New AML rules for accountants and real estate agents

This is general information, not legal advice. Check your own position with AUSTRAC’s guidance or your professional body.

Tranche 2 of Australia’s anti-money laundering rules started on 1 July 2026. AUSTRAC said it was preparing to bring around 80,000 new businesses under the rules. If your firm provides one of the listed services, such as helping a client buy property, set up a company or act as a trustee, you now have AML/CTF obligations and must be enrolled with AUSTRAC.

Most of the work that follows is checking, chasing and record keeping. That part can be automated, and I cover what I’d automate for accountants and law firms further down. The judgement calls stay with you.

The two dates and the four duties.

What changed on 1 July 2026

Until this year, the AML/CTF rules mostly covered banks, remitters and gambling businesses. The 2024 amendments added “tranche 2” businesses: lawyers, accountants, conveyancers, real estate agents, trust and company service providers, and dealers in precious metals and stones.

The key dates, as published by AUSTRAC and summarised by the Law Society of NSW and Pitcher Partners:

• 31 March 2026: enrolment with AUSTRAC opened.
• 1 July 2026: obligations started. Your AML/CTF program and the roles in it had to be in place by this date.
• 29 July 2026: the last day to finish enrolling for firms that were already providing a designated service on 1 July.

If you haven’t checked whether your firm is captured, do that first. AUSTRAC has a tool for it, and the Law Society of NSW suggests keeping a record of your assessment even if you find you’re not captured.

Is your firm captured?

Being a lawyer or an accountant doesn’t capture you on its own. What matters is whether you provide a “designated service” in the course of business, to a customer, with a link to Australia. The services that trigger it include:

• helping a client buy, sell or transfer real estate
• helping a client buy, sell or transfer a company or a trust
• receiving, holding or managing a client’s money or property in a transaction
• setting up or restructuring a company, trust or other arrangement
• acting as, or arranging, a director, secretary, trustee or nominee shareholder
• providing a registered office address for a company

The Law Society of NSW points out that obligations can start during the preparation for a transaction, before the transaction itself. Tax returns and general bookkeeping on their own are outside the list, but many practices do at least one of the items above for some clients.

What you have to do now

• Enrol with AUSTRAC.
• Keep an AML/CTF program that sets out your risks and how you manage them, with named roles.
• Name a compliance officer at management level. In a small firm that is often a principal or partner.
• Check your customers before you provide the service, and keep checking while you act for them.
• Report suspicious matters to AUSTRAC, and report to AUSTRAC each year.
• Keep records of who you checked, what you saw and what you decided, for seven years.
• Arrange an independent evaluation of your program at least once every three years.

Which checks can be automated

In a small practice the burden is rarely the rules themselves. It’s the admin: asking each client for ID, chasing the ones who don’t reply, and keeping a register that’s up to date when someone asks. These are the jobs I’d automate first:

• The ID request. When a new matter or engagement is opened for a captured service, the client gets a request with a secure upload link, in your words.
• The chase. If nothing arrives, polite reminders go out on a set schedule. Your staff only see the clients who still haven’t replied.
• The register. Each check is logged: who, when, what was provided and who reviewed it. That’s the record you need when AUSTRAC or your evaluator asks.
• The review dates. Ongoing due diligence needs a date. The system flags clients due for a fresh look, so it doesn’t rely on memory.
• The first draft of the file note. The client’s answers are set out in your template, ready for you to assess.

This is the kind of work I set up as part of the automation that runs after a client comes in.

What stays with a person

Three things should never be left to software:

• The risk decision. Whether a client is low or high risk is your professional call.
• Suspicious matter reports. Deciding to report, and what to say, stays with the person named in your program.
• Your program. Software can hold it and remind you to review it. You sign it off.

One more point on privacy. ID documents are personal information. The OAIC’s guidance is that you shouldn’t enter personal information into public AI chatbots. Any automation should keep client documents inside systems you control and have approved.

For real estate agents

Agents are in tranche 2 too, mainly for helping clients buy or sell property. The same pattern applies: the ID request, the chase and the register can be automated, and the risk call stays with you. If you’re an agent, my Melbourne SEO page covers the other half of the work, getting found.

Where to start

Map which of your services are on the list, and how many clients a month that touches. If it’s a handful, a checklist may be enough. If it’s dozens, the chasing alone is worth automating. Getting found by the right clients in the first place is the other half, and that’s what my Get found work covers.

If you’d like a second pair of eyes, the free snapshot looks at the one job costing your firm the most time and tells you if automation can take it. I’ll also tell you plainly if it can’t.

Related guides

A page on the AML rules for accountants works best alongside a healthy site. These guides go deeper on the parts that deserve their own page.