AML/CTF Reforms – What Existing Reporting Entities Need to Do before 31 March 2026

1. Overview of the Reforms

Significant changes to Australia’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) regime are taking effect under the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (the Amendment Act) and the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (the Rules). These reforms represent a fundamental shift toward an outcomes-based, risk-oriented framework, aligned with international standards set by the Financial Action Task Force. The core pillars of the reform include:

• Stronger governance and oversight, with clearer accountability for the board and senior management;
• Expanded risk assessments, including explicit coverage of Proliferation Financing (PF) risk; and
• New transitional measures, including a three-year transition period for initial Customer Due Diligence (CDD) obligations.

2. Who Do These Reforms Apply To?

The AML/CTF reforms affect a broad range of businesses. If your business provides any of the designated services regulated under the AML/CTF Act, you are a “reporting entity” and must comply with the reformed regime.

Existing Reporting Entities (Tranche 1)

Entities already regulated under the AML/CTF Act must comply with the reformed regime from 31 March 2026. These include:

• banks, building societies, and credit unions;
• life insurers and friendly societies;
• securities dealers, futures brokers, and managed investment scheme operators;
• remittance service providers;
• gambling service providers, including casinos and online wagering operators;
• bullion dealers; and
• virtual asset service providers (formerly digital currency exchange providers).

Newly Regulated Entities (Tranche 2)

A major expansion of the AML/CTF regime will bring approximately 90,000 new businesses under AUSTRAC regulation from 1 July 2026. These “Tranche 2” entities include:

• lawyers and law practices;
• accountants;
• real estate agents;
• trust and company service providers; and
• dealers in precious metals and stones (jewellers).

Tranche 2 entities will be able to enrol with AUSTRAC from 31 March 2026 and must be enrolled by 29 July 2026. AUSTRAC has released sector-specific guidance and program starter kits to assist newly regulated entities in preparing for their obligations.

3. Governance and Oversight: New Statutory Obligations

A central feature of the reforms is the introduction of defined roles for the “Governing Body” and “Senior Manager”, together with heightened expectations for effective internal controls.

Governing Body

The “Governing Body” refers to the individuals or body (such as a Board of Directors) with primary responsibility for the governance of the reporting entity. The Governing Body is expected to maintain ongoing oversight of AML/CTF compliance and be sufficiently informed of Money Laundering (ML), Terrorism Financing (TF), and Proliferation Financing (PF) risks to ensure that the AML/CTF Program is identifying and mitigating those risks in practice. Under the Amendment Act, the Governing Body has proactive obligations to provide “appropriate ongoing oversight”. The Australian Transaction Reports and Analysis Centre (AUSTRAC) has indicated that this may be demonstrated by:

• including AML/CTF compliance and ML/TF/PF risk as a regular standing agenda item in board or management meetings;
• reviewing relevant matters in AML/CTF compliance officer and independent evaluation reports;
• questioning how the business will address any adverse findings in those reports; and
• interrogating the root causes of non-compliance and the effectiveness of existing controls.

Senior Manager

A “Senior Manager” is an individual who makes, or participates in making, decisions affecting the whole or a substantial part of the reporting entity. The reforms sharpen accountability by making them legally responsible for approving the ML/TF/PF Risk Assessment, AML/CTF policies, and any material updates to those documents. The Senior Manager's approval is also required for high-risk individual matters, including:

• providing designated services where politically exposed persons are involved; or
• establishing or maintaining a nested services relationship.

Both of these roles must be held by individuals with greater active governance, oversight and executive decision-making responsibility.

4. Proliferation Financing (PF)

A key reform is the explicit requirement for reporting entities to identify, assess, and manage PF risk. PF involves financing activities linked to the development or acquisition of weapons of mass destruction. While many institutions are already familiar with sanctions compliance and screening requirements, the reforms clarify that PF must be treated as a distinct AML/CTF risk category. PF should be integrated into the ML/TF/PF Risk Assessment as part of routine risk management. For many entities, this will require refining existing methodologies to ensure PF is assessed with sufficient specificity (for example, through jurisdictional exposure, transaction typologies, and counterparty risk indicators), rather than being subsumed within broader AML/CTF risk settings. Where an entity reasonably assesses PF risk as low, a standalone Counter-Proliferation Financing policy is not required, provided the risk is appropriately managed through existing ML/TF controls. However, any low-risk assessment must be properly documented to satisfy AUSTRAC’s expectations for an auditable process. If PF is not addressed at all in the Risk Assessment and AML/CTF Program documentation, the framework may be non-compliant.

5. Implementation Timeline and Transitional Measures

The compliance deadline for existing reporting entities is 31 March 2026. Entities should use the remaining time to finalise necessary structural and governance updates.

Three-Year Transition for Initial CDD

On 22 January 2026, AUSTRAC announced that existing reporting entities will be granted an additional three years (i.e. until 30 March 2029) to comply with the new initial CDD obligations. During this period, entities may choose either to:

• continue applying their existing Applicable Customer Identification Procedures when onboarding new customers; or
• transition to the reformed initial CDD obligations at any time before 30 March 2029.

Entities must apply whichever framework they choose consistently across all new customers and customer types. Once an entity formally transitions to the reformed CDD obligations, it must apply the new requirements from that point forward. The three-year transition applies only to initial CDD (i.e. new customer onboarding). Ongoing CDD obligations under section 30 of the AML/CTF Act must be implemented from 31 March 2026 with no deferral.

Other Transitional Measures

AUSTRAC has also confirmed the following transitional arrangements:

• existing reporting entities have until 30 May 2026 to notify AUSTRAC of their AML/CTF Compliance Officer;
• staggered deadlines will apply for entities that have recently completed an independent review; and
• on 9 February 2026, AUSTRAC released exposure draft amendments to the AML/CTF Rules for industry consultation. The transitional rules being developed by the Department of Home Affairs under Schedule 12 of the Amendment Act are expected to be finalised shortly.

6. Your Compliance Readiness Checklist

With the 31 March 2026 deadline imminent, each reporting entity should assess its current position against the following:

1. Integrating PF as a distinct risk category in your ML/TF/PF Risk Assessment, ensuring the assessment methodology is sufficiently specific to identify threats;
2. Clearly designate the Senior Manager responsible for statutory approvals of policies and risk assessments and define the Governing Body's duty to exercise “appropriate ongoing oversight”;
3. Assess whether the AML/CTF Compliance Officer meets the new statutory criteria, including being an Australian resident (where applicable), a fit and proper person, and possessing sufficient authority and independence;
4. Refresh AML/CTF Programs and controls to align with the updated Rules and the outcomes-based framework;
5. Align evaluation schedules with the new statutory requirement to test Program effectiveness at least every three years, noting that any adverse findings now trigger an immediate review of the Risk Assessment;
6. Implement ongoing CDD processes under section 30 of the AML/CTF Act; and
7. Document transitional implementation steps, including approvals, milestones, and remediation activity.

The immediate task for existing reporting entities is not to start from scratch, but to ensure that existing frameworks are updated to meet the new expectations in governance accountability, PF risk assessment, and CDD obligations. AUSTRAC has made clear that its approach to compliance will be “pragmatic and proportionate” but has also signalled that entities that fail to manage their ML/TF risks or ignore their obligations will face regulatory action. Having a documented implementation plan in place by 31 March 2026 is essential.

7. How We Can Assist

H & H Lawyers has extensive experience advising reporting entities on AML/CTF compliance, risk assessments, and governance frameworks. We understand the practical challenges these reforms present, particularly for businesses operating across multiple jurisdictions. Our team can assist with:

• reviewing and updating your ML/TF/PF Risk Assessments and AML/CTF Programs;
• advising on governance structures, including the designation of Senior Manager and Governing Body roles;
• assessing AML/CTF Compliance Officer suitability under the new statutory criteria;
• preparing documented implementation plans and transitional strategies; and
• providing ongoing compliance support as the reforms take full effect.

To discuss how these reforms affect your business, please do not hesitate to contact us.