Tranche 2 for Law Firms: What You Must Have in Place
Tranche 2 commenced on 1 July 2026. Here is what Australian law firms must have in place now that AML/CTF obligations are in force.
Australian law firms providing designated legal services are now subject to Tranche 2, which commenced on 1 July 2026. To be compliant, a firm must be enrolled with AUSTRAC, have a written AML/CTF programme in place, and have a designated Compliance Officer appointed — not just started, but finalised.
What must a law firm have in place by 1 July 2026?
The AML/CTF Act 2006 requires every reporting entity to have the following operational before the designated service commencement date: 1. AUSTRAC enrolment — submit your enrolment through AUSTRAC Online as a priority if it is not already complete. Confirmation arrives by email within a few business days. 2. Written AML/CTF programme — a two-part programme covering Part A (governance, risk oversight, AMLCO role, staff training) and Part B (customer due diligence procedures for each designated service). 3. ML/TF risk assessment — a documented assessment of the money laundering and terrorism financing risks specific to your firm's client base, services, delivery channels, and jurisdictions. 4. AML/CTF Compliance Officer (AMLCO) — a senior person formally appointed with responsibility for AML/CTF compliance, documented in the programme. 5. Customer due diligence procedures — identity verification and beneficial ownership processes ready to apply to the first client who triggers a designated service after 1 July.
What happens if a law firm is not enrolled by 1 July 2026?
Operating as an unregistered reporting entity is a civil penalty offence under the AML/CTF Act 2006. AUSTRAC has signalled active post-commencement auditing of Tranche 2 sectors, with legal practices among the priority cohorts. Penalties can reach millions of dollars for serious or sustained non-compliance, ranging from infringement notices through to Federal Court civil penalty orders.
Can a law firm still get compliant quickly?
Yes — if you act today. AUSTRAC enrolment takes under an hour online. The greater risk is not the enrolment form; it is having a defensible AML/CTF programme and functioning CDD procedures operationalised. A programme written but not implemented will attract scrutiny in any supervisory review. AMLify's legal practice module generates a AUSTRAC-calibrated programme in under an hour — see AMLify for legal practices.
Key Takeaways
- Tranche 2 commenced on 1 July 2026 — all obligations now apply
- Law firms must have AUSTRAC enrolment, a written AML/CTF programme, an ML/TF risk assessment, a designated AMLCO, and operational CDD procedures in place
- Enrolment alone is not sufficient — the programme and CDD workflows must also be finalised and operational
- Operating without enrolment is a civil penalty offence; AUSTRAC has signalled priority auditing of legal practices
- AMLify for legal practices can generate a compliant programme in under an hour
Frequently Asked Questions
Q: Does AUSTRAC give law firms a grace period after 1 July 2026?
AUSTRAC has not announced a formal grace period for Tranche 2 commencement. Obligations take effect on 1 July 2026 and post-commencement compliance is a supervision priority. AUSTRAC uses enforcement tools graduated by severity — a firm enrolled and demonstrably working towards compliance is in a far better position than one that has taken no steps.
Q: What designated legal services trigger Tranche 2 obligations for law firms?
Designated legal services include conveyancing, operating or managing a client trust account, forming or administering companies or trusts on behalf of a client, and managing or investing client funds. A law practice that provides any of these services — even occasionally — is a reporting entity under the AML/CTF Act 2006 and must enrol with AUSTRAC.
Q: Can a sole practitioner use AMLify to meet Tranche 2 obligations?
Yes. AMLify is designed for legal practices of all sizes, from sole practitioners through to large national firms. A sole practitioner's obligations under the AML/CTF Act 2006 are the same in scope as a large firm's — the platform scales the programme and CDD workflows to your actual transaction volume. Visit AMLify for legal practices to start setup.
This is general information only and not a substitute for legal advice.