Yes, if companies or trusts can use your address as their registered office or principal place of business. Since 1 July 2026, providing that address in the course of carrying on a business is a designated service under Australia's anti-money laundering / Counter terrorism financing laws (AML/CTF), whether you charge for it or not. That makes you an AUSTRAC-regulated business, with the same core obligations as accountants, lawyers and real estate agents: enrol, appoint a compliance officer, put an AML/CTF program in place, verify and risk-rate the customers using your address, train your team, report to AUSTRAC and keep records.

If you run a co-working space, serviced office or virtual office business, this may have come as a surprise. Many operators have been running their spaces for years without ever thinking of themselves as part of a financial crime regime. Finding out you're in scope can feel unsettling: new language, new obligations and a worry about adding friction for members you've worked hard to win. You're not alone, and it's very manageable once you know what's involved.

"They aren't ignoring the law. They just weren't aware. The first step is simply knowing that it applies to you." – Kaan Yuksel, Founder and Managing Director, Visibl

Why are co-working spaces now regulated by AUSTRAC?

A registered office address with ASIC gives a company a credible, physical presence. That's exactly why it matters. AUSTRAC's guidance explains that this designated service covers addresses a customer may use and notify to ASIC in the absence of a true office address, for example because the company wants privacy or doesn't have a physical presence in Australia (AUSTRAC: professional designated services). Criminals can use third-party addresses to make shell companies look legitimate and to hide who really controls them. So the law now asks anyone providing an address to know who they're providing it to.

The designated service is "providing a registered office address or principal place of business address of a body corporate or legal arrangement" (item 9 in table 6 of the AML/CTF Act). Industry bodies such as the Institute of Public Accountants list it in their own Tranche 2 guidance.

Does it apply if the address is free, or we only offer virtual office or mail plans?

Payment doesn't change the answer. AUSTRAC says it doesn't matter whether the service is provided free of charge or not, as long as it's provided in the course of carrying on a business (AUSTRAC). So an address bundled into a membership, offered on a virtual office or mail-handling plan, or given as a perk can all count.

What matters is the service, not your size. A single site where one member company uses your address is in scope, just like a national network. If you're unsure whether a particular membership type counts, it's worth getting advice on your specific arrangements.

What do co-working operators need to do?

The obligations are the same ones every Tranche 2 business has, set out in AUSTRAC's obligations factsheet.

First, enrol with AUSTRAC. Newly regulated businesses must enrol within 28 days of first providing a designated service after 1 July 2026. Next, appoint an AML/CTF compliance officer, who can oversee every site. Then put an AML/CTF program in place: a risk assessment of the money laundering, terrorism financing and proliferation financing risks your business faces, plus written AML/CTF policies that suit your size and are kept up to date.

Day to day, your team verifies and risk-rates the companies and trusts using your address before providing the service, including the people who own or control them. You keep an eye on members over time, report suspicious matters to AUSTRAC, train your front-of-house and community teams, and keep records, generally for seven years.

What about members who joined before 1 July 2026?

You don't need to re-verify everyone overnight. AUSTRAC's factsheet explains that for customers you were already serving before your obligations started, initial or ongoing due diligence isn't required until you need to lodge a suspicious matter report about them, or a significant change raises their risk to medium or high (AUSTRAC). New members are a different story: they must be checked before they start using your address. 

How do we do this without adding friction for members?

This is the worry we hear most from operators. Your members are often start-ups, new companies with  busy founders, and they move between hot desks, suites and address-only plans. The answer is to build checks into sign-up, so they become part of joining rather than a chase later.

"Verify every member at sign-up, not just the ones using your address. Members often change plans from time to time, and it's much easier to do it once at the start than to chase people later." – Kaan Yuksel

Tank Stream Labs, which runs eight sites with more than 2,000 members, worked through exactly this. Visibl built its AML/CTF risk assessment and policy, trained its team and set up customer verification.

"When we learned our registered office address service brought us into AUSTRAC's regime, Visibl made it simple. Compliance went from a worry to something that just works." – Cassandra Diaz, COO, Tank Stream Labs

Flexible workspace keeps growing across Australia, with landlord allocation to flex space reported to have doubled over the past three years (Allwork.Space, reporting Flexible Workspace Australia data). The operators who make compliance part of a smooth member experience now will have one less thing to worry about as they grow.

Frequently asked questions

Do virtual office providers need to enrol with AUSTRAC?

If companies, partnerships or trusts can use your address as their registered office address or principal place of business, providing that address is a designated service under the AML/CTF Act. You'll need to enrol with AUSTRAC and meet the requirements of the AML/CTF Act and AML/CTF Rules, even if the address is free.

Can one compliance officer cover multiple co-working sites?

Yes. A business appoints one AML/CTF compliance officer to oversee day-to-day compliance, and that person can oversee every site, supported by a single program and clear processes for each location.

Do we need to verify members who only use a hot desk?

The designated service is providing a registered office or principal place of business address. If a member can't use your address that way, that membership may not be in scope. But because members often change plans (for instance, they may begin using the registered office address without notifying their provider), many operators choose to verify everyone at sign-up. Get advice on your specific memberships.

How long do we keep member records?

AUSTRAC requires most AML/CTF records, including customer due diligence records, to be kept for seven years from the end of the relationship.