Four Months Into Tranche 2: Accounting Firm Compliance Gaps

Four months after the 1 July 2026 Tranche 2 deadline, AUSTRAC's early supervisory contact with accounting firms is turning up the same handful of gaps -- not missing programmes, but programmes that were built to pass the deadline rather than to run day to day.

What Is AUSTRAC Finding at Accounting Firms?

Most firms enrolled on time and had a written AML/CTF programme in place by 1 July. Where AUSTRAC's early checks are landing is further in: customer due diligence that was done once at onboarding and never refreshed, risk assessments that still read like the template they were adapted from, and ongoing customer due diligence (OCDD) that exists on paper but isn't actually triggered by account or transaction changes.

Why Does a "Compliant on Paper" Programme Still Fail Review?

A programme written to satisfy the deadline is a point-in-time document. AUSTRAC's expectation is that it operates continuously -- that risk ratings get revisited when a client's circumstances change, that staff can explain the programme rather than just produce it, and that the firm can show a record of decisions, not just a policy describing how decisions should be made. Four months in, the firms AUSTRAC is flagging are the ones that treated 1 July as a finish line.

Where Are the Specific Gaps?

1. Stale risk assessments -- the firm-wide ML/TF risk assessment hasn't been revisited since onboarding, even though client mix or service lines have changed.
2. Thin ongoing monitoring -- CDD is completed once but there's no process for re-checking a client after a material change, such as a new beneficial owner or a jump in transaction value.
3. Training that stopped at launch -- staff hired after 1 July haven't completed AML/CTF induction training, and no refresher has been scheduled for existing staff.
4. No evidence trail -- decisions about risk ratings or enhanced due diligence aren't documented, so the firm can describe its process but can't demonstrate it was followed.

What Should Accounting Firms Do Now?

Start with the risk assessment: if it hasn't been reviewed since enrolment, that's the first thing to update, and it should reflect the firm's actual client base today, not the one assumed when the document was drafted. Next, confirm ongoing monitoring actually triggers on real events -- a new director, a change in instructing solicitor, an unusual transaction size -- rather than sitting dormant between periodic reviews. AMLify for accounting firms automates these triggers and keeps a running record of every risk decision, so the evidence AUSTRAC expects is generated as a by-product of normal client work rather than assembled after the fact.

Key Takeaways

• AUSTRAC's early reviews of accounting firms are finding programmes that were built for the 1 July deadline but haven't operated since
• The most common gaps are stale risk assessments, thin ongoing monitoring, lapsed training, and missing decision records
• A programme has to run continuously -- risk ratings revisited on change, not just set once at onboarding
• Documenting why a decision was made matters as much as the decision itself
• AMLify keeps risk assessments current and logs every monitoring decision automatically

Frequently Asked Questions

Q: Has AUSTRAC started formal enforcement action against accounting firms yet?

Early contact so far has mostly taken the form of supervisory reviews and requests for information rather than penalties. That doesn't mean low risk -- these reviews are how AUSTRAC builds the evidence base for later action, so gaps identified now are worth closing before a formal review follows up on them.

Q: How often should a firm update its AML/CTF risk assessment?

At minimum whenever the firm's client base, service lines, or risk exposure materially changes, and as a matter of practice at least annually even without a trigger event. A risk assessment that hasn't moved since enrolment is itself a red flag to a reviewer.

Q: Does ongoing customer due diligence apply to existing clients, not just new ones?

Yes. OCDD obligations apply for the life of the client relationship, not just at onboarding, which is why a process that only runs once tends to be the first gap AUSTRAC identifies.

Q: What's the fastest fix for a firm that hasn't reviewed its programme since July?

Re-run the risk assessment against the firm's current client base first, since everything else -- CDD intensity, monitoring triggers, training priorities -- flows from it. Trying to fix monitoring or training before the risk assessment is current just locks in the same gaps under a new process.

This is general information only and not a substitute for legal advice.

Related articles