Suspicious matters: What actually triggers a report under Tranche 2

For many businesses preparing for Tranche 2 AML/CTF obligations, there’s one area creating more uncertainty than almost anything else:

Suspicious Matter Reports (SMRs). The concern usually falls into one of two camps. Either "What if we miss something and should have reported it?" or "What if we start reporting everything and create unnecessary work?". Both concerns are understandable. When people hear the word suspicious, they often assume it means obvious criminal activity or hard evidence of wrongdoing. But it’s important to understand that under the AML/CTF framework, that isn’t what suspicion means at all.

What “suspicious” actually means

One of the biggest misconceptions around Suspicious Matter Reports is the idea that businesses are expected to prove criminal activity. Let’s make it clear right off the bat: They aren’t. Under the AML/CTF framework, the threshold is reasonable grounds for suspicion, not certainty. That means your role is not to investigate, gather evidence or prove intent. Instead, your role is to recognise when something doesn’t make sense in the context of the customer, the transaction, their behaviour or the risk profile you've established for them.

Think of it as asking:

"Does this fit with what I would reasonably expect based on what I know about this client and matter?"

If the answer is no, that does not automatically mean an SMR must be lodged, just that further consideration is required.

What does not automatically trigger a report

This is where many businesses breathe a sigh of relief. Not every unusual circumstance equals suspicious activity. For example:

• A client being nervous during onboarding
• A customer asking several questions about privacy
• A transaction involving a large amount of money
• Someone wanting a matter completed quickly

On their own, none of these things necessarily indicate money laundering or terrorism financing, so understand that context matters. A property transaction involving a large amount of money may be entirely normal and urgency may simply reflect settlement deadlines. Questions about privacy (especially in this day and age) can be perfectly reasonable.

What regulators expect is that businesses consider the circumstances, apply judgement and document their reasoning (whether they decide to lodge an SMR or not).

Real examples for newly regulated industries

The easiest way to understand suspicion is through realistic scenarios. These examples do not automatically require reporting, but they should prompt closer consideration and internal escalation.

Real estate and conveyancing

A buyer wants the funds for their purchase to be transferred through an unrelated third party and becomes evasive when asked why. Or perhaps ownership arrangements change repeatedly throughout a transaction without a clear explanation.

Individually, there may be innocent explanations. But together, these inconsistencies may warrant further review.

Legal practices

A legal client wants assistance establishing multiple entities and trusts but struggles to explain their commercial purpose. This may simply be lack of knowledge or perhaps it could be something more. Or perhaps you have a client where instructions appear to be coming from someone other than the person formally engaging the firm.

Again, none of these automatically mean criminal activity, but they do indicate that additional information should be gathered.

Accounting firms

A client with a relatively straightforward profile suddenly introduces complex ownership structures or overseas entities with no clear rationale. If the proposed structure appears inconsistent with the customer's circumstances or objectives, that may justify further escalation.

Patterns like this can create risk indicators that warrant further consideration.

Internal escalation comes before external reporting

One area that often creates confusion is the difference between escalating concerns internally and lodging an SMR externally. They are not the same thing. In most businesses, front-line staff will not be making final reporting decisions. Instead, once they identify concerns, they need to escalate them internally to a Compliance Officer or designated decision-maker in accordance with the business’s AML Program.

That process might look like:

Staff member notices unusual activity → Internal escalation → Further review → Decision made on whether an SMR is required.

This is important because not every escalation results in a report. The goal is to ensure potential issues are recognised and assessed consistently, not to encourage over-reporting.

The decision not to report matters too

This is one of the most overlooked parts of the process. Many businesses understand the need to document why they did lodge an SMR. Far fewer realise they should also document decisions not to lodge one.

For example, imagine you run a real estate agency and your team notices unusual urgency around a particular transaction. Following further discussion, it becomes clear the client is relocating interstate for work and facing strict timing pressures. Your team escalates the matter internally to you for review, additional information is collected and the concern is resolved. No SMR is lodged in this case.

That outcome may be completely reasonable. But if the matter was ever reviewed later, the business should be able to demonstrate:

• what concern was identified
• what additional information was obtained
• who reviewed the matter
• why the decision not to report was made

Without that documentation, it can appear as though the concern was never considered at all.

Record-keeping expectations under Tranche 2

Under AML/CTF obligations, your records are critical. Businesses need to maintain documentation around:

• Concerns raised and internal escalation processes
• Decisions made, based on the supporting information gathered
• Any reports submitted
• The reasoning behind any outcomes to lodge or not lodge an SMR

The reason for this is to create an audit trail showing that your business followed its own process. Because if AUSTRAC ever asks, 

"Why wasn't this matter reported?", you want to be able to answer confidently, with evidence (not from memory).

Suspicion is about judgement, not certainty

One of the biggest mindset shifts under Tranche 2 is recognising that AML compliance isn't about proving wrongdoing. That’s AUSTRAC’s job and the job of law enforcement. Instead, the role of Tranche 2 businesses is to identify situations that warrant further consideration. You are not expected to become investigators.

Managing suspicious matters manually can quickly become difficult, particularly as time goes on and businesses grow and workloads become larger. easyAML helps businesses structure escalation pathways, document decision-making, maintain audit trails and support reporting workflows within one platform.

You can get started for free, with no lock-in contracts, no credit card required and no commitments.

Get started at https://easyaml.com/get-started/