How to prepare your firm for AML/CTF tranche 2 reforms

The July 2026 anti-money laundering and counter-terrorism financing (AML/CTF) deadlines have passed. If your firm provides services that involve entity setup, client asset management, or transaction support, there's a real chance those engagements now carry obligations you haven't fully addressed.

The AML/CTF Tranche 2 reforms bring specified professional services, including designated services accounting firms provide, into Australia's existing AML/CTF framework. Covered firms need a risk-based program, customer due diligence, reporting, and recordkeeping in place. 

This guide covers how to assess your scope, understand what due diligence involves day to day, and embed compliance into your existing client engagement workflow.

Before Tranche 2, AML/CTF regulation applied mainly to banks and financial institutions. The reforms close that gap by extending the same obligations to professional service providers, including accounting firms, when they provide designated services with an Australian geographical link.

In practice, that means client acceptance now involves more than agreeing on scope, pricing, and conflicts of interest. Your firm needs to assess financial crime risk before taking on an engagement, enrol with AUSTRAC if it hasn't already, maintain a documented AML/CTF program, conduct customer due diligence, and keep records and reports as required. These aren't things you do once and move on from. They become part of how you run every relevant client relationship.

Whether your firm has Tranche 2 obligations depends on what it actually does, not on the fact that it's an accounting practice. The same engagement can sit in or out of scope depending on the specific activities involved.

Four service categories are worth assessing carefully:

Routine tax returns, audits, and bookkeeping aren't automatically designated services, but the activities within an engagement matter more than the label on it. Break each service down into what your firm is actually doing, and check every activity against AUSTRAC's current professional designated services list before accepting or renewing the engagement.

The key dates are already behind us. AUSTRAC enrolment opened on 31 March 2026, Tranche 2 obligations took effect on 1 July 2026, and the 29 July 2026 enrolment deadline for firms already providing designated services at commencement has passed. The question now is which of these three positions your firm fits:

• Fully enrolled with an operating program: Document your current position and address any control gaps you've identified.
• Enrolled but still building out CDD or monitoring: Record which controls are missing and prioritise any higher-risk matters already underway.
• Providing designated services without having enrolled: Act now. A firm providing a designated service without enrolment is in breach from the moment that service is delivered. Contact AUSTRAC, get qualified legal or compliance advice, and don't rely on assumptions about whether a particular engagement triggers your obligations.

Review your active engagements, program records, verification processes, risk assessments, and monitoring controls to confirm which position reflects reality.

Customer due diligence (CDD) is an ongoing risk decision that starts before a designated service begins and continues for as long as the engagement runs. It’s not a one-time box to tick at onboarding.

The initial steps are:

1. Identify the client, beneficial owners, and anyone acting on their behalf.
2. Verify those parties using reliable, independent information.
3. Document the engagement's purpose, expected activity, ownership and control structure, and relevant risk factors.
4. Screen for risk and apply enhanced checks where closer scrutiny is warranted.

From there, CDD continues whenever ownership changes, client records go stale, services expand, or activity doesn't match the engagement's known purpose. Update records, reassess risk, and escalate concerns through your firm's approved process. When suspicion arises, follow your suspicious matter reporting controls and observe applicable tipping off restrictions.

A workable AML/CTF program doesn't need to be complex, but it does need to reflect your firm's actual risk profile. The design should account for your specific services, client types, delivery channels, locations, and exposure to financial crime.

A practical program covers these areas, each with an assigned owner and a scheduled review date:

• Risk assessment
• Governance and accountability
• Customer due diligence procedures
• Reporting processes
• Recordkeeping
• Staff training
• Incident escalation
• Testing and regular review

A solo practitioner can own every control and still needs tailored procedures, records, and scheduled reviews. A mid-sized firm can split responsibilities across a partner, compliance lead, and engagement teams, with central oversight keeping things consistent. Use a structured technology change management process to roll out new responsibilities and align your acceptance documents with TASA client engagement guidance.

The impact of weak AML/CTF processes shows up before any regulatory action. Delayed engagements, repeated verification work, partner review time, remediation costs, and damaged client trust are the more immediate consequences.

To make it concrete: a firm onboarding 20 clients spends 10 hours on 30-minute manual checks. If five files need 15 minutes of rework and partner review adds two hours, administration hits 13.25 hours before accounting for delayed starts or client follow-up. That's the cost your firm carries right now with every onboarding, regardless of whether enforcement ever enters the picture.

AUSTRAC supervises AML/CTF compliance and can take enforcement action when requirements aren't met. Review each onboarding file, record missing checks, assign remediation tasks, and escalate unresolved cases before work begins.

The firms that handle these reforms most efficiently are those that build compliance into the workflow they already use for client acceptance.

That means classifying services and assessing risk before a proposal goes out, collecting and verifying identity as part of onboarding rather than after, escalating exceptions through a defined approval path, getting signed engagement terms that reflect updated obligations, retaining evidence in the client record, and monitoring for changes throughout the relationship. This detailed engagement guidance for Australian accounting firms can help you review where your current acceptance process may need to change.

Ignition Compliance is worth evaluating as part of that workflow. It's designed to connect client verification and risk checks directly to engagement steps inside Ignition, reducing the manual handoffs that let things slip through.

Firms that manage Tranche 2 most effectively treat compliance as part of the engagement process, not a layer on top of it. When verification and risk checks happen inside the same workflow your team uses to send proposals and onboarding letters, there's less room for something to get missed and less time spent on manual follow-up.

Ignition Compliance is built to make that integration practical. It brings verification into the proposals and engagements you already send, while professional judgment and regulatory accountability stay with your firm where they belong.