I've enrolled with AUSTRAC. Am I compliant now?

Not yet. Enrolling with AUSTRAC is the first step, and it's an important one. To be compliant, you also need an AML/CTF program that your team actually uses every day.

If you've enrolled, well done. You've taken the step AUSTRAC is now checking for. This article covers what comes next, in plain English, so you can get on with running your business.

What has AUSTRAC just done?

On 30 September, AUSTRAC began issuing infringement notices to businesses it believes should have enrolled under the AML/CTF Act but didn't. The notices went to real estate, accounting and jewellery businesses that hadn't enrolled within 28 days of providing a regulated (designated) service. They followed formal information requests AUSTRAC sent in August (AUSTRAC; Real Estate Business).

AUSTRAC says around 90% of the businesses it first flagged have now enrolled or tried to. CEO Brendan Thomas's message to everyone else was simple: "If you're required to enrol with AUSTRAC, do it now" (Accountants Daily).

The notice amounts are $21,840 for a company and $4,368 for an individual, and they can accrue daily (Accountants Daily). AUSTRAC hasn't said how many notices it issued.

Why is enrolment only the start?

Enrolment tells AUSTRAC you exist. It doesn't show that you're managing money laundering and terrorism financing risk. Since 1 July 2026, regulated businesses have also needed to:

  • have an AML/CTF program, built on a risk assessment of your own business
  • appoint an AML/CTF compliance officer
  • carry out customer due diligence: verify identity, screen for sanctions, negative media and politically exposed persons, and risk-rate the customer
  • report suspicious matters and certain transactions to AUSTRAC
  • train your team and keep records
  • conduct personnel due diligence

The AML/CTF regime is profession agnostic. While it largely impacts real estate agencies and professional services, such as accountants and lawyers, this is due to the provision of regulated, designated services. It is the services themselves that result in firms being regulated under the regime. As such, not all services that an accountant or lawyer offer are in scope and businesses should seek advice on their specific obligations and can do so by speaking to certified AML specialists such as Visibl. 

What does AUSTRAC actually expect from a small business right now?

Best efforts, not perfection. AUSTRAC has been consistent on this. Speaking to the real estate sector ahead of the reforms, Brendan Thomas said AUSTRAC "will not penalise any businesses that are making genuine efforts to meet their obligations", and that "our aim is not box ticking compliance" (AUSTRAC).

So what counts as best efforts today? You've enrolled, and you have an AML/CTF program in place, whether that's AUSTRAC's starter program or your own. The businesses receiving notices are the ones that haven't shown even that.

Visibl founder Kaan Yuksel, a certified AML specialist and admitted lawyer, puts it this way:

"AUSTRAC does not expect perfection in compliance from commencement of the reforms, but they do expect best efforts for compliance. For real estate, and many other Tranche 2 sectors, it is an iterative approach. Put your best foot forward to comply, continually assess how you mitigate your risk better over time, and put in new controls accordingly."

The catch is that best efforts only count if you can show them. The risk for Tranche 2 businesses isn't imperfection. It's having nothing to show.

What will AUSTRAC look at next?

Our view is that the focus will move in three stages:

  1. Now to mid-2027: pressure on businesses that haven't enrolled. Early action is likely to target wilful non-enrollers, as a signal to the whole sector.
  2. Next: the question moves from "are you enrolled?" to "is your program actually working and informing your daily processes and actions, and are your teams trained and do they understand the program?" That means training and looking at customer due diligence records, risk assessments and reporting.
  3. Longer term: the forgiving window closes. What counts as best efforts in year one is likely to look like neglect by year three.

Tranche 1, where banks, casinos and other financial services have been regulated for years, offers a useful lesson. The largest AML penalties in Australia's history didn't come from one-off mistakes. They came from failures that ran for years across large volumes of transactions, from leaders who didn't know or didn't act, and from warning signs that were ignored rather than fixed.

Is there a gap between paperwork and practice?

Often, yes. In Visibl's Australia's AML Readiness Report 2026, 65.6% of the 61 businesses surveyed felt confident they'd pass an AUSTRAC review. Once every governance and practice measure was checked together, only 34.4% were fully ready.

The most common blind spot is identity checks. 75.4% believed their identity verification alone met their AML obligations. Of that group, 56.5% weren't completing at least one other required check, such as sanctions and PEP screening, beneficial ownership verification, or full KYC/KYB.

Kaan sees the same pattern in practice:

"In our years auditing businesses, it's almost always true that the policies themselves comply with the law and provide the right set of procedures to follow. But there's an understanding gap between what the policy says and what's happening in practice."

(Report methodology: self-selected sample of 61 real estate, legal and accounting businesses, fielded 31 July to 10 August 2026. Cite as Australia's AML Readiness Report 2026, commissioned by Visibl.)

What should I do this week?

  1. Confirm your enrolment. If you provide a designated service and haven't enrolled, contact Visibl today and we can enrol your business on your behalf.
  2. Check your risk assessment exists and fits your business. It should reflect the services you offer, your customer types, how you deliver services and the countries you deal with. Need help? Complete Visibl’s online risk questionnaire and you’ll receive a tailored risk assessment in minutes.
  3. Train your team. Make sure your team knows what to do when a customer comes back high risk, for example a politically exposed person. This doesn't have to be onerous: Visibl offers short online videos explaining the fundamentals, what to look for and how to respond.
  4. Read your own AML/CTF policy. Almost always the answers are in your policy with clear direction on what to do in varying scenarios.
  5. Look beyond ID checks. Confirm you're screening for sanctions and PEPs, verifying beneficial owners of companies and trusts, and risk-rating every customer.
  6. Keep the evidence. Training records, customer files and decisions should all be easy to find if AUSTRAC asks.

Frequently asked questions

Is enrolling with AUSTRAC enough to be AML compliant?

No. Enrolment is the first step. You also need an AML/CTF program, a compliance officer, customer due diligence, reporting, staff training and record keeping.

What happens if I didn't enrol with AUSTRAC on time?

AUSTRAC has started issuing infringement notices to businesses that didn't enrol within 28 days of providing a designated service. Notices are $21,840 for companies and $4,368 for individuals, and can accrue daily. Enrol as soon as possible and seek advice from certified AML specialists such as Visibl on your situation.

Does AUSTRAC expect small businesses to be perfect?

No. AUSTRAC has said it won't penalise businesses making genuine efforts to meet their obligations. You do need to be able to show those efforts.

Are ID checks enough for AML compliance?

No. Identity verification is one part of customer due diligence. You also need sanctions, negative media and PEP screening, beneficial ownership checks for companies and trusts, and a risk rating for each customer.

What will AUSTRAC focus on after enrolment?

We expect attention to shift to whether programs work in practice: customer due diligence records, risk assessments, team training and reporting.

Not sure where you stand?

Book a free Visibl compliance health check. One of our AML specialists will look at where your business is today and what to do next, in plain English. 


This article is general information only and isn't legal advice. Firms should seek advice on their specific obligations.