The Australian AML/CTF Act - A Plain-English Overview

What is the AML/CTF Act?

The Anti-Money Laundering and Counter-Terrorism Financing Act 2006is Australia’s primary AML/CTF legislation. It establishes a risk-based framework designed to detect, deter and disrupt money laundering, terrorism financing and other serious financial crime.

The Act works with the AML/CTF Rules 2025 and AUSTRAC guidance. The Act sets the legal framework; the Rules and current guidance explain operational requirements for areas such as AML/CTF programs, customer due diligence, reporting and record keeping.

What changed in 2026?

Updated obligations began for existing reporting entities on31 March 2026. From 1 July 2026, newly regulated businesses providing designated services also have AML/CTF obligations.

• Risk-based programs: businesses need an AML/CTF program that identifies and manages their actual money-laundering, terrorism-financing and proliferation- financing risks.
• Clearer governance: a reporting entity needs an eligible AML/CTF Compliance Officer and documented oversight.
• Current CDD and reporting requirements:customer due diligence, suspicious-matter reporting, transaction reporting and record keeping form part of the operating framework.

Does it apply to a real estate business?

A business becomes subject to AML/CTF obligations when it provides a designated service with a geographical link to Australia. For real estate, AUSTRAC’s guidance covers brokering the sale, purchase or transfer of real estate, and certain developers or businesses selling real estate without an independent agent.

Whether a particular service is regulated depends on the service and circumstances. Do not rely on a generic industry label. Read the current AUSTRAC designated-services guidance and seek advice where the answer is unclear.

Core obligations in practical terms

1. Obligation 01
   Enrol with AUSTRAC

   AUSTRAC set 29 July 2026 as the transition enrolment date for newly regulated businesses that began providing designated services from 1 July 2026. The general enrolment rule is within 28 days of starting a designated service — check current AUSTRAC guidance for your circumstances.

2. Obligation 02
   Maintain an AML/CTF program

   Develop and maintain a documented program based on your risk assessment, controls, governance, staff training and review process.

3. Obligation 03
   Know your customer

   Apply the required customer due diligence, including identity, beneficial ownership and risk assessment steps, at the time required for the designated service.

4. Obligation 04
   Monitor and report

   Identify suspicious activity and submit an SMR through AUSTRAC Online within 24 hours for terrorism-financing suspicions, or within 3 business days for other suspicions. Other reporting obligations may also apply.

5. Obligation 05
   Keep required records

   Keep records that demonstrate compliance with your program, CDD and transaction obligations. Most relevant records have a 7-year retention period, but the exact rule varies by record type.

6. Obligation 06
   Review and improve

   Keep your risk assessment and program current as your business or risks change, and conduct the evaluations and reviews required by the Act, Rules and your policies.

Key dates

1. 10 December 2024
   Amendment Act received Royal Assent
   The 2024 reform legislation established the staged changes to Australia’s AML/CTF framework.
2. 31 March 2026
   Updated existing-entity obligations
   Updated obligations took effect for businesses already regulated by AUSTRAC.
3. 1 July 2026
   Newly regulated services commence
   AML/CTF obligations began for newly regulated designated services, including relevant real estate services.
4. 29 July 2026
   Transition enrolment date (completed)
   AUSTRAC set this as the transition enrolment date for newly regulated businesses that began providing designated services from 1 July 2026. Apply to enrol within 28 days of starting a designated service — check current AUSTRAC guidance for your circumstances.

What AUSTRAC expects now

AUSTRAC expects newly regulated businesses to be enrolled, have an AML/CTF program and Compliance Officer, train staff on their program, and be ready to report suspicious matters.

AUSTRAC’s current statement recognises that businesses will continue to embed new practices after 1 July. Its expectation is effort, not perfection, alongside genuine progress in managing risks and meeting obligations.

What happens when obligations are not met?

AUSTRAC can take compliance and enforcement action, seek a penalty, or both. Its current guidance explains tools including compliance monitoring, remedial directions, injunctions, enforceable undertakings and notices to reporting entities.

Outcomes depend on the law, facts and circumstances. For current enforcement information or penalty advice, use AUSTRAC guidance and obtain independent professional advice.

AML/CTF readiness checklist

Use this as a prompt for a proper review of your business. It is not legal or compliance advice.

• I know whether my business provides designated services.
• We have completed, or are completing, the required AUSTRAC enrolment.
• We maintain an AML/CTF program based on our risk assessment.
• We have appointed an eligible AML/CTF Compliance Officer.
• We understand the required CDD timing and record keeping.
• Our staff can identify, escalate and report suspicious matters without tipping off a customer.
• We can retrieve the records needed to demonstrate compliance.

Frequently asked questions

Sources and further reading