Your Accounting firm's ID checks aren't AML compliance. Here's what actually is

New research just landed that reveals a real compliance misconception for accounting firms: 75.4% of businesses believe their identity verification (VOI) checks alone satisfy their AML obligations.

They don't.

That's the headline finding from Australia's AML Readiness Report 2026, a survey of over 60 accounting, legal and real estate businesses with accountants making up the majority of the sample, in field a month after the 1 July 2026 Tranche 2 reforms took effect. It isn't a fringe issue. Of the businesses who believe VOI is enough, 56.5% are skipping at least one other check the law actually requires: sanctions and PEP screening, beneficial ownership verification, or full KYC/KYB. Across the whole sample, that's 42.6% of all businesses surveyed, more than two in five, operating on a false sense of compliance.

Here's the confusion in plain terms. VOI answers one question: is this person who they say they are? AML asks a much bigger one: could this client, this transaction, or this structure present a money laundering or terrorism financing risk? For an individual client, that means screening for sanctions and politically exposed persons. For a company, trust or partnership, which describes a large share of accounting engagements, it means identifying and verifying beneficial owners, sometimes several layers back. VOI doesn't touch any of that. It confirms identity, once, at a point in time. It has nothing to say about risk.

Why the gap between policy and practice

This isn't a story about firms cutting corners. It's a governance-versus-practice gap, and the report's numbers show exactly where it opens up: 91.8% of businesses have appointed a Compliance Officer, 82% have completed a formal risk assessment, 70.5% have a written AML/CTF program. But only 55.7% have trained their whole team on it, and only 34.4% are actually ready when governance and day-to-day practice are checked together; a 31-point gap between feeling ready (65.6%) and being ready.

Jesselyn Dang, Business Transformation Manager at HK Partners, put it plainly:

"Accountants are used to things being black or white, but there's a fair degree of grey in tranche 2 compliance. Understanding the legislation is one thing — the real challenge is embedding it into daily workflows."

Another accounting respondent was more blunt: "It's time-consuming — and honestly, I'm still not sure whether we fully comply."

That's the real risk for accounting firms right now; not ignorance of the law, but a compliance program that looks complete on paper and nobody has translated into what to actually do when a client turns out to be a PEP, or a trust has three layers of ownership to unwind.

Where generic customer verification software leaves a gap

A lot of firms responded to 1 July by bolting on a verification tool, software that checks a driver's licence or passport against a database and returns a green tick. That's useful, and it's necessary. It's also nowhere near the whole job, and treating it as the whole job is exactly the blind spot this research measured.

Generic, standalone verification software has a structural problem: it isn't connected to anything else. It doesn't know your firm's risk assessment, so it can't tell you a client should be risk-rated higher because of their ownership structure or the jurisdictions involved. It doesn't train your staff, so whoever runs the check has no prompt for what a PEP flag or an adverse media hit actually means, or what to do next. And it doesn't run a workflow, so there's no escalation path, no record of the decision, and no audit trail explaining why a client was or wasn't a concern.

Kaan Yuksel, Visibl's founder and an AML compliance specialist, sees this constantly:

"The policies themselves almost always comply with the law. The gap is between what the policy says and what's actually happening in practice, because people don't take the time to turn each procedure into a practical example. What do you actually do when base-level KYC tells you a client is a PEP? You genuinely need someone to explain it."

That's where firms end up exposed, not through bad intentions, but because a verification tool was never designed to carry a risk assessment, staff training and an escalation workflow. It was built to check a document. Almost everything AUSTRAC actually looks for sits outside that.

What to look for instead

If you're assessing whether your firm's AML setup will hold up, four things matter more than which VOI tool you use.

Your risk assessment, AML policy and your customer checks should be the same system, not two things you're manually reconciling. A client's risk rating will determine relevant controls, workflows and approvals, not sit in a document or system nobody connects to the customer or internal processes.

Your team needs to know what to do with a result, not just receive one. A sanctions hit or a PEP flag is meaningless if whoever's looking at it doesn't know whether to escalate, or what controls may need to be in place to navigate heightened risk.  

Your records need to explain the "why," not just the "what." AUSTRAC reviews decisions, not only outcomes and the gap between policy and practice shows up first in the records. Having role based workflows and well trained teams mean decisions are explainable and linked back to a company’s broader AML program; the risk assessment and policy. 

The cost needs to be predictable and justifiable. 41% of businesses surveyed named time or cost as their single biggest compliance challenge, and it's sharper for smaller firms - those under 20 staff report meaningfully lower confidence (3.58/5) and readiness (3.66/5) than firms with 20 or more staff (4.07/5 and 4.22/5). Having a compliance system in place that enables your teams to focus on their day job, not endlessly trying to interrupt policies or customer verification results can save hours of time. Time that would otherwise be costing your firm money. Look for a solution that gives you access to policies, training and specialist support along with affordable customer verification checks.  

A fixed-cost routine, not a black box

This is the gap Visibl was built to close. Instead of a standalone verification tool, Visibl connects a tailored, risk-based AML/CTF program, screening, staff training and audit-ready records into one system, so your AML program exists to support team members with the everyday tasks such as customer verifications and managing a potential high risk situation. Staff are trained on what a flag means before they ever see one, and every decision is recorded with the reasoning behind it. It's built for firms that don't have, and shouldn't need, a dedicated compliance team to make sense of Tranche 2, at a fixed cost that scales with the business. 

As Kaan puts it: "There is a reason banks invest in large compliance teams: AML compliance is a specialised skill learned through daily practice. With tens of thousands of newly regulated entities, there are not enough specialists in Australia for every business to hire one. Software has to help close the gap."

See where your firm actually stands

The businesses in this research weren't complacent, they were confident, and mostly wrong about why. Twelve months from now, when the first annual AML/CTF compliance reports fall due, that gap between paperwork and practice is what regulators will be testing.

If you're not sure whether your firm's current setup would hold up, Visibl's free AML Compliance Gap Assessment shows you exactly where the gaps are in about ten minutes, no obligation.

Start your free AML Compliance Gap Assessment

Read the full Australia's AML Readiness Report 2026 for the complete findings, methodology and practitioner interviews.