs.pdf