New Money-Laundering Rules Now Cover 100,000 Australian Small Businesses

On 1 July 2026, one of the biggest expansions of Australian business regulation in years quietly took effect. The anti-money-laundering and counter-terrorism financing regime, known as AML/CTF, which for two decades applied mainly to banks, casinos and money remitters, now reaches an estimated 100,000 businesses that had never been covered before. If you run an accounting practice, a real estate agency, a law or conveyancing firm, or you buy and sell precious metals or stones, you are almost certainly on the list. This is the long-discussed tranche two reform, and it is now live.

This matters because it is not a light-touch registration you tick off once and forget. It is a genuine, ongoing compliance obligation, and the clock is already running. AUSTRAC, the federal financial-crime regulator, opened enrolment for the newly covered services on 31 March 2026, and businesses that began providing those services from 1 July have until 29 July 2026 to enrol. That is a hard deadline, and it is close.

Enrolment is only the entry ticket. From there, the rules ask these businesses to actually know who their customers are and to prove it: verifying a client's identity before certain work begins, screening against sanctions lists, watching for and reporting suspicious activity, appointing a compliance officer at management level, and keeping detailed records for seven years. For a bank with a compliance department, that is business as usual. For a four-person conveyancing firm or a suburban accounting practice, it is a brand-new operational load landing on people who already have a full day.

Who is now in scope, and why it caught people off guard

The newly covered services span real estate agents and property developers, lawyers and conveyancers, accountants, trust and company service providers, and dealers in precious metals and stones, the local jeweller included. The common thread is that these are the professionals money tends to pass through when someone wants to move or hide it: a property settlement, a company formation, a large cash purchase. Australia was one of the last major economies to bring these gatekeeper professions under the rules, which is exactly why the change is so large, roughly 100,000 businesses at once, and why so many owners only discovered late that it applied to them. AUSTRAC and business.gov.au both carry the detail, and given the stakes it is worth confirming your exact obligations with them or your own accountant or lawyer rather than guessing.

The real cost is not the sign-up, it is the everyday grind

The enrolment is a one-off. The obligations are forever. Every new client now comes with an identity check that has to be done properly and evidenced. Every file has to carry the right records, held securely for seven years. Screening and monitoring are not one-time tasks either, they run quietly across the whole life of the relationship. Done on paper, or bolted onto an already busy front desk, this is precisely the kind of repetitive, high-stakes admin that swallows hours and, worse, gets done inconsistently. Inconsistency is where a breach hides, and the penalties for getting AML/CTF wrong are serious.

Here is the part worth sitting with. The businesses that will feel this least are not the ones with the most staff. They are the ones that build the checking and record-keeping into how a new client is taken on, so it happens the same way every single time without a person having to remember each step. That is a systems problem, and it is a solvable one.

What good looks like once this is handled properly

You do not need to become an AML expert to see the shape of the answer. The goal is not to bury your team in a new manual checklist on top of the real work. It is to design the obligation into your onboarding once, so compliance happens as a by-product of taking on a client rather than as a second job. Handled well, this is what that looks like:

• New clients are brought on through one smooth flow where identity verification happens as a natural step, not a scramble after the fact.
• The records the rules require are captured, organised and retained automatically, so a seven-year trail exists without anyone building it by hand.
• Routine screening and monitoring run quietly in the background and surface only the handful of things a human actually needs to look at.
• The busy front desk is freed from remembering a compliance checklist on every job, because the system remembers it for them.
• When AUSTRAC or an auditor asks, the evidence is already there, tidy and complete, instead of being reconstructed under pressure.

The firms that stay calm through this will not be the ones with the biggest compliance teams. They will be the ones who turned a new obligation into a quiet, repeatable system and got back to their clients.

The rules are not optional and they are not going away. But the sensible response is not to hire a person just to shuffle paperwork, or to hope a spreadsheet holds it together. It is to treat the ongoing obligation as a process to be designed once and run reliably, so the checks and the records take care of themselves while your people stay on the work that actually earns.

This is exactly the kind of fiddly, high-stakes, repeatable work NextAura is built to take off your plate. We design the client-onboarding and record-keeping systems and automations that make obligations like these run quietly in the background, wired into the tools you already use, so the verification and the paper trail happen every time without anyone chasing them. We build the systems, not the legal advice, that side stays with you and your adviser. If you would rather your onboarding just worked the way we have helped other firms hand their back office to reliable automation, get in touch and we will carry the building while you get back to your clients.