With the 31 March 2026 deadline now just days away, Australian law firms face a critical milestone in the country's most significant anti-money laundering reforms in nearly two decades. On that date, enrolment opens for Tranche 2 entities under the amended Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), and for current reporting entities, a raft of new obligations formally takes effect. If your firm provides designated services, the time to act is now.

What Happens on 31 March 2026?

Two things change simultaneously on 31 March. First, existing reporting entities ie banks, financial institutions, and payment providers, must begin complying with the reformed AML/CTF Rules 2025, which AUSTRAC tabled in Parliament on 29 August 2025. These updated rules introduce a more principles-based, risk-focused compliance framework, replacing much of the prescriptive detail in the previous regime.

Second, and more consequentially for the legal sector, AUSTRAC opens enrolment for newly regulated Tranche 2 entities. Lawyers, accountants, conveyancers, real estate professionals, dealers in precious metals and stones, and trust and company service providers can begin registering with AUSTRAC from this date. Full compliance obligations then commence on 1 July 2026, with enrolment required by 29 July 2026.

The reforms, passed by Parliament on 29 November 2024 and receiving Royal Assent on 10 December 2024, are designed to align Australia's AML/CTF regime with Financial Action Task Force (FATF) standards ahead of Australia's scheduled mutual evaluation later this year.

Which Law Firms Are Captured?

Not every legal practice will fall under the new regime. The amended Act targets firms that provide specific "designated services", a term that carries particular regulatory weight. For lawyers, these include assisting in the planning or execution of a transaction to sell, buy, or transfer a body corporate or legal arrangement; receiving, holding, controlling, or managing a person's property; and assisting in organising, planning, or executing equity or debt financing transactions.

Critically, the trigger is the nature of the service, not the size of the firm. A sole practitioner handling conveyancing and a national firm managing complex corporate transactions may both be captured if they provide one or more designated services with a geographical link to Australia.

Litigation-only practices and purely advisory firms are unlikely to be affected, but any practice that touches transactional work should carefully assess whether its services fall within the designated categories.

What Firms Need to Prepare

Once enrolled, law firms must meet several core obligations by 1 July 2026. These include conducting customer identification and verification (know-your-customer procedures), developing and maintaining a tailored AML/CTF programme that includes a documented risk assessment, implementing ongoing customer due diligence, establishing reporting and record-keeping systems (with records retained for seven years), and enrolling with AUSTRAC. Firms in other jurisdictions like the UK that have been managing these obligations for decades use technology systems like Legl for client lifecycle management.

AUSTRAC has been progressively releasing guidance to support the transition. Core guidance was published in October 2025, with further updates and sector-specific programme starter kits released in January 2026. These starter kits are designed to help small and mid-sized practices customise and maintain an AML/CTF programme without needing to build one from scratch.

Legal Professional Privilege Is Preserved: With Caveats

One of the most closely watched aspects of the reforms is how they interact with legal professional privilege (LPP). The amended Act explicitly provides that nothing in the legislation affects a person's right to refuse to give information or produce a document on the grounds of LPP. AUSTRAC will provide a specific form for practitioners to assert privilege where relevant.

However, the practical application of LPP within a compliance framework that demands customer identification, transaction monitoring, and suspicious matter reporting will inevitably create tension. Firms should consider how their AML/CTF programme will handle situations where compliance obligations and privilege intersect, particularly around record-keeping and reporting.

Privacy Obligations Expand Too

From 1 July 2026, Tranche 2 entities, including law firms, will also be brought within the scope of the Privacy Act 1988 (Cth). This is significant for smaller practices that may previously have been exempt under the small business exemption (annual turnover under $3 million). The Office of the Australian Information Commissioner (OAIC) has released updated guidance for newly captured reporting entities.

Key Takeaways for Compliance Officers

• Assess now: Determine whether your firm provides any designated services that trigger AML/CTF obligations. Do not wait until July.
• Enrol from 31 March: Registration with AUSTRAC opens on 31 March 2026. Begin the process early to avoid last-minute complications.
• Build your programme: Use AUSTRAC's sector-specific starter kits to develop a risk assessment and AML/CTF programme tailored to your practice. Leverage know-how from technology leaders in AML & Risk Management like Legl who can help your firm to prepare.
• Budget for compliance: With an estimated 80,000–90,000 new reporting entities entering the regime, demand for training, technology, and specialist expertise is expected to surge. Plan your resourcing accordingly.

Looking Ahead

The three months between enrolment opening on 31 March and full obligations commencing on 1 July will be a critical window for law firms across Australia. AUSTRAC has indicated that further tailored guidance for the legal sector is forthcoming, and firms should monitor AUSTRAC's reform page closely. With Australia's FATF mutual evaluation also scheduled for 2026, regulators will be keen to demonstrate that the expanded regime is being implemented effectively. Compliance platforms like Legl, which help legal practices manage client onboarding and regulatory obligations, can support firms in building the systems they need to meet these new requirements. The message from AUSTRAC is clear: preparation must begin well before July.

‍