For the first time in the nearly two decades since the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act) was passed, Australian law firms are reporting entities in their own right. The long-anticipated "Tranche 2" reforms commenced on 1 July 2026, and the first hard deadline is now days away: firms that provide a designated service must be enrolled with the Australian Transaction Reports and Analysis Centre (AUSTRAC) by 29 July 2026.

The change is not a future planning exercise. As of 1 July, obligations that have applied to banks, casinos and remittance providers for years now attach to close to 100,000 newly regulated businesses — lawyers, conveyancers, accountants, real estate agents, precious-metals dealers, and trust and company service providers among them. For many practices, the practical question is no longer whether the regime applies, but how quickly they can demonstrate compliance.

What actually changed on 1 July

Under the reforms, a law firm becomes a reporting entity if it provides a prescribed "designated service". The Law Council of Australia, in guidance released on 30 June 2026, pointed to real estate and corporate transactions, equity and debt financing, corporate restructuring, and the handling of client money as examples of work that can bring a practice within scope. Company and trust formation services are also captured.

Crucially, the obligation attaches from the moment a designated service is provided — not from a later compliance milestone. In AUSTRAC's framing, a firm that acted on a captured matter on 1 July without customer due diligence in place has already created a compliance gap rather than a future risk.

The 29 July deadline and what sits behind it

Enrolment opened on 31 March 2026, and regulated practices must complete it by 29 July 2026. Firms must also appoint an AML/CTF compliance officer and notify AUSTRAC of that appointment by the later of 29 July or 14 days after enrolling.

Enrolment, though, is only the visible tip. Behind it sit the substantive obligations: a board-approved, risk-based AML/CTF program tailored to the firm's services and client base; customer due diligence (CDD) covering both identity verification at onboarding and ongoing monitoring of the relationship; source-of-wealth checks in specified circumstances; suspicious matter reporting; and seven-year record-keeping. Newly regulated entities must also arrange an independent evaluation of their program, with the first review due between 30 June 2029 and 31 December 2030, depending on the firm's AUSTRAC account number.

The tipping-off trap

One obligation that is genuinely new territory for many practitioners is the prohibition on "tipping off". Where a firm reports a suspicious matter to AUSTRAC, it must not inform the client that a report has been made. The Law Council has warned that if tipping off occurs, the practice will need to cease acting for that client and seek legal and ethical advice. Sitting alongside long-standing duties of client confidentiality and candour, the rule demands careful handling, and it is exactly the kind of scenario firms should game out before, not after, it arises. The amending legislation also clarifies the treatment of legal professional privilege, preserving the doctrine while enabling firms to meet their reporting obligations.

How AUSTRAC is likely to approach the first months

AUSTRAC has signalled a measured opening posture, indicating it will prioritise enforcement against entities that wilfully ignore their obligations or are complicit in — or wilfully blind to — money laundering, rather than firms making genuine, good-faith efforts to comply. That is reassurance, not amnesty: the regulator's civil penalty powers apply to newly regulated entities in the same way they apply to any other reporting entity, and closing a gap after the fact does not undo the exposure created while it existed.

Managing these obligations at scale — verifying clients, screening against sanctions and politically exposed person (PEP) lists, and keeping defensible records — is where firms are now investing, and platforms such as Legl are built to help legal teams run client due diligence and record-keeping in one place.

Key Takeaways

• Enrol by 29 July 2026 if your practice provides a designated service — the obligation is already live, not pending.
• Confirm your scope using the Law Council's 30 June 2026 guidance on designated services, and document your reasoning even if you conclude you are out of scope.
• Appoint your AML/CTF compliance officer and notify AUSTRAC by the later of 29 July or 14 days after enrolling.
• Get CDD running now — identity verification, sanctions and PEP screening — even while the full written program is being finalised.
• Brief your fee-earners on tipping off and the steps to take if a suspicious matter arises.

Looking Ahead

The 29 July enrolment deadline is the first checkpoint, not the finish line. Over the coming months, attention will turn to the quality of firms' AML/CTF programs and their first suspicious matter reports, and the Law Council has said it will monitor the reforms' impact and continue working with Government on any unintended consequences. Practices that treat enrolment as the start of an ongoing operational compliance capability — rather than a one-off registration — will be best placed as AUSTRAC's expectations sharpen through the remainder of 2026.

Sources

• Law Council of Australia — Law Council releases guidance to help legal profession navigate new AML/CTF regime (30 June 2026)
• AUSTRAC — Newly regulated businesses: get ready for reforms
• Queensland Law Society (Proctor) — Queensland law firms encouraged to enrol as new AML/CTF laws start (July 2026)

‍