AUSTRAC has started issuing fines over enrolment. Here’s who has to enrol

AUSTRAC has moved from asking questions to issuing fines. In a media release on 30 September, AUSTRAC said it had begun issuing infringement notices to businesses it had identified as failing to enrol with it under the anti-money laundering and counter-terrorism financing (AML/CTF) laws.

The notices went to businesses in the real estate, accounting and jewellery sectors that AUSTRAC “believes failed to enrol”. An infringement notice is the regulator’s allegation, not a court finding. AUSTRAC said they were issued at $21,840 for corporate entities and $4,368 for individuals, “but can accrue on a daily basis”. It didn’t say how many it has issued, and it didn’t name anyone.

What changed on 1 July

AUSTRAC says the AML/CTF regime expanded on 1 July 2026 to include businesses in “sectors such as real estate, legal services, accounting, conveyancing, trust and company services, and dealing in precious stones and metals”. The regulator’s shorthand for these is “tranche 2” entities, and it has described them as tens of thousands of businesses.

The law doesn’t cover a profession as a whole. AUSTRAC’s factsheet for the new sectors says obligations apply to “certain services typically provided by” those businesses, which the law calls designated services. AUSTRAC’s checking tool puts it this way: “Your business is only regulated by us if you provide a designated service.” The enrolment page adds that the service needs a geographical link to Australia.

So the first job is working out whether anything you do is a designated service. AUSTRAC’s tool for checking if you may be regulated is the place to start.

The 28-day rule

AUSTRAC’s enrolment page puts the deadline this way: “You must apply to enrol no later than 28 days after the day you start providing a designated service.”

For a business already providing a newly regulated service on 1 July, the factsheet says that date was typically 29 July 2026. For a business that starts providing one later, the 28 days run from the day it starts.

Enrolment is done online. You create a user account in AUSTRAC Online and complete the “enrol a new business” form, which asks about the designated services you provide and your business. Once enrolled, your business appears on the Reporting Entities Roll.

Two points from the same page are easy to miss:

• Enrolment is not registration. Registration is an extra process that, AUSTRAC says, typically applies only to money remitters and specialised virtual asset services. Lawyers, accountants, real estate agents, property developers, conveyancers and dealers in precious metals and stones generally don’t need to register.
• Details must be kept current. If your business details or designated services change, you have 14 days to update your enrolment.

How the enforcement has unfolded

Date	What happened
1 July 2026	The regime expanded to the new sectors
29 July 2026	Typical enrolment due date for services already being provided on 1 July
28 August 2026	AUSTRAC announced it had begun issuing section 167 notices, which require a business to provide information, to businesses that appeared to be providing designated services without enrolling
30 September 2026	AUSTRAC announced it had begun issuing infringement notices

AUSTRAC chief executive Brendan Thomas said most businesses it looked at had responded. “We initially looked at a group of businesses where we had concerns about enrolment, and of these, around 90 per cent have now enrolled or attempted to enrol,” he said in the September release.

He also said more could follow. “We are actively looking for businesses that haven’t enrolled and we will issue more infringement notices where necessary,” he said, adding that “enrolment is a simple first step, and there is no excuse for failing to take it”.

AUSTRAC’s enrolment page gives a sense of scale. As at 17 September 2026 it counted these enrolments among the new sectors:

Industry	Enrolments
Real estate	18,350
Accounting and professional services	13,780
Lawyers	6,580
Conveyancers	1,600
Jewellers and dealers in precious metals and goods	320

That is 40,630 by our addition. The page doesn’t say how many businesses AUSTRAC thinks should have enrolled, so the figures don’t show how many are still missing.

Enrolling is the start, not the finish

A business that provides a designated service has obligations beyond enrolment, whether or not it has enrolled yet. AUSTRAC’s factsheet summarises them, and says it doesn’t cover every obligation or scenario:

• An AML/CTF program. This is a risk assessment plus policies for managing those risks, suited to the “nature, size and complexity” of the business. Senior management must approve it, and you must appoint an AML/CTF compliance officer. AUSTRAC says the compliance officer, senior manager and governing body “can all be the same person”.
• Customer due diligence. In most cases you must establish certain information about a customer before providing a designated service, and keep monitoring during the relationship. For what the factsheet calls pre-commencement customers, those checks aren’t required until you have to file a suspicious matter report about them, or the relationship changes significantly and their risk is assessed as medium or high.
• Reports to AUSTRAC. Suspicious matter reports are due within 24 hours where the suspicion relates to terrorism financing and within 3 business days otherwise. Threshold transaction reports are due within 10 business days for a transaction involving A$10,000 or more in physical currency. There is also an annual compliance report.
• Records. For most obligations, records must be kept for 7 years.

Customer checks mean collecting identity information you may not have held before. Our guide to when a small business has to report a data breach covers what happens if that information is exposed.

A way out for some jewellers

AUSTRAC’s guidance for dealers in precious metals, stones and products says a purchase or sale is regulated only if it involves $10,000 or more in physical currency or virtual assets, or both.

So a dealer that provides no other designated service, and doesn’t accept cash or virtual assets at all, isn’t regulated for those sales: “You can still accept other forms of payment through alternative methods, such as a bank transfer.”

A dealer that takes cash only below $10,000 is in a harder position than it looks. The threshold also applies when payments are split across several transactions “that are linked or appear to be linked” and add up to $10,000 or more. AUSTRAC warns that a business that provides a regulated transaction without a program “could face serious penalties”. It recommends “clear and strict policies” that either rule out cash and virtual assets or limit them to less than $10,000 per transaction, plus a process for spotting payments that add up. A dealer that accepts larger amounts needs an AML/CTF program.

If you’re not sure

AUSTRAC says it is “continuing to work with industry to provide clarity on the scope of designated services”, which suggests the line isn’t always obvious. Its Contact Centre is on 1300 021 037, and its August release said asking for help wouldn’t count against a business: “Contacting AUSTRAC for help isn’t a red flag.”

Checklist

• Check whether you provide a designated service. Use AUSTRAC’s “Check if you may be regulated” tool, and look beyond your main line of business.
• Enrol in AUSTRAC Online if you provide a designated service. You must apply within 28 days of first providing a designated service. If that date has passed, enrol now and call AUSTRAC’s Contact Centre on 1300 021 037 if you need help.
• Check whether you also need to register. Registration typically applies only to remitters and specialised virtual asset services. AUSTRAC says lawyers, accountants, real estate agents, conveyancers and precious-goods dealers generally only need to enrol.
• Name your AML/CTF compliance officer. AUSTRAC says the compliance officer, senior manager and governing body can be the same person.
• Write your AML/CTF program. It needs a risk assessment and policies suited to the nature, size and complexity of your business, approved by senior management.
• Set up customer checks for new customers. In most cases you must identify a customer before providing a designated service.
• Jewellers with no other designated services: set a strict cash policy. Either stop accepting cash and virtual assets, or cap them at less than $10,000 per transaction and set up a process to spot linked payments that add up to $10,000 or more. If you accept larger amounts, you need an AML/CTF program.
• Update AUSTRAC within 14 days of any change. That covers changes to your business details and to the designated services you provide.