AUSTRAC hasn't changed its posture. It's changed phase.

AUSTRAC has started saying it out loud

This week AUSTRAC put a message in front of its LinkedIn audience that a lot of firms will not have seen coming: if your business is providing designated services, you should already be enrolled and meeting your AML/CTF obligations — and businesses that have not enrolled, or taken reasonable steps towards meeting their obligations, may face enforcement action.

It ran under a campaign tile headed “Consequences of non-compliance”, with the line: if you don't meet your obligations under AML/CTF law, we can take steps to enforce compliance, seek a penalty, or both. The link goes to AUSTRAC's own page setting out precisely what those steps are.

That is a public warning aimed at a specific group of people, and it is a shift in tone. But I don't think it's a shift in stance, and the difference matters for how you respond to it.

AUSTRAC published its regulatory expectations for the reforms on 4 July 2025, a full year before the newly regulated sectors came into scope. The document is still on their site, unamended. It sets out what the regulator expected of newly regulated businesses by 1 July 2026 — enrolled, with a program, a compliance officer, trained staff, and the ability to ask clients questions and report suspicious activity. And then it says, in plain terms, exactly where enforcement would go.

In the CEO's words, after 1 July 2026 AUSTRAC would focus its enforcement in the newly regulated sectors on entities who wilfully ignore the obligation to enrol, and entities it suspects are complicit with, or wilfully blind to, money laundering in their business.

That was written thirteen months ago. Nothing about it has been revised. What has happened is that we've crossed the date it was written about.

One word did change, and it's worth noticing

Put the two statements side by side, though, and there is a shift — just not the one people are reacting to.

The July 2025 document said enforcement would focus on entities that wilfully ignore the obligation to enrol. This week's post says businesses that have not enrolled, or taken reasonable steps towards meeting their obligations, may face enforcement action.

“Wilfully ignore” describes someone who knew and dodged. “Hasn't taken reasonable steps” describes someone who simply never got around to it. The second is a much wider net, and it catches the far more common case: the firm that fully intended to sort this out in July, got busy, and still has nothing written down.

I wouldn't over-read a social media caption as a change in legal test. But as a signal of where the practical threshold now sits, it's clear enough. The question being asked is no longer whether you deliberately avoided the regime. It's whether you did anything at all.

‘Education first’ was never ‘enforcement never’

Two different things got conflated during the run-up, and a lot of firms are still holding the wrong one.

AUSTRAC did say it does not expect perfection on day one. That statement is about the maturity of your risk judgement — your ability to spot what money laundering actually looks like in a conveyancing file or a trust account, which is a practice that improves with time. It was never a statement about whether you turned up.

Enrolment isn't a maturity question. It's binary. You are either on the Reporting Entities Roll or you are not, and if you are providing designated services without being on it, that is a contravention on any reading. There was never a version of the guidance where that part was going to be treated gently.

My view: this was always the sequence

I've been saying for some time that the education phase had a hard stop built into it, and that the stop wasn't discretionary. It's worth being clear about why, because it isn't impatience.

Australia is being assessed. The Financial Action Task Force mutual evaluation of Australia commences this year, and the Tranche 2 timetable was drawn tight precisely so the country would have a functioning regime to show. A regime that brought roughly 90,000 new reporting entities into scope, but where a large share of them never enrolled, is not a regime you can present to an evaluator. The pressure to close that gap is structural, and it doesn't come from AUSTRAC's mood.

So the question was never whether the enforcement phase would arrive. It was what the first move would look like.

Where I think this goes: data matching

Here is the part I'd encourage every principal to think through, because I believe it is the most likely mechanism and very few firms have priced it in.

The Reporting Entities Roll is a list of businesses that put their hand up. But every profession captured by Tranche 2 is already licensed, registered, admitted or accredited by somebody else — and those are lists too. They are public, they are structured, and they contain the two fields that matter: who you are, and what you're entitled to do.

• ASIC's company and professional registers, and the ABN record with its ANZSIC industry classification
• State and territory real estate agent licensing — Fair Trading, Consumer Affairs and their equivalents in each jurisdiction
• Legal practitioner rolls and current practising certificates, held by admission authorities and law societies
• Conveyancer licensing schemes, which sit with a different body in almost every state
• The Tax Practitioners Board register, plus membership of CA ANZ, CPA Australia and the IPA

Reconciling those against the roll is not difficult work. It is exactly the kind of thing government already does at scale — the ATO has operated a data-matching program against AUSTRAC transaction report information since 2021, currently running through to 2030. The capability is not hypothetical and the precedent is not new.

My expectation is that the first wave won't look like enforcement at all. I think it looks like correspondence: a letter noting that the recipient holds a current agent's licence, or a practising certificate, or a tax agent registration, in a category that provides designated services — and that no enrolment can be found against their ABN. Please explain, or please enrol.

That is a cheap, high-volume, defensible way to close a gap of tens of thousands of entities. It costs the regulator very little. And it changes the position of every firm that received one.

Why ‘we didn't think we were captured’ gets weaker from here

The enforcement test AUSTRAC published turns on wilfulness. That word is doing real work, and it cuts both ways.

A firm that looked at the regime, formed a considered view that a particular service line sits outside scope, wrote down the reasoning, and can produce it — that firm is in a defensible position even if the view turns out to be wrong. Getting scope wrong on the record is a different thing from ignoring the question.

A firm that never looked, and is now holding a letter that names its licence number, is in a materially worse position than it was the day before that letter arrived. Whatever ambiguity existed, the correspondence removes it. From that point, doing nothing is a choice with a date on it.

If you've decided you're out of scope, the thing worth doing this month is not re-litigating the decision. It's making sure the decision is written down, dated, and attached to the services you actually provide.

What “enforcement action” actually means

It's worth knowing what sits behind the phrase, because it is not only courtroom-scale litigation against banks. AUSTRAC has a graduated toolkit, and most of it is administratively cheap.

• Remedial directions — a written instruction that you have breached the Act and must take specified actions to comply
• Infringement notices — which cover, among other things, failing to designate an AML/CTF compliance officer and failing to document, approve and follow your program
• Enforceable undertakings — binding commitments AUSTRAC can take to the Federal Court if you breach them
• Civil penalty orders — up to 100,000 penalty units for a body corporate, and 20,000 for an individual

Look at the second one closely, because it is the one that should concentrate the mind. Infringement notices attach to precisely the obligations an unprepared firm has skipped: no compliance officer, no documented program, or a program that exists on paper but isn't being followed. That is not a power reserved for egregious cases. It is quick, it is cheap for the regulator, and it fits the profile of a firm that did nothing.

What actually protects you

AUSTRAC gave a fairly pointed warning in the same document, and it's the line I'd put in front of anyone about to buy a policy template: resist the urge to implement programs or processes that create the impression of compliance but have minimal impact on the risk of money laundering.

Read alongside the enforcement test, that's reasonably clear about what a regulator wants to see. Not a binder. Evidence that you identified your risks, made decisions about them, and can show the working.

• Enrolment, or a written and dated scope decision explaining why you don't need one
• A risk assessment that describes the clients and services you actually have, not a generic one
• Customer due diligence that leaves a record — what you checked, when, and what you concluded
• Ongoing monitoring, so a change in a client's circumstances reaches you before it reaches someone else
• A compliance officer who has made and recorded at least one real decision

None of that is exotic. Most of it is the difference between a firm that can answer a letter in an afternoon and a firm that spends three weeks reconstructing what it did.

If you're not enrolled

The practical steps are the same as they were in July, and they're set out in what to do if you missed the enrolment deadline. If you're still unsure whether you're captured at all, start with how scope actually works — and write down what you conclude.

The one thing I'd say plainly: the window where being late looked like an administrative oversight is closing. It closes faster once your licence number is sitting in a spreadsheet next to an empty enrolment field.

True Comply exists for firms that would rather be able to prove this than argue about it — program, screening and an evidence trail that builds as you work. If you want a straight answer on where you stand, start the conversation.