The AML deadline passed. Now the real work starts

Six weeks into Australia’s expanded anti-money laundering regime, a comfortable story is circulating through advice, accounting and law firms. AUSTRAC has said it will not expect perfection in year one, so the harder work on AUSTRAC compliance can wait until the guidance settles.

Catherine Evans, founder and head of legal at Kit Legal, hears that story most weeks. She thinks firms have taken half of what the regulator said and left the rest on the table.

“I keep hearing the same thing, we’ve got time, AUSTRAC isn’t going to come after small firms in the first year,” Evans says.

“That’s not what the regulator said. It said it doesn’t expect perfection early, it didn’t say it expects nothing, and its patience is for firms making an honest effort, not for firms doing nothing at all.”

What the regulator promised, and what it attached

AUSTRAC chief executive Brendan Thomas set the tone for the new cohort well before the start date.

“We do not expect newly regulated businesses to be expert at identifying and controlling money laundering risks from day one,” he told a 2025 summit of real estate agency leaders, adding that where businesses make genuine efforts to meet their obligations, “we’re not looking to throw the book at people on day one”.

He named the exceptions in the same breath. AUSTRAC would direct its enforcement effort toward businesses that wilfully ignore the duty to enrol, or that make no meaningful effort to comply.

Evans reads those two statements as a single instruction rather than a concession.

“There’s a big difference between a firm still working through its controls and a firm that has filed nothing and is hoping the deadline was soft,” she says. “The first is exactly what AUSTRAC asked for, while the second is what it’s looking for.”

Advice firms did not start from zero on 1 July

Many advice businesses have carried AML obligations since the AML/CTF Act first took effect, because arranging for a client to receive a designated service counts as a designated service in its own right. They enrolled once, ticked that single item, and got on with running the practice.

What happened on 1 July widened the field rather than opening it. Lawyers and conveyancers, accountants, real estate agents, dealers in precious metals and stones, and trust and company service providers all became reporting entities, and AUSTRAC expects roughly 80,000 businesses to fall inside the expanded perimeter.

Anyone starting to provide designated services from that date had 28 days to enrol and to name an AML/CTF compliance officer, which put the first hard deadline in late July.

The quieter problem belongs to the firms that enrolled years ago and assumed the paperwork still held.

A practice that registered as a straightforward advice business in 2010 might now run managed accounts, own an accounting arm and refer clients through a related mortgage business. Its AUSTRAC record shows none of that.

Law firm Hamilton Locke made the same observation after March’s letter, noting that plenty of wealth businesses carry one designated service on their enrolment while providing several others in the course of ordinary work.

An enrolment that describes a business you stopped running years ago protects nobody. It documents the wrong firm.

Zero is doing a lot of work

The assumption that regulators stay quiet in year one already runs against the evidence. In March, AUSTRAC wrote to the wealth management sector about how little it reports, and the arithmetic was unflattering.

Around 98 per cent of enrolled wealth businesses lodged no suspicious matter reports at all during 2025. Three businesses accounted for 64 per cent of everything the sector filed. And 92 per cent told the regulator they had no high-risk customers on their books.

AUSTRAC described the result as an unacceptable blind spot.

“That’s not a regulator waiting quietly for twelve months, that’s a regulator already telling firms it’s watching,” Evans says.

“1 July was the start line, not the finish line.”

AUSTRAC compliance: what honest effort looks like on paper

Evans frames the year-one test as evidence rather than completion. A firm should know which of its services count as designated services, and it should enrol for each one it provides. It should hold a risk assessment built around its own clients, products and delivery channels, rather than a template downloaded and left in a folder. Customer due diligence should run continuously instead of stopping at onboarding.

The fourth marker carries the most weight. A firm should be able to point to the decisions it has made and explain why it made them. Reasoning that lives only in a principal’s head reads, to a supervisor, exactly like reasoning that never happened.

The odds argument, and where it breaks

There is a fair counter-argument doing the rounds, and it deserves a straight answer. AUSTRAC now supervises tens of thousands of newly regulated businesses with finite resources, so the chance of any one small practice facing a year-one review looks slim. As arithmetic, that holds up.

It misreads how scrutiny usually arrives. Supervisory interest rarely opens with a random audit of a small firm. A name surfaces in another reporting entity’s suspicious matter report, in a law enforcement referral or in a client dispute, and the request for documents follows from there. By that point the firm cannot build a record, only produce one.

The harder constraint is the one both sides skip. Working out which services are designated services inside a mixed practice takes real judgement, and AUSTRAC’s guidance keeps developing, so a position documented in July may need revisiting by Christmas.

That argues for writing the reasoning down while the thinking is fresh, rather than waiting for certainty that will not arrive on a convenient schedule.

“Most firms I speak to want to do the right thing,” Evans says. “The risk is delay. Assuming there’s more runway than there is, and being caught flat-footed when the questions start.”

Built to run, not to finish

The regime rewards firms that treat AUSTRAC compliance as an operating habit rather than a filing exercise, because the obligations repeat. Risk assessments need reviewing, controls need testing, and reporting needs to happen when something looks wrong.

“The firms that come through this well won’t be the ones that scrambled to enrol and then stopped,” Evans says. “They’ll be the ones that treated it as part of how they run the business.”

AUSTRAC’s first contact with most firms will take the form of a request for documents. The answer a practice can hand over that day is the one it started writing in July.