The TCSP Typology AUSTRAC Is Most Concerned About — Shell Companies, Layering and Enhanced CDD Australia 2026

Among all the Tranche 2 sectors, trust and company service providers sit closest to the mechanism criminals actually use. When AUSTRAC talks about gatekeepers, this is the gate it's most worried about — because professional service providers can, often unknowingly, build the very structures that hide dirty money.

The typology: shell companies and layering

The pattern to understand is layering through shell companies. It works like this:

• A client asks you to set up one or more companies or trusts.
• Those entities are stacked — companies owning companies, trusts holding shares, nominees inserted as directors or shareholders.
• The resulting structure is complex enough that the real beneficial owner is buried several layers down.
• Funds are moved through the structure ("layering") so their origin becomes almost impossible to trace.

Each individual step looks like ordinary corporate work. That's what makes professional service providers so useful to launderers — and why a TCSP can facilitate serious crime without ever intending to.

The red flags that should trigger a closer look

You're not expected to be an investigator, but you are expected to notice when a structure doesn't make commercial sense. Warning signs include:

• Unnecessary complexity — layered entities or offshore links with no genuine business rationale.
• Nominee arrangements that appear designed to obscure who's really in control.
• Reluctance to disclose beneficial owners, or vague answers about the purpose of the structure.
• Speed and secrecy — pressure to set things up fast with minimal questions.
• A mismatch between the client's profile and the scale or sophistication of what they're asking you to build.

When to escalate to enhanced due diligence

These signals are enhanced customer due diligence (ECDD) triggers. The reformed CDD framework is explicitly risk-based: where the money-laundering risk is higher — high-complexity structures, opaque ownership, higher-risk jurisdictions, or a politically exposed person (PEP) involved — standard checks aren't enough.

The practical problem is consistency. Whether a structure gets flagged for ECDD shouldn't depend on which staff member happened to onboard it or how busy the week was.

Make the risk call automatically

Veriqua's Customer Risk module uses AI-assisted risk scoring to flag high-complexity structures for ECDD automatically. Instead of relying on individual judgement to catch the layered, opaque, nominee-laden structures that warrant extra scrutiny, the platform scores each customer and surfaces the ones that need enhanced due diligence — consistently, on every engagement, with the reasoning recorded.

That protects your practice two ways: it raises the structures that genuinely deserve a second look, and it gives you a defensible, timestamped record showing you applied a risk-based approach — exactly what AUSTRAC expects from the sector it watches most closely. See AI risk scoring in two minutes, no login: demo.veriqua.com.au/start.