Your AML/CTF checklist: what you can start doing now to be ready in 2026

Tranche 2 is no longer something to prepare for. It's already here, and AUSTRAC enforcement is live. If your business operates in real estate, conveyancing, law or accounting, this checklist walks through exactly what you need in place, and what needs to stay in place as your business changes.

What's changed now that Tranche 2 is in effect?

Enrolment for newly regulated businesses closed on 29 July 2026. If your business hasn't enrolled with AUSTRAC yet, we hate to break it to you, but you're already behind.

Enforcement options now range from infringement notices and enforceable undertakings through to civil penalty orders and, in serious cases, criminal referral, with penalties reaching into the millions of dollars for serious breaches.

These aren't theoretical numbers reserved for big banks, they apply to any regulated business that fails to meet its obligations — and AUSTRAC has wasted no time handing out issue notices.

Who do these AML/CTF obligations apply to?

Tranche 2 captures a wide range of professional services, including real estate agents, conveyancers, lawyers, accountants and tax agents. If your business provides a designated service, you're likely in scope. That can include:

• Buying or selling property on a client's behalf
• Managing client funds or accounts
• Forming, managing or administering companies and trusts

Not every part of a business is captured, and coverage varies by the specific services offered. If you're unsure whether your work falls inside the rules, it's worth checking now rather than assuming you're exempt.

The AML/CTF basics checklist your business needs to comply with

Enrol with AUSTRAC

This is the starting point for every other obligation on this list. If you haven't enrolled yet, do it immediately. Enrolment involves registering your business, outlining your designated services, and providing key business details to AUSTRAC.

Appoint your AML/CTF Compliance Officer

Every regulated business needs someone accountable for compliance. This doesn't need to be a dedicated hire or a legal specialist. It's usually an existing team member, often a director or senior manager, who takes ownership of the program and reporting.

Complete your ML/TF risk assessment

Before you write a program, you need to understand your risk. A proper risk assessment looks at your clients, the services you offer, how you deliver them, and the jurisdictions you operate in. This forms the foundation for everything else.

Write your AML/CTF program

Your program is the written, risk-based document that sets out how your business identifies and manages money laundering and terrorism financing risk. It needs policies, procedures and controls that actually reflect how your business operates, not a generic template.

Run customer due diligence before providing a designated service

Before you act for a client, you need to verify who they are. This includes identity checks, and for company or trust clients, confirming beneficial ownership. Higher-risk clients, such as those based overseas or using complex structures, need enhanced checks.

Deliver staff training and evidence it

Anyone in your business handling client work needs to understand red flags and reporting steps. It's not enough to run training once, unfortunately. You need records showing who was trained, when, and on what.

Set up record-keeping that meets the 7-year requirement

Every risk assessment, verification, and report needs to be retained for at least seven years. This applies whether or not a client's file is ever flagged.

Build your reporting process for SMRs, TTRs and IFTIs

Your process needs to make it clear who's responsible for identifying and lodging these:

• Suspicious Matter Reports when something looks unusual
• Threshold Transaction Reports for cash transactions over $10,000
• International Funds Transfer Instructions, depending on the transactions your business handles

Your ongoing AML/CTF compliance checklist

Getting set up is only half the job. AML/CTF compliance is ongoing, and that's exactly where easyAML keeps things manageable: your program stays current without you having to track every change yourself.

Review and update your risk assessment

Review your risk assessment as your client base, services or business structure change, and at regular intervals regardless.

Ongoing due diligence and re-verification triggers

Client checks don't stop at onboarding. Certain events, such as a change in ownership structure or a long gap since the last check, should trigger re-verification.

Enhanced due diligence when a client's risk changes

If a client's circumstances shift, a new director is appointed, or a red flag appears, their risk level may need to be reassessed and additional checks applied.

Transaction monitoring

Ongoing monitoring helps you spot activity that doesn't match a client's expected behaviour, which is often the first sign something needs a closer look.

Refresher training and new-starter onboarding

New starters need onboarding before they handle client work, and existing staff need refreshers as obligations or risks evolve.

Keep your program current as the rules change

AUSTRAC's rules and guidance will continue to evolve. Your AML/CTF program needs to be reviewed and updated to reflect any changes, not left as a static document from your original setup.

Independent evaluation of your AML/CTF program

Periodically testing whether your program is actually working, rather than assuming it is, helps you catch gaps before AUSTRAC does.

Update your AUSTRAC enrolment when your business changes

If your business structure, services or key personnel change, your AUSTRAC enrolment details need to be updated to match.

Speed up compliance with AML/CTF software

At easyAML, we know running through this checklist manually takes real time. According to the Attorney-General's Department, the average ongoing cost of AML/CTF compliance sits around $23,250 a year per business, once you factor in admin time, consultants, software and training.

AML/CTF software like easyAML's all-in-one Tranche 2 platform brings the whole list above into one place, including:

All of it sits in a single system, rather than being pieced together across spreadsheets, consultants and separate tools.

If you'd rather hand the day-to-day checks over entirely, AML on Demand lets a dedicated team run verification and screening on your behalf, while you retain approval and sign-off on every outcome.

Find out more about how easyAML can keep you compliant

This checklist covers what AUSTRAC expects, but it doesn't need to be something your business builds from scratch or manages alone. easyAML is purpose-built for Australian businesses navigating Tranche 2, with step-by-step guidance, local support and no compliance experience required.

Get started for free and see what your Tranche 2 program could look like within the week.