AUSTRAC Tranche 2 deadline 1 July 2026 — AML/CTF compliance checklist for Australian businesses

Operating as a reporting entity without a compliant AML/CTF program after 1 July 2026 is a contravention of the AML/CTF Act. Civil penalties under Part 15A can reach $22.2 million per contravention for body corporates and $4.44 million for individuals. AUSTRAC has signalled active supervision of Tranche 2 industries from commencement. There is no announced grace period. In serious cases, AUSTRAC can also seek criminal referrals to the Australian Federal Police.

AUSTRAC has not announced any blanket extension to the 1 July 2026 commencement date. The AML/CTF Amendment Act 2024 confirms the date. Businesses that engage proactively and demonstrate good-faith compliance efforts may receive some supervisory flexibility in early enforcement, but this is at AUSTRAC's discretion and cannot be relied on as a substitute for having a program in place.

Under s 81 of the AML/CTF Act and the AML/CTF Rules, a complete program typically covers: (1) AML/CTF Program document (Part A — governance and systems, Part B — CDD procedures), (2) ML/TF Risk Assessment, (3) Customer Due Diligence Policy, (4) Enhanced CDD Policy, (5) Simplified CDD Policy, (6) SMR Procedures, (7) TTR Procedures, (8) Record-Keeping Policy, (9) Ongoing Monitoring Policy, (10) Staff Training Program, (11) Compliance Officer Role Description, (12) PEP and Sanctions Screening Policy, and (13) Annual Compliance Report Template. AutoAML generates all 13 from your onboarding questionnaire.

AUSTRAC uses a graduated enforcement approach under Part 15A of the AML/CTF Act: informal engagement and guidance for early minor issues, infringement notices for specific contraventions, enforceable undertakings requiring corrective action, Federal Court civil penalty orders for significant or persistent non-compliance, and criminal referrals to the AFP in the most serious cases. AUSTRAC also has powers to issue notices to produce information, conduct on-site inspections, and publish enforcement outcomes.

An ML/TF Risk Assessment is required under Chapter 3 of the AML/CTF Rules. It is a documented analysis of the money laundering and terrorism financing risks posed by your: (a) customer types — individuals, companies, trusts, PEPs, foreign nationals; (b) designated services provided; (c) delivery channels — face-to-face, online, through intermediaries; and (d) geographic exposure — domestic versus international transactions. The assessment must rate each risk category, explain the controls in place to mitigate it, and be reviewed at least every three years or on material change.

Not necessarily. AUSTRAC's published guidance, the AML/CTF Rules, and the Act itself provide sufficient detail for a structured platform like AutoAML to generate a compliant program tailored to your business. Many businesses — particularly small and mid-size professional practices — have used AutoAML to build and adopt a compliant program without a consultant. However, if your business has complex ownership structures, cross-border operations, or significant high-risk customers, independent legal review of the final program is worthwhile.