AML Tranche 2 Starts in Three Weeks. Here Is What We Have Been Building.

Key Takeaways

• AML/CTF obligations attach to designated services, not industry labels. You are not caught because you are a lawyer, an accountant or a broker. You are caught if you provide a service listed in s 6 of the AML/CTF Act 2006 (Cth). Some operators are defaulting every professional to 'yes'. That is not what the legislation says.
• AUSTRAC's free starter kits cover five sectors. Everyone else is caught with effectively zero tailored industry support. The biggest groups we see are insolvency practitioners, property developers and business brokers.
• Customer due diligence is not one rigid procedure. The Act and Rules provide at least five lawful pathways: modified CDD for pre-commencement customers (s 36), delayed initial CDD (s 29), simplified CDD, reliance on third-party CDD and modified CDD for transferred customers when a practice or book changes hands. Blanket re-identification of your entire client base is a choice, not a requirement.
• Edge cases are real and the answers are not always published anywhere. Whether a goodwill-only business sale is a designated service is one we had to resolve from first principles. The answer is definitive. It is also complicated. No authority currently sets the record straight.
• Becoming a reporting entity also switches on the Privacy Act. Under s 6E(1A) of the Privacy Act 1988 (Cth) the small business exemption does not protect reporting entities. Businesses under the $3 million threshold that have never had privacy obligations will have them from 1 July 2026 for their AML/CTF activities, including all the KYC data they are about to start collecting.
• Enrolment with AUSTRAC opened on 31 March 2026 and closes on 29 July 2026. A policy document alone will not discharge the obligations. The regime assumes screening, records, reviews and a compliance calendar that actually runs.

1. 1.What We Have Been Building
2. 2.Where the Reform Stands
3. 3."Are We In or Are We Out?"
4. 4."You're in That Industry, So You're Caught." No.
5. 5.Staying Out Is a Position You Have to Hold
6. 6.The Sectors Caught With Zero Support
7. 7.The Goodwill-Only Business Sale
8. 8.CDD Is Not One Procedure (Or: Have You Met the PCC?)
9. 9.The Privacy Trap Nobody Mentions
10. 10.The Sectors We Built For
11. 11.Three Weeks

For the past year we have been building for AML Tranche 2. More than 2,500 pages of policy documents, risk assessments and procedures across twelve sector editions, published through a sister entity HeadStart Docs™. A compliance portal of roughly 410,000 lines of code behind them. A dedicated Tranche 2 advice practice, HeadStart Counsel, the trading name under which Astris Law does this work. This article announces that work, lists the sectors we built for and shares what the work taught us, because the questions reaching us in the final weeks before commencement have answers that nobody else is publishing.

Disclosure of interest. HeadStart Counsel is a registered trading name of Astris Law. HeadStart Docs™ is a separately incorporated publisher and platform provider, not a law practice, sharing the same ultimate beneficial owner and director as Astris Law.

What We Have Been Building

We drafted Tranche 2 policy documents for our own purposes and kept drafting. The suite now runs to more than 2,500 pages across twelve sector editions. The portal behind it is roughly 410,000 lines of code. Those numbers answer a fair question: on what basis does anyone write about a regime this new? Our basis is months inside the legislation, drafting against it line by line for twelve industries at once.

Two things became obvious in that work.

The first was price. The market was quoting thousands of dollars for template packs, for documents most small reporting entities need in materially similar form. Making the documents accessible solved that. It was also the easy part.

The second was the real problem: the obligations are continuous and documents are not. The free kits are static Word files. So are the expensive templates. A policy written in June 2026, filed and never looked at again until AUSTRAC asks for it, is where compliance programs go to die. The risk assessment must be reviewed on triggers. Screening must actually run. Training must be tracked. Records must accumulate somewhere they can be produced.

So the documents became a system. Every customer passes through gates. No matter opens until the file confirms the work is permitted under the guardrails policy. No settlement or disbursement proceeds past an unresolved screening match. A configuration schedule switches each designated service on or off, so provisions for services you do not offer are formally non-operative rather than vaguely ignored. A significant change register watches for the drift that quietly changes your answer (new services, new markets, new delivery channels) and forces the risk assessment to catch up. The compliance calendar tracks the annual AUSTRAC report, the compliance officer's report to the governing body, the three-yearly independent evaluation and the SMR and TTR clocks. The portal runs all of it, version controlled, so when an evaluation or an AUSTRAC enquiry arrives, the evidence of a functioning program exists because the program actually functioned. It integrates with practice management tools like Clio rather than asking you to run compliance in a parallel universe.

Because the regime is service based, so are the documents. There are editions for the five sectors AUSTRAC wrote kits for. There are editions for the orphans: insolvency practitioners, property developers, business brokers, buyers' agents, nominee director providers, virtual address providers and TCSPs. Each is built around the specific Table 5 and Table 6 items that sector triggers. The suite scales by governance scenario, from a sole practitioner who lawfully holds the governing body, senior manager and compliance officer roles at once, through to reporting groups. Section 26F demands policies appropriate to the nature, size and complexity of your business, not the business a template author imagined.

The roles are deliberately separate. HeadStart Docs™ is a digital publisher and platform provider. It does not give legal advice. Its documents must be reviewed and tailored to your circumstances. Legal advice on Tranche 2 is provided through HeadStart Counsel, the name under which Astris Law runs its Tranche 2 practice. Documents from a publisher. Advice from a law firm. If a provider is blurring that line, ask them which one they are.

And if the free AUSTRAC kit covers your situation, use it. We reviewed it honestly and it rates well for what it is: 25 of 45 mandatory items fully addressed, 12 partial, 8 missing. The businesses that need more are the ones the kits were not written for: reporting groups, edge cases, orphan sectors and anyone who knows a Word file on a shared drive is not a compliance program.

Where the Reform Stands

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), which now incorporates the 2024 amendments, extends the AML/CTF regime to so-called Tranche 2 entities: lawyers, conveyancers, accountants, real estate professionals, dealers in precious metals and stones and providers of trust and company services. The reform commences in stages. The expanded digital asset perimeter, covering digital currency exchanges and other virtual asset service providers, commenced on 31 March 2026. We covered it in our cryptocurrency regulation article. The new professional, real estate and precious products sectors follow from 1 July 2026. Enrolment with AUSTRAC opened on 31 March 2026. Newly regulated businesses have until 29 July 2026 to enrol and to notify AUSTRAC of their compliance officer.

The reporting population grows from roughly 17,000 entities to estimates of between 80,000 and 100,000. No prior reform has pulled this many industries into a single regulatory regime at once. This is the largest cross-industry regulatory change most Australian businesses will experience in their operating lives.

The enforcement history shows what the regime does to those who treat it as paperwork. Westpac paid $1.3 billion. CBA paid $700 million. Crown Melbourne paid $450 million. SkyCity Adelaide paid $67 million. In 2025 the Federal Court ordered two former Star executives to pay personal fines and banned them from management for failing to exercise care and diligence on AML risk. Those were Tranche 1 institutions with compliance departments. The same Act now applies to businesses with three staff.

"Are We In or Are We Out?"

This is the question we hear most. The way it is being answered across the market is a problem.

The AML/CTF regime does not regulate industries. It regulates designated services. Section 6 of the Act sets out tables of services. You become a reporting entity when you provide one of them in the course of carrying on a business. For the new sectors the operative concepts include assisting a person in the planning or execution of a transaction to sell, buy or otherwise transfer real estate or a body corporate or legal arrangement. Receiving or managing a client's money or assets beyond payment of professional fees. Creating or restructuring companies and trusts. Acting as or arranging nominee directors or shareholders. Providing registered office services.

Notice what is not in that list. Litigation. Tax returns and audits. Residential property management and rent collection. Business advisory that never touches a transaction. A business can sit squarely inside a "Tranche 2 industry" and trigger nothing, because the regime never regulated industries in the first place. Home lending is the reverse trap: the loan has been Tranche 1 business since 2006, with the lender as the reporting entity, so it was never waiting for Tranche 2 at all.

The deeper problem is a paradigm gap. The market has not caught up. Industries describe their work in their own vocabulary: conveyancing, appointments, campaigns, engagements. The Act describes regulated work in its vocabulary: designated services in the tables in s 6. The two languages do not map onto each other. Almost every wrong answer circulating right now comes from someone translating carelessly between them. We have seen legal services that are clearly out. We have seen property services confirmed out. We have seen innocuous-looking insolvency work dissolve on analysis into services that are in, services that are excluded and services that turn on the appointment type. There is a striking lack of authority writing at this level in the market.

"You're in That Industry, So You're Caught." No.

There are operators in this market whose answer to every solicitor, every accountant, every agent and every broker is yes, you are caught, buy the program. That is not what the legislation says. It is a wrong answer with a comforting price tag.

The honest analysis runs service by service and it cuts both ways in every sector. A litigation practice that never touches conveyancing, never holds client money beyond fees and never sets up companies may be outside the regime entirely. The suburban firm that does four conveyances a year is in. An accounting practice that only does tax and audit is out. The one that helps clients buy businesses or registers companies is in. A property manager running a rent roll is out. The buyer's agent next door is in. The finance broker arranging debt for companies is in under Tranche 2. The mortgage broker arranging home loans under a credit licence is generally not a reporting entity under either tranche, yet the loan itself has been a Tranche 1 designated service since 2006: the lender carries it, lending off your own book makes you the lender and a broker holding an AFSL can be caught by the arranging item in Table 1. The label on the door decides nothing. The services you actually provide decide everything.

Defaulting everyone to yes is not prudence. It commits businesses to enrolment, programs, screening, reporting and audit obligations they may not have. Once you are enrolled you are on AUSTRAC's books with everything that follows. The opposite error is just as live: assuming you are out because your industry was never mentioned in the headlines. Both errors come from the same habit of reasoning by label instead of by designated service.

If the answer for your business is unclear, that is an edge case. Edge cases deserve advice, not a default.

Staying Out Is a Position You Have to Hold

The flipside is misunderstood too. "Not caught" is not a permanent state. It is a description of your current service list. Service lists drift. The property manager who does one sales campaign as a favour. The accountant who registers one company for a long-standing client. The serviced office that lets one tenant use the address as a registered office. Each has just provided a designated service. Each is now a reporting entity with the full set of obligations attached.

Getting that wrong compounds daily. A business that provides designated services without enrolling accrues separate daily penalties once it has been doing so for 28 days, currently up to $19,800 a day for a body corporate and $3,960 a day for an individual. Operating without compliant AML/CTF policies works the same way. The Act counts a separate contravention for each designated service and for each day it continues (s 26F(8A), (9) and (10)).

So businesses on the right side of the line need something most providers do not sell: controls that keep them there. A documented compliance position recording why no current service is designated. A guardrails policy that defines what the business will not do, so the line is visible to staff before they cross it rather than to a regulator after. A trigger process so a planned new service or market is assessed before launch, not discovered in an audit. We flagged in our February review that the free AUSTRAC kits contain nothing like this. Staying out is cheaper than being in. It is not free and it is not passive.

The Sectors Caught With Zero Support

AUSTRAC released free starter kits in January 2026 for five sectors: legal professionals, accounting professionals, conveyancers, real estate agents and precious product dealers. Whatever their gaps, those five sectors have a free, regulator-issued starting point.

Now consider who is caught by the designated services tables but has no kit, no tailored peak body program and in some cases no published guidance that even acknowledges their situation. In our practice the biggest groups are:

Insolvency practitioners

An appointee who sells real estate out of an administration, sells the business itself or receives and manages money and assets is squarely within the territory of the designated services tables. There is a narrow exception for court-appointed registered liquidators, which makes the analysis appointment by appointment, not practice wide. There is no insolvency starter kit. The accounting kit was not written for appointments, statutory duties or the realities of acting as a controller, liquidator or administrator.

Property developers

A developer who sells its own stock directly, without an agent in the middle, provides a designated service in its own right. The real estate kit does not cover developers, a gap we flagged in our February review. Off-the-plan sales, related party structures and foreign purchasers put many developers at the harder end of the risk assessment exercise, with nothing written for them.

Business brokers

Brokering the sale of a body corporate is a designated service. Brokering the sale of a business is where the published guidance runs out. More on that below.

Virtual office providers

Almost nobody in this sector has noticed. Providing a registered office address for a company is a designated service under the professional services table. A serviced office or virtual office business whose product includes acting as a client company's registered office is providing a trust and company service, whether or not it has ever heard the phrase. Mail handling alone is a different analysis. The line between the two is exactly the kind of question this regime keeps generating.

The Goodwill-Only Business Sale

Here is a question we were asked recently and could not answer from any published source, because no published source deals with it properly.

A business is sold. No real estate. No shares. No company changes hands. The sale is of goodwill only, perhaps with some contracts assigned alongside it. Is anyone in that transaction providing a designated service?

You would think a regime years in the making, covering business sales as one of its core professional services, would have a clear answer. It does not. The legislation requires careful reading. The answer turns on concepts the guidance does not address. The commentary we have seen either ignores the question or waves at it.

We worked the answer out from the statutory text. The conclusion is definitive. It is also complicated, it is not the answer most people assume and we are not publishing our reasoning in a blog post. If you broker business sales, advise on them or are selling a business this financial year, ask us. This is the category of question HeadStart Counsel exists for.

CDD Is Not One Procedure (Or: Have You Met the PCC?)

The loudest myth in the market right now is that customer due diligence means one thing: identify and verify every client, in full, including the ones you have acted for since 2009.

The framework is more intelligent than that. The difference is measured in hundreds of hours for an established practice.

The starting point is the prohibition: you must not commence a designated service before initial CDD is complete (s 28). The Act and the Rules then build five lawful pathways around that prohibition. Almost nobody selling compliance programs mentions more than one.

Modified CDD for pre-commencement customers (s 36)

A customer is a PCC if, on 1 July 2026, you are in an ongoing business relationship with them and the only designated services in that relationship are the new Tranche 2 ones. The test looks at designated services, not services generally. You can have done years of tax returns, advice work or other non-designated work for a customer and they can still be a PCC. What disqualifies them is the relationship also involving a Tranche 1 designated service, such as lending, because then you were already a reporting entity and the transitional concession is not for you. For a PCC, you can generally keep providing designated services without conducting initial CDD at all. The obligation arises on triggers: an SMR obligation or a significant change in the nature and purpose of the relationship that lifts the customer's risk to medium or high. What remains is ongoing CDD at a frequency appropriate to risk. Compare that with re-papering your entire client base before 1 July, which is what some providers are telling businesses they must do.

Delayed initial CDD (s 29)

Where it is essential to commence before CDD is complete to avoid interrupting the ordinary course of business, the risk is low and proportionate mitigations are applied, you may start and complete CDD as soon as practicable after. For practices where new matters are often urgent, this exemption is the difference between a workable program and one your staff will route around.

Simplified CDD (rules 6-16 to 6-19)

For customers you have assessed as low risk with no enhanced CDD trigger, a reduced set of KYC information may be collected and, absent reason for doubt, accepted without full verification. Simplified does not mean none. It means proportionate.

Reliance on third-party CDD (rules 6-29 to 6-31)

CDD properly performed by another can be relied on rather than repeated. Reporting group arrangements let related entities perform it once and share it.

Modified CDD for transferred customers (rules 6-27 and 6-28)

Buy a practice, a rent roll or a book of clients and the Rules provide a transfer pathway for the acquired customers rather than forcing immediate re-identification of every file. Almost no commentary mentions this one at all. It matters to every acquisition in every Tranche 2 sector between now and the end of the decade.

Add enhanced CDD for the situations that actually warrant it and the picture is clear: there are multiple lawful ways to build a CDD process. The right one depends on your customer base, your services and your risk assessment. Anyone selling you a single rigid procedure as "the requirement" is selling you their template, not the law.

The Privacy Trap Nobody Mentions

Most Tranche 2 businesses are small. Most small businesses have spent their entire existence outside the Privacy Act 1988 (Cth), protected by the small business exemption for operators under $3 million in turnover. That protection ends the day you become a reporting entity.

Section 6E(1A) of the Privacy Act provides that the small business exemption does not apply to a reporting entity in relation to activities carried on for the purpose of, or in connection with, the AML/CTF Act. Read that against what the regime requires you to do: collect identity documents, beneficial ownership information, source of funds material and screening results on every customer you run CDD on. From 1 July 2026 you will be collecting exactly the kind of personal information the Australian Privacy Principles govern. For the first time the APPs will apply to you when you do.

That means a compliant privacy policy, collection notices, security and retention practices for KYC data and exposure to the notifiable data breaches scheme for the very documents the AML/CTF Act forces you to hold for seven years. The OAIC published guidance for reporting entities in February 2026. Very little of the Tranche 2 commentary mentions any of this. A program that solves AML/CTF and ignores privacy has solved half the problem.

The Sectors We Built For

The HeadStart Docs™ sector editions cover the five sectors AUSTRAC wrote kits for and the sectors it did not. Each edition is built around the Table 5 and Table 6 designated services that sector actually triggers, with the corresponding risk assessment, policies, CDD procedures and registers:

• AML/CTF compliance for real estate agents
• AML/CTF compliance for buyers' agents
• AML/CTF compliance for property developers
• AML/CTF compliance for conveyancers
• AML/CTF compliance for lawyers and law firms
• AML/CTF compliance for accountants
• AML/CTF compliance for insolvency practitioners
• AML/CTF compliance for business brokers
• AML/CTF compliance for trust and company service providers
• AML/CTF compliance for nominee director and nominee shareholder providers
• AML/CTF compliance for virtual offices
• AML/CTF compliance for jewellers and dealers in precious metals, stones and products

Digital currency exchanges and other virtual asset service providers sit on the earlier 31 March 2026 clock and are covered in our digital assets analysis.

If your industry is on that list, the documents exist. If your service mix is unclear, that is an advice question. Answering it before 29 July is considerably cheaper than answering it after.

Three Weeks

The commencement date does not move. Enrolment closes on 29 July 2026 and the daily penalties for unenrolled reporting entities start accruing from there. If your position is clear, enrol and build the program. If your position is an edge case, get the question answered now, while the answer can still shape what you do, rather than in August when AUSTRAC asks why you did nothing. And if your position is out, document why and put the guardrails up that keep it true.

Need advice on whether Tranche 2 catches your business?

Contact HeadStart Counsel or call Astris Law on +61 7 4270 8880.

Disclosure of interest. HeadStart Counsel is a registered trading name of Astris Law. HeadStart Docs™ is a separately incorporated publisher and platform provider, not a law practice, sharing the same ultimate beneficial owner and director as Astris Law. We make no representations about the products provided by HeadStart Docs™ and you should do your own research before purchasing AML compliance products.

This article is for general information purposes only and does not constitute legal advice. You should seek professional advice tailored to your specific circumstances before acting on any information in this article. Liability limited by a scheme approved under Professional Standards Legislation.