What happens if I don’t comply with Tranche 2? The real risks for small businesses

You know Tranche 2 is coming. You’ve read about it, maybe even briefly considered what compliance will look like or what areas of your business you need to look at. But somewhere in the back of your mind it still feels like “that problem for next year.” Now, we’re the first to say that these changes should be approached calmly and reasonably.  But at the same time, they are big changes and it’s worth considering what the impact of waiting just a bit longer could be.

If you’re in one of the Tranche 2 industries (real estate, legal, conveyancing, accounting, precious metals/stones or trust & company service providers), we wanted to give you an insight into the potential impacts if you don’t start taking action today. Hint: the costs aren’t hypothetical, and the consequences can hit small business hard.

Risks & consequences of non-compliance with AML obligations

At the moment, there are around 17,000 current reporting entities enrolled with AUSTRAC.  Come 2026 with Tranche 2 businesses coming under AUSTRAC’s remit, it is anticipated to be upwards of 100,000 enrolled entities.  Waiting too long will see you risk being non-compliant come July 2026, so now is the time to start educating yourself and taking the initial steps towards compliance.

Let’s look at the kinds of risks you’re facing by delaying your AML/CTF compliance work:

1. Financial Penalties

AUSTRAC has a suite of enforcement tools, and financial penalties are front and center. If businesses fail to meet AML/CTF obligations, for example by not enrolling prior to providing designated services or by failing to submit suspicious matter reports, AUSTRAC can and does impose fines and civil penalty orders. 
For instance, as recently as 2024, AUSTRAC issued infringement notices to sole traders and companies for non-lodgement of annual compliance reports. These fines range from a few thousand dollars for small operators up to much larger sums for bigger organisations.

2. Legal and Regulatory Action

Fines and financial penalties aren’t AUSTRAC’s only option when it comes to penalising non-compliance. In addition to this, they also have the power to:

• Seek civil penalty orders through the courts. 
• Issue remedial directions to force changes to your systems and processes. 
• Accept enforceable undertakings (essentially legal promises to fix the compliance issue). 
• Refuse, suspend or cancel registrations in some cases. 

3. Reputational Damage

This is often under-estimated until it’s too late.  Being named in AUSTRAC’s enforcement actions or “lists of enforcement actions taken” makes you and your business publicly visible. Once that’s out there in the public space, trust can be much harder to rebuild with new and existing customers. 

Clients, partners, or regulators might question your ability to handle risk or compliance. This can hurt referrals, licensing, insurance premiums, or even ability to win new business.

4. Operational & Business Disruption

Delaying enrolment and compliance means you’ll be rushing to build your policies, procedures, systems all at once. The risks of this delay include:

• Poorly designed processes that have holes or gaps.
• Staff confusion or mistakes if training is last minute.
• Systems overburdened (or simply unavailable) when you try to implement monitoring, reporting, or record-keeping.

5. Criminal Exposure

While most breaches are civil or administrative, there are circumstances under which criminal liability becomes possible, especially if breaches are wilful, reckless, or systemic. Individuals (including directors and compliance officers) may be personally exposed under the AML/CTF Act. 

AUSTRAC enforcement stories

Many of the industries impacted by Tranche 2 are already used to operating within regulated environments, whether through professional bodies, licensing regimes, or state-based legislation. But in many of those areas, enforcement action is relatively rare. It can create a false sense of security that if you do slip up, the most you’ll face is a warning, a “please fix this” letter, or perhaps a minor penalty.

AUSTRAC is a very different kettle of fish. It has a documented track record of taking meaningful enforcement action, even against businesses that might have thought of themselves as “too small to matter.” When AUSTRAC identifies systemic non-compliance, it uses infringement notices, enforceable undertakings, civil penalty proceedings, and in some cases even suspensions or cancellations to full effect.

Here are a few recent examples showing AUSTRAC enforcing non-compliance:

• AUSTRAC enforcement against Entain (owner of Ladbrokes, Neds): Launched in December 2024 for alleged systemic non-compliance, including failures in identity and assess AML risks, and inadequate oversight for high-risk customers. The parties are currently in mediation. 
• Mount Pritchard and District Community Club Ltd (“Mounties”): On 30 July 2025, AUSTRAC launched civil penalty proceeding in  the Federal Court for alleged serious and systemic non-compliance in relation to its AML/CTF program.  Of note, it specifically claimed that the program did not have an adequate risk assessment, appropriate staff training and appropriate risk based systems and controls.
• Infringement notices: AUSTRAC has issued notices to various businesses (companies and sole traders) for failing to comply with the AML/CTF obligations. 

These cases show that AUSTRAC is not only watching big financial institutions, but that businesses of all sizes are in scope when obligations are breached. 

Why you need to start your AML compliance now, not later

Here are arguments for greater urgency, and the things small businesses often overlook until it’s too late.

Avoid a last-minute reactive scramble

Starting early gives you time to map out what compliance will mean for your business.  Specifically, your services, customers, systems. If you wait, you’ll be rushing to hire people, write policies, set up monitoring, train staff… all under pressure. Mistakes, gaps, or overlooking something vital are much more likely, and fixing those under stress costs more (in money, time, reputation).

Leverage learning time

When compliance isn’t urgent, you can take the time to attend webinars and information sessions, test your AML risk assessment, try out transaction monitoring methods, see where you struggle, iterate policies, adjust for your staff’s workflows. That means when Tranche 2 enforcement arrives, you’ll be ready, not surprised.

Save money (on both direct and hidden costs)

Implementing in a rush often means paying premium rates for consultants, tech and training. Plus, the cost of non-compliance (penalties, remediation, legal fees) is almost always much higher than the investment in getting ahead.

Protect your reputation and trust

For many Tranche 2 businesses, relationships built on referrals and trust are everything. Being “named” for non-compliance (even just for failing to lodge reports or improper customer due diligence) can damage your standing, affect client confidence, and have long tail effects in how professional peers, regulators, or insurers view you.

Legal and regulatory certainty

Even though Tranche 2 takes effect 1 July 2026, the rules have already been published. Some obligations (like registering, risk assessment, reporting requirements) are or will be enforceable under current regimes. Delaying may mean breaking laws before your business is fully ready, with no excuse for “we didn’t know.” Ignorance won’t shield you.

What you can do now to prepare for Tranche 2 compliance

With upwards of nine months left until you’re required to comply, here is a step-by-step plan to help you reduce risk and get ahead, in measured, manageable stages.

The bottom line on Tranche 2 compliance preparation 

You don’t want to wake up one morning in mid-2026 and realise you’re non-compliant. The legal, financial, reputational, and operational risks are real for businesses of all sizes.

If you’re aware of Tranche 2, but not in much greater detail other than knowing it’s coming, the best thing you can do is start preparing now. Even just beginning with a risk assessment or appointing someone responsible makes a difference.  Taking small steps now will make the transition much less stressful, and reduces risk of nasty surprises.

Want help making sure you’re on track?

We’re running regular webinars aimed specifically at Tranche 2 SMEs.  These sessions will look at what you should have in place to be ready and how our end-to-end solution can help you meet your AML compliance obligations with ease. Register now and hear from our AML experts, so you can move from overwhelmed and unsure to confidently ready.