AML/CTF Compliance for Lawyers in Australia: What You Need to Know in 2026

From 1 July 2026, Australian lawyers who provide certain designated services must comply with AUSTRAC's AML/CTF obligations. This guide explains exactly what's required, which legal services are captured, and how to meet your obligations efficiently.

Which legal services are captured by Tranche 2?

Not all legal work is captured. You must comply when you assist a client in connection with:

• The buying or selling of real estate
• The management of money, securities or other assets
• The creation, operation or management of companies, trusts or partnerships
• The buying or selling of business entities
• The creation of express trusts

If your practice is purely litigation or advisory with no property, trust or company transactions, you may not be captured. But most general practice firms will be.

What AUSTRAC requires from law firms

If you provide a captured designated service, you must:

• Enrol with AUSTRAC by 29 July 2026
• Develop and maintain a written AML/CTF program
• Appoint an AML/CTF Compliance Officer
• Conduct customer due diligence (KYC) before providing services
• Screen clients against sanctions and PEP lists
• Submit Suspicious Matter Reports (SMRs) when required
• Maintain records for 7 years

Customer due diligence for legal clients

For individual clients, you must verify their identity using reliable documents — passport, driver's licence or Medicare card. For company or trust clients, you must verify the entity, identify all beneficial owners (anyone with 25%+ ownership), and verify each director or trustee individually.

This can be done through biometric identity verification software, which confirms a client's identity against government-issued documents in minutes — far faster than photocopying and certifying documents manually.

PEP and sanctions screening

Every client must be screened against the DFAT Consolidated Sanctions List and checked for Politically Exposed Person (PEP) status. PEPs — politicians, senior government officials, judges, and their close associates — require Enhanced Due Diligence (EDD) before you act for them.

When does the obligation begin?

The obligation to conduct KYC begins when you start to provide a designated service — not when you open a file. For conveyancing matters, this is typically when you accept instructions on an actual transaction, not when you provide general advice.

What's the penalty for non-compliance?

Civil penalties can reach $33 million per contravention for a corporate entity. Law firms that fail to enrol, maintain a program, or conduct KYC face serious regulatory and reputational risk.

How CompliDesk helps law firms

CompliDesk is built for Tranche 2 entities including law firms. It guides your team through every client's compliance checklist — identity verification, questionnaire, screening and risk assessment — and generates a compliance evidence pack you can produce on request from AUSTRAC or during a PI insurance review.

Related reading: Customer due diligence explained · AUSTRAC record keeping requirements · AUSTRAC Tranche 2 complete guide · Frequently asked questions