What AUSTRAC's Early Law Firm Reviews Are Finding
Three weeks after the Tranche 2 deadline, AUSTRAC's first law firm compliance checks are surfacing the same gaps. Here is what reviewers are flagging.
AUSTRAC's earliest law firm compliance checks since the 1 July 2026 Tranche 2 deadline are turning up the same gaps: unfinished risk assessments, CDD files with no evidence trail, and AML/CTF programmes that exist on paper but were never actually followed.
Why is AUSTRAC reviewing law firms so soon after the deadline?
Early Tranche 2 reviews focus on whether a reporting entity actually enrolled, appointed an AML/CTF Compliance Officer (AMLCO), and started operating a programme — not just whether a document exists. Law firms handling conveyancing, trust accounts, and structuring advice are a natural early target, since trust accounts are a known laundering vector.
What are reviewers actually asking for?
- Proof of enrolment — your AUSTRAC reporting entity number, current and correct
- A named, empowered AMLCO — someone who can show real reporting to partners, not just a title
- A signed-off ML/TF risk assessment — dated and specific to your practice areas
- CDD files — identity, source-of-funds, and beneficial ownership evidence for matters already underway
- Staff training records — attendance and dates, not a policy that training "will occur"
What gaps are showing up most often?
- Risk assessments copied from templates with no adaptation to the firm's actual clients
- CDD evidence scattered across matter files, email, and practice management software
- No ongoing monitoring — clients verified once at onboarding and never revisited
- AMLCOs appointed in name only, with no evidence of real oversight authority
What should a firm do if AUSTRAC makes contact?
Respond within the timeframe given and be upfront about gaps rather than papering over them — AUSTRAC treats a firm that co-operates and remediates in good faith very differently from one that misrepresents its position. AMLify's audit readiness tools for law firms keep risk assessments, CDD evidence, and training records in one exportable place.
Key Takeaways
- Early reviews check whether a programme is actually operating, not just whether documents exist
- Trust accounts make conveyancing work a natural focus for reviewers
- Template risk assessments and scattered CDD evidence are the most common gaps
- Ongoing monitoring is frequently missing entirely
- Co-operating and remediating quickly is treated far more favourably than concealing gaps
Frequently Asked Questions
Q: How soon after Tranche 2 started could AUSTRAC review a law firm?
There is no minimum waiting period. AUSTRAC can review any enrolled reporting entity providing designated services, and its early Tranche 2 activity has focused on confirming firms actually operationalised their obligations rather than just registering.
Q: Does a sole practitioner face the same scrutiny as a large firm?
The AML/CTF Act 2006 applies regardless of firm size, though AUSTRAC expects the programme to be proportionate to risk and scale. A sole practitioner still needs a risk assessment, an AMLCO, and CDD records, just scaled to a smaller practice.
Q: What happens if our risk assessment is out of date when AUSTRAC asks?
AUSTRAC treats an outdated risk assessment as evidence the programme is not genuinely operating, which can lead to a remediation direction, and for serious failures, infringement notices or civil penalty proceedings.
Q: Can we fix gaps after AUSTRAC has already made contact?
Yes, and AUSTRAC's guidance encourages it — remediating promptly after a review request is viewed far more favourably than having no plan. It does not erase the original gap, but acting quickly reduces the risk of formal enforcement.
This is general information only and not a substitute for legal advice.