Your Law Firm Is Now an AUSTRAC Reporting Entity — Here's What That Actually Means | AML/CTF Law Firms Australia 2026

For most of its history, Australia's anti-money laundering regime was something that happened to banks. From 1 July 2026, that changed. Under the Tranche 2 reforms to the AML/CTF Act, a wide range of legal work was brought inside the regime — and many practices became AUSTRAC reporting entities without changing a thing about how they operate.

This is a plain-English explainer of what triggered the obligation, which legal services are caught, and the practical first steps. It is general information for legal practices, not legal advice — your exact position depends on what your firm does.

What actually triggered the obligation

The regime does not regulate "lawyers" as a profession. It regulates specific activities the law calls designated services. Your firm is a reporting entity for AML/CTF purposes when it provides one or more of those services in the course of carrying on a business, with a connection to Australia. Provide none of them and you may have no obligations at all; provide even one and you are a reporting entity for that work.

AUSTRAC takes a broad view of "carrying on a business." A service can be caught even if it is provided infrequently, as a one-off, or without a separate fee — so low volume does not put you out of scope.

Which legal services are designated

The activities most likely to bring a legal practice into the AML/CTF regime include:

• Conveyancing — assisting a client to buy, sell or transfer real estate: preparing or reviewing the contract of sale and transfer documents, researching title, coordinating with lenders, and holding and disbursing funds at settlement.
• Handling client money or assets in connection with a transaction — receiving, holding, controlling or managing a client's funds, accounts, securities or other property when you're helping them plan or carry out a transaction.
• Company and trust formation or restructuring — creating, restructuring or helping to sell companies, trusts or other legal arrangements.
• Acting in certain roles — acting as (or arranging for someone to act as) a director, secretary, trustee, partner or nominee shareholder, or providing a registered office address.

Purely advisory work — giving legal advice, appearing in court, litigation — is not caught by the designated services as a standalone activity. The trigger is the transactional work: handling the funds, forming the structure, settling the property.

The three things to do first

If your firm provides one or more designated services, three foundational steps come first:

• Enrol with AUSTRAC. Enrolment opened on 31 March 2026. You generally must enrol within 28 days of starting to provide a designated service — which, for most solicitors already doing this work, means enrolling by 29 July 2026. Enrolment places your practice on AUSTRAC's Reporting Entities Roll.
• Appoint an AML/CTF Compliance Officer. This must be someone with enough seniority, authority and independence to oversee the program and have it taken seriously. In a small firm this is often a principal or partner, and the role carries real personal accountability.
• Develop your AML/CTF Program. This is the written framework governing how you manage money-laundering and terrorism-financing risk — a risk assessment plus your policies. You develop and maintain this program and produce it to AUSTRAC on request; you do not lodge it with AUSTRAC.

It is worth being clear-eyed about the stakes without overstating them: civil penalties under the AML/CTF Act apply per contravention and can run into the millions for a body corporate, and each affected matter can be a separate contravention. On top of that sit reputational exposure and potential disciplinary action from your state law society. AUSTRAC has signalled a supportive posture early on — while making clear that not knowing the rules will not be a defence.

Where Veriqua fits

Ninety days is less time than it sounds once you account for mapping services, enrolling, building the program, choosing identity-verification tools and training staff. This is the gap Veriqua is built to close. Veriqua is an Australian compliance operating system for AUSTRAC-regulated reporting entities, with legal-sector obligations and workflow templates pre-loaded — not a blank-slate tool.

It helps you map which of your services are designated, stand up and maintain your ML/TF risk assessment and AML/CTF policies, run KYC and beneficial-ownership verification on your clients, manage CDD records, monitor matters for suspicious activity and lodge SMRs inside their statutory deadlines. Two minutes, no login: demo.veriqua.com.au/start.