AML/CTF Tranche 2 is now in effect for covered professional services. Since 1 July 2026, some accounting firms have been brought into Australia’s anti-money laundering and counter-terrorism financing framework.
But the important answer is this: your firm didn’t become a reporting entity simply because it provides accounting services.
The trigger is whether your practice provides one or more designated services under the AML/CTF Act. Routine accounting work may sit outside the regime, while company formation, trust administration, transaction support and managing client property can bring your firm squarely within it.
This guide explains the practical trigger points for Melbourne accounting firms, the obligations that follow, and what you should do now.
Important: This article provides general information, not legal advice. Your firm should assess its actual service lines and obtain professional advice where necessary. Review the latest AUSTRAC guidance for professional designated services.
Did your accounting firm become a reporting entity automatically?
No. Tranche 2 applies to designated services, not to every accounting practice.
From 1 July 2026, accountants and other professional service providers can become reporting entities when they provide a covered service in Australia during business activities.
That means a firm focused on services such as the following may not automatically be captured:
- Preparing tax returns
- Preparing BAS statements
- Maintaining accounting records
- Processing payroll
- Reconciling bank accounts
- Preparing financial reports
- Creating payment files where the client authorises payments directly
However, the position can change when those services form part of a transaction or involve control over client funds, assets or legal structures.
The practical question isn’t “Are we accountants?” It’s “What exactly are we doing for the client?”
Which services can trigger AML/CTF obligations?
Your firm is likely to be in scope if it provides one or more of the following professional designated services.
1. Do you assist with real estate transactions?
A firm may be captured when it assists with planning or executing a transaction to buy, sell or transfer real estate.
The service needs to be assessed in context. General tax advice about property ownership isn’t automatically the same as assisting with the transaction itself. The more directly your firm helps structure, organise or execute the transaction, the more carefully you need to assess the engagement.
2. Do you assist with the sale or transfer of a company, trust or other legal arrangement?
Supporting a client with the sale or transfer of a company, trust, partnership or similar legal arrangement can be a designated service.
This may include work connected with:
- Buying or selling a business
- Transferring company ownership
- Transferring interests in a trust or partnership
- Planning a transaction involving a legal structure
Transaction involvement is the key distinction. Preparing financial information for a potential sale may not, by itself, trigger the regime. Helping plan or execute the transfer may.
3. Do you receive, hold, control or manage client property for a transaction?
This is one of the most important trigger points for accounting firms.
A practice may become a reporting entity if it receives, holds, controls or manages money or other property to help plan or execute a transaction.
Examples may include:
- Holding funds connected with a business sale
- Controlling an account to settle a transaction
- Receiving deposits or purchase funds
- Managing client money as part of a specific transaction
- Transferring funds on a client’s behalf where the activity is tied to a covered transaction
By contrast, preparing a payment file for a client to approve and pay directly from its own bank account may not be the same as receiving or controlling the client’s property.
Review who has authority over the money, why the money is being managed and how closely the activity connects to a transaction.
4. Do you assist with equity or debt financing?
Helping organise, plan or execute equity or debt financing for a company or legal arrangement can fall within the professional designated services.
This could arise during:
- Business acquisitions
- Capital raising
- Corporate restructures
- Debt arrangements
- Funding connected with a trust or company structure
General financial reporting may not be enough to trigger this category. However, active involvement in organising or executing the financing should be reviewed.
5. Do you sell or transfer shelf companies?
If your firm sells or transfers a ready-made or “shelf” company, that activity is specifically relevant under Tranche 2.
This is different from helping a client with ordinary annual compliance for an existing company. It concerns the provision or transfer of a company prepared for use by another party.
6. Do you help create or restructure companies, trusts or other legal arrangements?
Company and trust establishment services are a clear area of focus.
Your firm may be captured if it assists with:
- Creating a company
- Establishing a trust
- Restructuring an existing entity
- Planning changes to ownership or control
- Organising a legal arrangement for a client
A firm that regularly provides entity formation or restructuring services should treat its AML/CTF assessment as urgent.
7. Do you act as a director, secretary, trustee or attorney?
Providing key officeholder services can also trigger the regime.
This includes acting, or arranging for another person to act, as:
- A company director
- A company secretary
- A trustee of an express trust
- An attorney for a company or legal arrangement
- A person in a similar role within another legal structure
These services can give a provider significant influence over an entity’s operation, ownership or assets. That is why they attract additional regulatory attention.
8. Do you provide nominee shareholder services?
Acting as a nominee shareholder, or arranging for someone else to act in that role, is another designated service.
If your practice provides nominee or ownership-holding arrangements, you should not assume that existing client onboarding processes are sufficient. The ownership and control structure must be understood and documented.
9. Do you provide a registered office or business address?
Providing a registered office address or principal place of business address for a company or legal arrangement can also bring a firm within Tranche 2.
This may be relevant where your practice offers company administration packages that include an address service.
What obligations begin when you are captured?
Becoming a reporting entity creates a broader compliance program, not just a new form to complete.
If your firm provides a designated service, your obligations generally include the following.
Do you need to enrol with AUSTRAC?
Yes. A captured business must enrol with AUSTRAC through AUSTRAC Online.
The initial enrolment period for existing Tranche 2 businesses ran from 31 March 2026 to 29 July 2026. If your firm was already providing a designated service and has not enrolled, do not treat the missed date as an exemption. Confirm your position with AUSTRAC and act promptly.
The legal entity that actually provides the designated service needs to be identified. This matters for groups where different companies, partnerships or trusts provide different services.
Do you need a written AML/CTF program?
Yes. You need a documented program that is appropriate for your business and risk profile.
Your program should address matters such as:
- Your money laundering, terrorism financing and proliferation financing risks
- The clients and industries you serve
- The types of transactions you support
- Governance and accountability
- Customer due diligence procedures
- Escalation and suspicious matter processes
- Staff training
- Record-keeping
- Program testing and review
A template can provide a useful starting point, but a generic document won’t demonstrate that your firm understands its own risks. Your program should reflect how your Melbourne practice actually operates.
Do you need to identify and verify clients?
Yes. Customer due diligence, often called KYC, becomes a central part of the relationship.
Depending on the situation, this can involve:
- Identifying the customer
- Verifying the customer’s identity
- Understanding the nature and purpose of the relationship
- Identifying beneficial owners
- Assessing customer risk
- Applying additional checks to higher-risk clients
- Conducting ongoing due diligence when circumstances change
Your onboarding process should be consistent, repeatable and recorded. Staff should know when an application requires escalation rather than relying on informal judgement.
Do you need to report transactions or suspicious matters?
Potentially, yes. Reporting obligations depend on the activity your firm performs.
They can include:
- Suspicious Matter Reports, where a matter gives rise to a suspicion connected with money laundering, terrorism financing or other serious crime
- Threshold Transaction Reports, where applicable to cash transactions of AUD 10,000 or more
- International Funds Transfer Instruction reports, where applicable to cross-border transfers
The AUSTRAC transaction reporting guidance should be reviewed carefully. Your systems and staff need a clear path for identifying, escalating and submitting reports using the current AUSTRAC processes.
Do you need to keep records for seven years?
You need reliable records that demonstrate what you did and why you did it.
AML/CTF records can include:
- Client identification and verification records
- Beneficial ownership information
- Risk assessments
- Transaction records
- Suspicious matter decisions
- Training records
- AML/CTF program approvals and reviews
- Reporting information
Many AML/CTF records must be kept for at least seven years. Confirm the specific retention requirements for each record type and align them with your broader legal, professional and privacy obligations.
How does privacy law affect your AML/CTF processes?
More compliance information does not mean you can collect and retain everything.
The OAIC has issued updated guidance for reporting entities. From 1 July 2026, Tranche 2 entities such as accountants are brought within the Privacy Act for these purposes.
The OAIC guidance makes clear that firms should:
- Collect only personal information that is reasonably necessary
- Explain how personal information is handled through suitable privacy notices
- Protect identification and client information securely
- Avoid retaining full copies of identity documents solely for AML/CTF record-keeping
- Delete or de-identify information when it is no longer required, unless another law requires retention
Read the OAIC’s updated AML/CTF privacy guidance before changing your document collection process.
This is also where technology becomes practical. Your practice needs controlled access, secure storage, audit trails, retention rules, backup protection and reliable user management.
What should your accounting firm do this week?
A short service-mapping exercise is the best place to start.
Work through these steps:
- List every service line. Include services delivered by partners, contractors and related entities.
- Mark transaction-based work. Identify engagements involving property, business sales, financing, company structures or trusts.
- Review authority over client funds. Document whether your firm receives, holds, controls or transfers client property.
- Identify officeholder and address services. Include trustee, director, nominee and registered office arrangements.
- Confirm the legal entity involved. Determine which entity provides each designated service.
- Check your AUSTRAC enrolment status. If you may be captured and have not enrolled, obtain guidance immediately.
- Appoint an accountable compliance officer. Give that person clear authority and resources.
- Build your AML/CTF program. Include a firm-specific risk assessment, controls, training and review processes.
- Update your technology controls. Protect client data with strong access controls, multi-factor authentication, secure cloud systems and tested backups.
- Train your team. Staff should recognise unusual activity, know when to escalate concerns and understand tipping-off restrictions.
Can your IT systems support AML/CTF compliance?
Compliance depends on people and processes, but technology makes those processes dependable.
A secure practice environment can help you:
- Restrict sensitive client information to authorised users
- Maintain access and activity logs
- Protect identity documents and financial records
- Apply retention and deletion policies
- Secure cloud applications and email
- Recover quickly from a cyber incident
- Support remote staff without losing visibility
- Keep critical systems available during tax and reporting periods
Technology won’t decide whether a matter is suspicious, and an IT provider can’t replace legal or AML/CTF advice. But your systems should make it easier to follow your approved procedures consistently.
Whole IT provides managed IT services for Melbourne businesses, including proactive support, cloud services and cybersecurity controls. We also help professional services firms improve their technology foundations through IT support services and cloud solutions.
What is the main takeaway for Melbourne accounting firms?
Tranche 2 is live, but not every accounting practice is automatically a reporting entity.
Your firm should focus on the work it actually performs:
- Routine accounting work may not be enough on its own.
- Transaction assistance can change the analysis.
- Managing client money or property is a major trigger.
- Company and trust services are directly relevant.
- Enrolment, AML/CTF procedures, customer due diligence, reporting and records may all be required once you are captured.
- Privacy and cybersecurity controls must support the new processes.
The strongest next step is a documented service review. Know which services trigger the regime, identify the entity responsible and build a secure process before a compliance issue exposes a gap.
If your accounting firm needs help reviewing its IT environment, securing client data or preparing systems for stronger compliance processes, contact Whole IT for a practical conversation about your technology needs.