AML/CTF Tranche 2 for accountants and bookkeepers

Published Tuesday 10 November 2026

Table of contents

• What is AML/CTF Tranche 2?
• Who the reforms may apply to: Designated services
• Key dates your practice needs to know
• What firms in scope need to do
• How to identify potential AML/CTF risk in your practice
• Apps that integrate with Xero
• How to use technology and training to stay compliant
• Make client checks easier to manage with Xero
• FAQs on AML/CTF Tranche 2 for accountants and bookkeepers

Key takeaways

• Since 1 July 2026, AML/CTF Tranche 2 obligations apply to new professional services, including some accounting and bookkeeping practices.
• Your practice is in scope only if you provide designated services. The Australian Transaction Reports and Analysis Centre (AUSTRAC) self-assessment tool can help you check.
• Practices in scope must apply to enrol with AUSTRAC within 28 days of starting a designated service. They also need an AML/CTF program covering customer due diligence, staff training, and record-keeping.
• Xero Partner Hub brings your client information and practice tools into one place, so it's easier to monitor clients. Xero-integrated apps can support parts of your AML/CTF program, such as identity verification, client onboarding, and documentation.

What is AML/CTF Tranche 2?

AML/CTF Tranche 2 is the expansion of Australia's anti-money laundering and counter-terrorism financing (AML/CTF) regulations to new professional services. These obligations have applied since 1 July 2026. Gatekeeper businesses commonly provide these services. They include real estate businesses, lawyers and legal services, dealers in precious metals, stones, and products, and professional services such as accountants.

These businesses act as intermediaries when clients manage assets and set up businesses. Extending the regulations to them is part of wider AML/CTF reforms designed to close the gaps criminals use to commit financial crimes. The reforms also bring Australian regulation in line with the global Financial Action Task Force (FATF) Recommendations.

For some accounting and bookkeeping practices, this means carrying out more checks on clients and reporting to AUSTRAC, the financial regulator.

Who the reforms may apply to: Designated services

AML/CTF Tranche 2 obligations apply only to practices that provide specific designated services. If you offer any of the following services, you could be in scope of the regulations:

• Providing a registered office
• Managing client funds, including the transfer of assets and accounts
• Creating or managing companies, trusts, or other legal entities
• Assisting clients with the sale of a business entity
• Assisting clients with the planning or execution of a company restructure

Practices offering tax compliance, business activity statement (BAS) preparation, and general bookkeeping services may not be in scope. Read AUSTRAC's professional designated services guidance and seek independent legal advice if you're unsure. You can also check if you need to enrol or register using AUSTRAC's self-assessment tool.

Key dates your practice needs to know

Two dates set the timeline for Tranche 2, and both have now passed:

• Enrolment for Tranche 2 entities opened on 31 March 2026
• AML/CTF obligations have applied to entities providing designated services since 1 July 2026

Practices already providing designated services on 1 July 2026 had to enrol by 29 July 2026. From here, the timing depends on when you start. Say your practice begins offering a registered office for clients. You must apply to enrol with AUSTRAC no later than 28 days after you start.

If your enrolment details change, you need to update them with AUSTRAC within 14 days of the change. AUSTRAC can enforce compliance and issue penalties, so enrol on time and keep your details current.

What firms in scope need to do

If your practice provides designated services, these obligations apply to you now. Here's what you need to do to comply with AML/CTF regulations:

1. Create an AUSTRAC Online account and apply to enrol no later than 28 days after you start providing a designated service. If you were providing designated services on 1 July 2026, the deadline was 29 July 2026, so enrol now if you missed it.
2. Update your enrolment details with AUSTRAC within 14 days of any change.
3. Have an AML/CTF program in place before you provide a designated service to a client. It needs a risk assessment for your practice, plus procedures, processes, and controls to manage and mitigate risks. AUSTRAC has an AML/CTF program accountants can use to get started.
4. Appoint a compliance officer who oversees your practice's approach to managing AML/CTF risk and handles communication with AUSTRAC.
5. Complete initial customer due diligence, also known as know your customer, before you start providing a designated service. Keep checking throughout the relationship, including identity verification and transaction monitoring.
6. Provide AML/CTF training for staff who work on compliance activities.
7. Submit an annual compliance report to AUSTRAC. Submit suspicious matter reports within 24 hours of a terrorism financing suspicion, or within three business days for other suspicions.
8. Submit threshold transaction reports for transfers of A$10,000 or more in physical currency, such as notes and coins (or the foreign currency equivalent), within 10 business days after the transaction.
9. Keep records on your AML/CTF program and compliance activities for at least seven years.

Your AML/CTF program should reflect the size and complexity of your practice. As your business grows, your exposure to risk may grow too, so update your program to match. Check AUSTRAC's guidance for accountants if you're stuck.

How to identify potential AML/CTF risk in your practice

The risks your practice faces are unique to your client base and the services you provide, so factor both into your risk assessment. Start with your practice's inherent risks. These are areas of your business that are naturally more exposed, with weaknesses criminals might exploit.

Accounting and bookkeeping practices have a close view of clients' bank accounts and financial records. That means you could see client activity that raises alarm. For example, you might notice unexpected large cash movements, high volumes of transactions in a short period, or sudden unexplained increases in client wealth.

Your ability to identify risk hinges on how well you know your clients. Store their information in secure practice systems, update it regularly, and perform checks throughout the relationship. Use AUSTRAC's accounting risk assessment framework to guide your approach.

Apps that integrate with Xero

For AML/CTF Tranche 2, accountants need a program containing procedures, systems, and controls to maintain compliance with regulations. There's a range of apps that integrate with Xero accounting software and can help you manage certain parts of compliance. They include:

• Identity verification apps handle the identity checking process for you and sync client data with Xero. You can set identity checks to trigger automatically at certain moments, so there's less manual admin for you.
• Digital signature and client data management apps store and centralise all client and contact data. They help you spot missing and outdated information, and get digital signatures from clients for sign-off.
• Client onboarding apps create a professional, branded onboarding experience that ticks the compliance boxes too. You can send onboarding forms securely, complete identity verification checks, and sync contact information with Xero.

You can find a selection of these apps on the Xero App Store.

How to use technology and training to stay compliant

Keeping tabs on your clients is easier when their information sits in a secure, searchable system. Xero Partner Hub gives you a view of key client information at a glance, and Xero Partner Hub plus Practice Management helps you manage jobs, time, and billing. That makes it easier to spot sudden changes in income or outdated contact information.

With Xero Partner Hub, your client information and practice tools sit in one place, so you can manage client work without moving between systems. Xero-integrated apps add more capability, and you can find and connect tools for identity verification, onboarding, and document management on the Xero App Store.

As your practice evolves, risk profiles change too. Alongside controls and procedures, give staff regular training on AML/CTF.

Make client checks easier to manage with Xero

With a clear AML/CTF program and connected systems, your clients get compliant onboarding and identity checks, and your practice lowers its regulatory risk. Xero Partner Hub keeps client records in one place, while Xero-integrated apps support identity checks.

Compliance work runs more smoothly when you and your clients share the same platform. Explore Xero plans for your clients and get one month free, or join the partner program to grow your practice with Xero.

FAQs on AML/CTF Tranche 2 for accountants and bookkeepers

These frequently asked questions cover what accountants and bookkeepers might want to know about AML/CTF Tranche 2.

Where can you get authoritative guidance on AML/CTF Tranche 2?

AUSTRAC is the primary source, with sector-specific guidance for accountants, a self-assessment tool, and an accounting program starter kit. CPA Australia, Chartered Accountants ANZ, the Institute of Public Accountants (IPA), and the Institute of Certified Bookkeepers (ICB) have also published member guidance. For advice specific to your firm's situation, consult a lawyer with AML/CTF expertise.

Does AML/CTF Tranche 2 apply to all accountants in Australia?

No. It applies only to practices providing designated services, so check AUSTRAC's guidance on designated services to see if the regulations apply to you.

If you're a BAS agent or bookkeeper, how do these changes affect you?

These AML/CTF changes may affect you, depending on the services you provide. You might only help clients make routine business payments, such as payroll, super, or creditor payments, under the client's authority. If that's part of your normal bookkeeping or BAS service, AUSTRAC has indicated it wouldn't usually be treated as a designated service requiring AML/CTF enrolment.

Review your service offerings, engagement terms, and payment authority arrangements carefully. If you think you may be affected, watch for new practical guidance from your professional body, such as ICB or the Australian Bookkeepers Network (ABN).

When do you need to enrol with AUSTRAC?

You must apply to enrol no later than 28 days after you start providing a designated service, as defined by AUSTRAC. Practices already providing designated services on 1 July 2026 had to enrol by 29 July 2026, so if your practice missed that date, enrol now.

What is an AML/CTF program?

An AML/CTF program is the framework and actions you put in place to prevent and address risks. The scale and complexity of your program should reflect the scale and complexity of your business; smaller practices generally have simpler programs than large firms.

Your program needs a risk assessment of your practice, assigned roles, and training for staff working on AML/CTF tasks. It also covers updated client processes and policies, identity checks, transaction and client monitoring, and annual and suspicious matter reporting to AUSTRAC. Review, test, and update your program regularly to reflect new and developing risks.

Do you need to verify the identity of all existing clients?

No. Existing clients are generally treated as pre-commencement clients, so you do not need to repeat identity checks solely because the new requirements have commenced.

However, if a client seeks a new service, their circumstances change significantly, or other risk factors arise, you may need to undertake additional identity verification or client due diligence. Practitioners must also continue to meet their broader Tax Practitioners Board (TPB) obligations, including knowing their client and maintaining appropriate client records.

Can Xero help your firm with AML/CTF compliance?

You can get a clearer view of your client records, assign tasks, and track your team's work with Xero Partner Hub and Xero Partner Hub plus Practice Management. These products are not AML/CTF compliance solutions and don't replace your firm's legal obligations. Xero-integrated apps in areas like identity verification and client onboarding may support specific compliance processes.