For the first time in the two decades since the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — the AML/CTF Act — was passed, Australian law firms are now regulated entities. The long-anticipated "Tranche 2" reforms commenced on 1 July 2026, extending the regime to lawyers, accountants, conveyancers, real estate professionals, precious-metals dealers and trust and company service providers. Captured firms that were providing designated services from day one were required to enrol with the Australian Transaction Reports and Analysis Centre (AUSTRAC) within 28 days — a deadline that fell on 29 July 2026 and has now passed.

That makes the current moment a genuine inflection point rather than another item on a distant compliance calendar. An estimated 80,000 newly regulated businesses have been drawn into the regime, and for many legal practices the past six weeks have been the first real test of whether their preparation translates into working compliance. This piece looks at what actually changed, who is captured, the obligations now in force, and what compliance officers should be watching as the regime beds in.

What changed on 1 July

Tranche 2 completes an expansion that Australia first committed to more than fifteen years ago and that the Financial Action Task Force (FATF), the global standard-setter for anti-money-laundering rules, has repeatedly flagged as an outstanding gap. The reforms were enacted through the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth), which amended the 2006 Act to bring "designated non-financial businesses and professions" — the international shorthand for exactly these sectors — within scope.

The trigger for a law firm is specific. Under the amended Act, a practice becomes a reporting entity if it provides one or more designated services with a geographical link to Australia in the course of carrying on a business. Providing legal services alone does not capture a firm; providing a designated service does.

Who is actually captured

This is the question that has dominated the profession's preparation, and it is not always straightforward. AUSTRAC published core guidance on 20 October 2025 to help practitioners work through whether their services are captured, and the Law Council of Australia followed with detailed profession-specific guidance in late June 2026, on the eve of commencement. State bodies including the Law Society of New South Wales have built dedicated AML/CTF hubs and issued implementation guides for sole practitioners and small practices.

Broadly, the designated services most relevant to law firms include assisting with buying and selling real estate, managing client money or assets, acting in the buying or selling of a body corporate or business, providing equity or debt financing, and providing trust and company service-provider functions such as acting as (or arranging for a person to act as) a company director or trustee. A commercial-property or corporate-transactions practice is far more likely to be captured than, say, a criminal-defence or personal-injury practice — but the analysis turns on the service, not the practice area label, and firms have been urged to document their reasoning either way.

The obligations now in force

For captured firms, enrolment with AUSTRAC was only the entry point. The substantive obligations that now apply include developing and maintaining a written AML/CTF programme tailored to the firm's risk profile and the designated services it provides; carrying out customer identification and verification — know-your-customer (KYC) checks — before providing a designated service; conducting ongoing customer due diligence and enhanced customer due diligence (ECDD) for higher-risk clients and matters; appointing an AML/CTF compliance officer with sufficient seniority and authority; submitting suspicious matter reports (SMRs) to AUSTRAC; and retaining relevant records for seven years.

For many practices the operational burden falls on client onboarding, where identity verification and risk assessment now need to happen consistently and be evidenced. Compliance technology providers, Legl among them, have positioned client due-diligence and onboarding tooling to help firms run and record these checks without grinding matter intake to a halt. Whatever the tooling, the underlying obligation is the same: the firm must be able to show what it did, when and why.

Enforcement and the stakes

The penalties give the regime teeth. Civil penalties under the AML/CTF Act reach up to roughly A$31.3 million per contravention for a body corporate, and AUSTRAC has signalled that wilful failure to enrol is precisely the kind of conduct it will pursue. The regulator has framed its early posture as education-led — helping a genuinely unfamiliar sector come into compliance — but that goodwill is not open-ended, and the 29 July enrolment deadline was the first hard marker of who took the obligation seriously.

Key takeaways for compliance officers

• Confirm your capture position in writing. Whether or not you provide a designated service, document the analysis against AUSTRAC and Law Council guidance so your reasoning is defensible.
• Check enrolment is complete. If your firm was providing designated services from 1 July, the 29 July enrolment deadline has passed — verify status now and act immediately if you have missed it.
• Make the AML/CTF programme a living document. It must reflect your actual risk profile and services, not a generic template, and be reviewed as your practice changes.
• Operationalise KYC at intake. Build identity verification, risk rating and record-keeping into onboarding so compliance is consistent and evidenced, not ad hoc.
• Know your reporting triggers. Ensure staff can recognise and escalate matters that may require a suspicious matter report, and that your seven-year records are being captured from day one.

Looking ahead

The next phase will test the regime in practice rather than on paper. Expect AUSTRAC to shift gradually from education toward supervision as the sector settles, with early attention likely on firms that failed to enrol at all. Compliance officers should watch for further sector-specific guidance, the first wave of SMRs flowing from newly regulated practices, and the independent-review obligations that will require firms to periodically test their programmes. For Australian law firms, AML/CTF compliance is no longer a project with a deadline — it is now part of how the practice runs.

Sources

• Anti-Money Laundering reforms — Grant Thornton Australia
• Australia's AML/CTF Reforms: A New Era in Financial Crime Prevention — Norton Rose Fulbright
• Understanding designated services: when legal services trigger Tranche 2 AML/CTF obligations — Law Society of NSW
• Law Council releases guidance to help legal profession navigate new AML/CTF regime — Law Council of Australia
• Professional designated services — AUSTRAC

‍

‍