AML/CTF Tranche 2: What Law Firms Must Do in 2026

What Tranche 2 Means for Law Firms

Tranche 2 is the extension of Australia’s AML/CTF regime to another group of businesses providing services that criminals can exploit. It includes specified services provided by lawyers, accountants, real estate businesses and trust and company service providers. Dealers in precious metals and stones are also covered by the reforms.

AUSTRAC is the Australian Transaction Reports and Analysis Centre, Australia’s AML/CTF regulator and financial intelligence unit. Its professional designated services guidance explains which professional activities attract obligations under the AML/CTF Act.

The legal-sector obligations commenced in 2026. Firms already providing covered services at commencement had a specific enrolment deadline. Firms starting afterwards must apply within 28 days of starting a designated service. AUSTRAC’s enrolment guidance sets out the applicable commencement and deadline details.

For Western Australian practices, the Law Society’s AML/CTF hub brings together legal-sector resources. The accountant’s tranche 2 obligations need a separate assessment when a practice also provides accounting services.

Which Legal Services Are Caught

Designated legal services are specific activities, rather than every service a solicitor provides. Table 6 of the AML/CTF Act and AUSTRAC’s sector guidance cover these professional services:

• Assisting with transactions to buy, sell or transfer real estate.
• Assisting with transactions to buy, sell or transfer a body corporate or legal arrangement.
• Receiving, holding, controlling or managing a person’s property to help plan or execute a transaction.
• Assisting with equity or debt financing for a body corporate or legal arrangement.
• Selling or transferring a shelf company.
• Assisting with creating or restructuring a body corporate or legal arrangement.
• Acting, or arranging another person to act, in specified positions in a body corporate or legal arrangement.
• Providing a registered office or principal place of business address for a body corporate or legal arrangement.

The service must meet its statutory conditions and have the required geographical link to Australia. Court-ordered transactions have specific exceptions. Some providers, including legal aid commissions and community legal centres, have exemptions.

Legal professional privilege remains protected. It affects which information a firm must disclose, rather than giving every legal matter an exemption from reporting.

Core Obligations

A covered law firm needs a working AML/CTF program and customer procedures that match its risks. Enrolment is the entry requirement. The separate AUSTRAC registration regime applies to remittance and virtual asset services, rather than ordinary designated legal services.

Build the program around the designated services your firm supplies and the risks of its customers and matters. The program includes a documented risk assessment and policies for managing those risks. Appoint an AML/CTF compliance officer and obtain the required approvals and oversight. AUSTRAC’s policy guidance explains this framework.

Customer due diligence, or CDD, establishes who the customer is and the risk of providing the service. It also covers relevant beneficial owners and people acting for the customer. Complete initial CDD before providing a designated service, subject to the law’s exceptions. Continue monitoring while you provide the service and during an ongoing business relationship.

Keep records of the program, customer checks and transactions, alongside reporting decisions and follow-up work. Under AUSTRAC’s record-keeping guidance, CDD records remain for seven years after the relationship ends or the occasional transaction finishes. Other records have their own retention triggers.

The reformed framework calls this assurance process an independent evaluation. Older guidance calls it an independent review. The evaluation examines the risk assessment and policy design, then tests whether the firm follows its policies and manages its risks.

AUSTRAC requires evaluations at least every three years, with frequency appropriate to the firm’s nature, size and complexity. Transitional rules stagger the first evaluation deadline for newly regulated firms by AUSTRAC account number. Record your deadline and rationale using the transitional rules.

A suitable evaluator can be internal or external, provided they are sufficiently independent of the work being assessed. Someone who designs or maintains the program is unsuitable to evaluate that work. AUSTRAC’s independent evaluation guidance explains competence and independence requirements.

Suspicious Matter Reporting and Tipping Off

A suspicious matter report, or SMR, is required when a firm forms a reportable suspicion on reasonable grounds while providing or proposing a designated service. Relevant grounds include suspected criminal activity or doubts about a customer’s claimed identity. An unusual transaction can trigger investigation without automatically establishing reasonable grounds for an SMR.

Record when the firm forms its suspicion on reasonable grounds. That point starts the reporting clock, even if further enquiries continue. An alert alone can require investigation, while reasonable suspicion requires a factual basis. You do not need proof that a crime occurred.

For ordinary suspicions, the firm has three business days after the day it forms the suspicion. Count from the following day. Terrorism-financing suspicion requires reporting within 24 hours of formation.

The five-business-day period for a qualifying privilege claim also runs after the formation day. It does not extend the terrorism deadline. The AUSTRAC SMR guidance explains the conditions. Our suspicious matter reporting guide covers the reporting process.

When the grounds come wholly from information protected by another person’s legal professional privilege, AUSTRAC requires neither an SMR nor an LPP form. A suspicion based partly on privileged communications and partly on non-privileged material has a different reporting outcome. Submit the non-privileged grounds in the SMR and an LPP form explaining the information withheld.

Submit both forms together within five business days after the formation day for a non-terrorism suspicion involving a qualifying privilege claim. For terrorism financing, both are due within 24 hours of forming the suspicion. Ordinary client confidentiality does not establish privilege. Identify the legal basis for withholding the particular information. Apply the legal professional privilege guidance to the information involved.

Tipping off is a criminal offence involving disclosure of protected information where it would, or could reasonably be expected to, prejudice an investigation. Telling a client that your firm has reported them can create that risk. Ordinary customer enquiries and appropriate internal escalation need controls that protect the reporting information. AUSTRAC’s tipping off guidance explains permitted disclosures and restrictions.

Monitoring Trust Account Transactions

Transaction monitoring examines customer transactions and behaviour to identify unusual activity and changes in risk. AUSTRAC expects firms to monitor all customers receiving designated services. For an occasional transaction, monitoring covers the service period. An ongoing relationship requires monitoring throughout that relationship.

Trust-account monitoring compares receipts and payments with the matter’s purpose and expected activity. A receipt from an unexpected third party or a request to return settlement funds to another account needs assessment. Trust-account reconciliation checks the accounting records, while AML monitoring examines the customer activity behind those records.

A written transaction monitoring policy sets the rules or thresholds that trigger an alert. It names who reviews alerts, the escalation path and how decisions are recorded. Include all relevant transaction data, review frequency and follow-up procedures. Record why you close an alert or escalate it for enhanced CDD or reporting.

For a fictional conveyancing matter, your firm expects one deposit from the buyer’s verified account. Several unrelated payers send the deposit instead. The reviewer records each receipt and asks how the contributors relate to the buyer. The decision record captures the explanation, supporting documents and any further action.

Manual monitoring can suit a manageable transaction load. AUSTRAC expects automation when manual monitoring cannot work effectively, such as at high volumes. AUSTRAC’s monitoring guidance explains the risk-based approach. Our money laundering warning signs supply further examples for alert review.

Checking Where Client Funds Come From

Source of funds checks establish how a customer obtained the money used in a transaction. The sending bank account alone does not explain its origin. The evidence needs to support the customer’s explanation.

AUSTRAC expects verification appropriate to risk. More detailed checks apply when customers present higher risks, transactions conflict with known information or funds have unclear origins. Politically exposed persons (PEPs) and high-risk jurisdictions can require closer assessment. Property settlement funds can need these checks as part of CDD.

Wider source of wealth enquiries apply where the risk assessment calls for them. AUSTRAC’s funds and wealth guidance explains the triggers.

In a fictional property purchase, a client says their $180,000 contribution comes from accumulated salary. Statements show regular pay deposits supporting $120,000, followed by a $60,000 transfer from another person. The transfer requires an explanation and supporting evidence, such as a loan agreement or gift record. Missing statement periods also leave gaps in the transaction history.

Keep the client’s explanation and the statements examined, with supporting documents for the underlying source. Record the risk assessment, questions asked and the reviewer’s decision. The file must show why the evidence supports the funds used. Our source of funds guide explains how to document the client’s funds.

AML Software and Outsourced Compliance Support

AML tools support different jobs, so choose them against the duties your firm needs to perform. Customer onboarding software collects information and verifies identity. Screening checks sanctions lists and PEP status. Transaction monitoring reviews activity against risk-based rules and routes alerts to staff.

Approach	What It Supports	What Your Firm Must Assess
Practice workflow add-on	Customer information, identity checks and screening within existing matter workflows	Which checks it performs and how staff record follow-up decisions
Dedicated AML system	CDD cases, customer risk assessments and ongoing review workflows	How it receives trust transaction data and whether its alerts cover your risks
Transaction monitoring system	Rules, alerts and investigation records for transaction activity	Data completeness, thresholds and timely staff review
Specialist compliance provider	Program development or defined compliance functions	Scope, competence and the firm’s oversight responsibilities

InfoTrack describes identity verification, PEP and sanctions screening, adverse media checks and customer risk reports in its AML Onboarding & VOI workflow. First AML documents dedicated CDD workflows and an integration with Aderant Expert and Expert Sierra. These are examples of documented capabilities, without a ranking. An onboarding integration alone does not establish a complete trust-account transaction monitoring system.

Before selecting an AML system, list your designated services and the risks each creates. Map each requirement to a demonstrated function: customer checks, beneficial ownership and screening, then monitoring alerts and escalation. Require an audit record of staff decisions and exports your firm can retain independently of the subscription. Confirm that incoming trust data preserves the payer, amount and matter reference needed for review.

Test monitoring rules with fictional transactions reflecting those risks. Include an expected payment, an unexplained third-party receipt and a return-payment request to a different account. Confirm which cases create alerts and which staff receive them. Record the test inputs, expected results and actual results. A rule that generates alerts still needs a reviewer who investigates and records the decision.

For each reviewed alert, retain its trigger, the evidence considered and the explanation obtained. Record the reviewer, decision time and reason for closure or escalation. Test that enhanced CDD and reporting referrals reach the responsible person within the applicable deadline. Buying software does not establish that the firm follows these procedures.

A specialist can draft a tailored program or carry out defined compliance functions. A suitable independent evaluator can assess the program, provided their role meets the independence requirements. AUSTRAC’s outsourcing guidance makes the firm’s continuing responsibility explicit. Define the provider’s work and retain oversight.

Forensic bank-statement analysis supports a specific client-funds enquiry. FinTrace saves hours of statement review by consolidating large PDF bundles into a searchable Excel ledger and a readable findings report. Suspicious transactions are clearly flagged, with the source filename and page beside each finding. The firm uses those outputs in its customer assessment and keeps responsibility for its monitoring and reporting.

FinTrace performs the statement-analysis work at a fraction of the cost of manual review or engaging a forensic accountant for that same task. Forensic accountants can also use the service to free time for interpretation. For a client-funds enquiry involving substantial statements, request a matter assessment with the approximate pages, accounts and timeframe.