As Australia moves closer to tranche 2 AML/CTF reform, the key challenge for law firms, conveyancers and real estate professionals is no longer understanding that change is coming. It is understanding what effective implementation looks like in practice.
AUSTRAC enrolments are now open. From 1 July 2026, newly regulated Tranche 2 businesses will come under AUSTRAC’s AML/CTF regime, with obligations commencing from this date and a final enrolment deadline of 29 July 2026 for businesses providing designated services upon commencement.
One of the clearest lessons from tranche 1 is that AML/CTF compliance cannot be treated as a box-ticking exercise. Firms do not need to become experts overnight, but they do need to make genuine, risk-based efforts to understand where their services could be exposed and to put appropriate controls in place. That is especially important in property, where real estate remains an attractive asset class for criminals seeking to move or store illicit funds. The broader purpose of the regime is to make it harder for serious and organised crime to exploit Australian businesses and the wider economy.
A strong risk assessment is the foundation of an effective AML/CTF program. The most useful question is not “what document do I need to fill out?” but “how could someone misuse our business, services or transaction flow?” That mindset helps firms focus on their effort where it matters most.
Most transactions will be low risk. That is exactly why resources need to be directed toward higher-risk scenarios, unusual behaviour, complex ownership structures, offshore funds, high-risk jurisdictions, sanctions of exposure, or patterns that do not make commercial sense. A good risk assessment should also be dynamic. Criminal behaviour changes, and controls need to evolve with it.
Another major lesson from tranche 1 is that having technology is not enough on its own. The real value comes from using it to reduce manual effort, improve consistency, and free people to focus on judgement and decision-making.
For many firms, the real operational burden is not just running identity, sanctions, or PEP checks. It is gathering data, repeating searches, reviewing records, maintaining audit trails, and ensuring consistency across staff and matters. Technology can reduce that burden significantly by guiding users through the right workflow, centralising checks, and improving record keeping. That matters not just for efficiency, but also for auditability and regulator confidence.
At the same time, technology does not replace human judgement. AML/CTF risk is not one-size-fits-all, and firms still need people who can assess what the results mean, identify red flags and decide when escalation is necessary.
A common issue in compliance programs is over-reliance on one or two people who “know AML”, while everyone else depends on them. That creates bottlenecks, inconsistency and operational risk.
The stronger model is to combine training with process-driven systems that guide staff through what needs to happen at each stage. When people are supported by clear workflows, they are less likely to rely on memory, old training or ad hoc workarounds. That creates a more consistent customer experience and a more defensible compliance position.
Tranche 2 compliance will also bring privacy obligations into sharper focus. OAIC guidance confirms that from 1 July 2026, tranche 2 reporting entities handling personal information for AML/CTF purposes will need to comply with the Privacy Act, and should collect only what is reasonably necessary. The guidance also makes clear that businesses do not need to retain scanned copies or photocopies of full identity documents for AML/CTF record-keeping purposes.
This is an important practical point. Firms still need to verify identity and keep evidence of the checks they performed, but that does not mean holding unnecessary copies of passports or drivers' licenses. Reducing the amount of sensitive identity information stored can also reduce cyber and data breach risk. In practice, privacy, cyber, fraud and AML should be treated as connected risks rather than separate compliance issues.
Another strong lesson from tranche 1 is that no sector can manage financial crime risk in isolation. Property transactions involve multiple parties, systems and decision points. Lawyers, conveyancers, real estate professionals and technology providers often see different parts of the same transaction.
Professionals and technology providers often see different parts of the same transaction.
The future state of effective AML/CTF compliance is likely to involve better information sharing, better quality reporting and less duplication across the transaction chain. For businesses preparing now, that means thinking not only about internal controls, but also about how due diligence, record keeping and risk signals can be managed more consistently across the broader ecosystem.
Tranche 1 has shown that effective AML/CTF compliance is not about having the longest policy or the most manual checks. It is about understanding risk, embedding the right controls into day-to-day workflows, using technology intelligently, and creating a culture where good decisions can be made consistently.
For property professionals preparing for tranche 2, that is the real opportunity: not just to meet a new regulatory obligation, but to build a more resilient, efficient and trusted way of working.
PEXA Clear helps property professionals move from guidance to practical implementation, with a solution designed to reduce friction, support consistent due diligence and make compliance easier to evidence. Book a demo to see how PEXA Clear can support your day-to-day workflows.
