- with Senior Company Executives, HR and Finance and Tax Executives
- in United Kingdom
- with readers working within the Banking & Credit, Business & Consumer Services and Insurance industries
Over the past year, AUSTRAC has been busy on several fronts (making good use of its largest budget and staffing numbers to date). Key areas of focus have included:
- finalising, and preparing industry for, the suite of regulatory reforms that are being introduced through the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (Amended AML/CTF Act) and Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (New Rules);
- releasing a suite of guidance notes in relation to compliance with key areas of reform;
- continuing to pursue a range of enforcement actions, including those aligned with its latest Fintech and cash intensive sector regulatory priorities; and
- seeking new powers to ban high-risk services.
Regulatory reform
The reforms being introduced to the Australian AML/CTF landscape as a consequence of the Amended AML/CTF Act and Rules promise to be one of the most significant regulatory developments to be rolled out in the coming year, for both existing and new reporting entities alike.
The reforms affecting existing reporting entities will largely take effect from 31 March 2026, with those for new (or "Tranche 2") reporting entities from 1 July 2026.
For existing and new reporting entities alike, work to prepare for the reforms should by now be well underway.
In the case of existing reporting entities, some of the key reforms that should already be top of mind include:
Changes to risk assessment and program requirements
The reforms in this area can be expected to require substantial re-writing of existing risk assessment and policy materials, not only to cater to changes in terminologies and lay out but also to address a broader range of specific expectations in the updated regime as described below.
Structural changes to reporting groups and flow on impacts
The reforms introduce the concept of a "lead entity" of a reporting group. Among other things, the lead entity must not be controlled by another member of the group that provides designated services. Being a lead entity results in additional compliance obligations and potential exposure to regulatory penalties for non-compliance within the group. Reporting entities should therefore carefully consider what entity is appropriate to be the lead entity if a reporting group is formed, and how that entity will manage its increased regulatory obligations.
Structural changes to governance obligations and exposures
Reporting entities will now need to appoint a "senior manager" to make key decisions relating to the AML/CTF program and certain business relationships. Obligations on senior managers include approval for continuing relationships in connection with certain PEPs, nested services and reliance arrangements. These approvals cannot be delegated. Reporting entities should therefore consider having multiple senior managers responsible for different AML/CTF functions, to ensure commercial matters are not delayed due to approval requirements.
Sanctions compliance
Reporting entities will need to include proliferation financing considerations in their AML/CTF risk identification mitigation and management processes and ensure that their AML/CTF policies include sanctions-related policies and procedures. Reporting entities will need to take care in preparing sanctions controls for the purpose of the Amended AML/CTF Act. It will unlikely be appropriate to merely lift and shift an existing financial sanctions compliance framework into the AML/CTF policies developed for the purpose of the Amended AML/CTF Act.
New customer due diligence framework (CDD)
The reforms involve a substantial rewrite of the existing approach to CDD, including introducing a new framework for undertaking initial customer due diligence (ICDD). For example, the New Rules prescribe minimum Know Your Customer information that must be collected as part of ICDD prior to the provision of a designated service and removes safe harbour procedures for meeting minimum requirements. The New Rules also list the circumstances where the verification of certain ICDD information can be delayed until after providing a designated service.
Refinement of transfers of value
Changes to designated services connected with transfers of value, and flow on obligations, are some of the more significant changes in the reforms. These are expected to have a material impact on the systems of many reporting entities. Key changes include new rules for determining who is an "ordering institutions" and "beneficiary institution", changes to what information needs to be collected, verified, monitored for and passed on (such as the clarification that "payee information" is the payee's "full name"), and various exemptions from travel rule requirements. For entities with operations outside of Australia, some relief may be available where transfers of value occur within one jurisdiction. However, whether this relief is available will depend on the facts and whether the controls put in place ensure the conditions of the modification can be satisfied.
In early 2026, AUSTRAC announced that it is working with the Department of Home Affairs to finalise transitional rules designed to provide reporting entities with additional time to comply with certain new obligations.
Most notably, the proposed transitional rules are expected to include:
- a three-year transitional period for existing reporting entities to comply with the new ICDD requirements. During this period, such reporting entities may continue to use their existing applicable customer identification procedures;
- a deferral of new international value transfer service reporting requirements until 2029, with existing IFTI obligations continuing in the interim;
- extended timeframes for notifying AUSTRAC of AML/CTF compliance officers;
- staggered deadlines for initial independent evaluations for Tranche 2 reporting entities; and
- clarification of registration arrangements for remittance providers and virtual asset service providers.
As industry prepares for implementation, final updates to regulatory guidance and timing requirements should be kept under review.
Increased enforcement and expanded power
In July 2025, AUSTRAC released its regulatory priorities for the 2025-26 financial year that included improving risk management within the digital currency exchange sector, virtual asset service providers, and by entities whose exposure to cash creates particular vulnerabilities. This has subsequently translated into various recent enforcement actions including:
|
In October, the Australian government announced it will seek to introduce a new power which will enable the AUSTRAC CEO to restrict or prohibit certain high-risk products, services and delivery channels. This power is proposed to be aimed at reducing money laundering risk associated with perceived high-risk products such as Crypto ATMs.
In December, the government released a consultation paper seeking feedback on the proposed new framework. The new framework will be introduced as an amendment to the AML/CTF Act, although the exposure draft has not yet been released.
Under the proposal, the AUSTRAC CEO would be able to exercise the new power having regard to a non‑exhaustive list of factors, including whether the exercise of the power is in the public interest to prevent or disrupt serious financial crime, and whether there are viable alternatives that would allow the relevant designated services to continue to be provided.
The proposed framework would require the AUSTRAC CEO to undertake mandatory consultation with persons reasonably likely to be affected by a decision before exercising the power. However, the consultation paper notes that there may be circumstances in which consultation is not practicable, such as if a decision must be made urgently. In those circumstances (which the consultation paper does not further define or explain), a failure to consult would not invalidate a decision made by the AUSTRAC CEO.
These powers, if enacted, would represent a significant regulatory intervention into otherwise lawful activities and could materially impact business models in high-risk sectors.
Looking ahead to 2026
As AUSTRAC enters 2026 with a new regime, expanded powers and a clear focus on high-risk sectors, reporting entities should expect a regulatory environment that is both assertive and strategic. The introduction of the Amended AML/CTF Act and New Rules marks a significant shift, requiring entities to overhaul compliance frameworks, strengthen governance, and embed sanctions and proliferation financing considerations into their risk programs. While AUSTRAC's enforcement actions in 2025 signal a willingness to act decisively, we anticipate its approach in 2026 will be increasingly targeted, by zeroing in on vulnerabilities in digital assets, cash-intensive businesses, and complex transfer-of-value arrangements. For reporting entities, proactive preparation and robust internal engagement will be critical to navigating this evolving landscape.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
