AML/CTF compliance for firms new to AUSTRAC

Six professions, where they provide designated services:

• Lawyers
• Conveyancers
• Accountants
• Real estate professionals
• Dealers in precious metals and stones
• Trust and company service providers

The qualifier matters as much as the list. Being in one of these professions does not by itself make you a reporting entity; providing a designated service does. Managing client money, real estate transactions and company formation are the common triggers.

Customer due diligence obligations began on 1 July 2026.

Enrolment with AUSTRAC opened earlier. If your firm is not enrolled yet, that is the first step and it comes before everything else. A program you cannot evidence to a regulator you have not registered with is not much use.

The practical position for most firms now is not whether to start but how quickly the gap since July can be closed.

The trigger is the activity, not the client or the fee.

For conveyancers and real estate professionals it is typically the property transaction itself. For accountants and lawyers it is usually managing client money, operating trust accounts, or acting in company and trust formation. For trust and company service providers it is the core of what the business does.

The distinction matters because a firm can provide designated services in some matters and not others. The obligations attach to those matters, which is why the first task is usually mapping which parts of your practice are in scope, instead of treating the whole firm as uniformly regulated.

Four components:

• A written AML/CTF program based on your risk assessment
• Client identification before you provide a designated service
• Screening against sanctions and PEP lists
• Records of each check

For most small firms that amounts to a policy document plus checks run in a browser. The obligations are the ones banks have carried for years; the difference is that you do not have a compliance department, and the program should be sized accordingly.

A proportionate program that runs is worth considerably more than an elaborate one that does not.

Where the client is a company or a trust, yes. You need to identify the individuals who ultimately own or control it, and screen them too.

This is the part that most often catches firms out, because it is where a simple matter stops being simple. A property purchase by an individual is a straightforward identification. The same purchase by a company requires establishing who is behind that company and verifying them as people.

Company purchasers are a routine scenario in conveyancing and commercial work, so it is worth having the process settled before one arrives with a settlement date attached.

You need checks that run against reliable, independent sources, and records that prove they ran.

That is the requirement stated plainly, and it is where manual processes hit a wall. A firm cannot reach the Document Verification Service or sanctions data directly by inspecting a licence across the counter; that access is exactly what the portal provides. Photocopying a passport into a matter file is not verification against an independent source.

There is no integration project involved. Checks run from a browser, and a first check takes minutes, not an implementation cycle.

Send an ID Pass link. The client photographs their identity document and takes a selfie on their own phone, the checks run automatically, and the result comes back to your file.

There is no app for them to install and nothing for your firm to build.

For a conveyancing or accounting practice this is usually the default, not the exception. Most clients now expect to complete a matter without attending an office, and requiring an in-person identity check is a real source of friction at exactly the point where a matter is being won or lost.

Seconds for the check itself. First-time setup (account, users and a test check) is typically done inside a day.

That timescale is deliberate. The obligations arrived on a fixed date for tens of thousands of firms at once, most of them without compliance staff, and a solution requiring a lengthy implementation would not have been usable by the people who needed it.

Screening and record-keeping then run in the background, which is what stops compliance becoming a recurring administrative task for a practice that has no one dedicated to it.