AUSTRAC Tranche 2 (from 1 July 2026): what newly regulated businesses need for KYC

From 1 July 2026, Australia's AML/CTF regime extends to around 100,000 previously unregulated businesses — often called the "Tranche 2" reforms. Newly regulated sectors will need to verify customer identities, screen against watchlists, report suspicious activity, and keep records for seven years. This is general information, not legal or compliance advice — confirm your obligations with AUSTRAC.

What Tranche 2 is

Australia's anti-money-laundering and counter-terrorism-financing (AML/CTF) regime, overseen by AUSTRAC, historically covered financial services, gambling and bullion. Tranche 2 extends it to a set of "designated services" provided by professions that were previously outside the regime.

Who's newly in scope

• Lawyers and conveyancers
• Accountants
• Real estate agents and property developers
• Trust and company service providers
• Dealers in precious metals and stones

Key dates

• 31 March 2026 — AUSTRAC enrolment opened.
• 1 July 2026 — obligations commence for in-scope designated services.
• 29 July 2026 — enrolment deadline if you were already providing designated services on 1 July.

What you'll need to do

The obligations centre on knowing who your customer is and monitoring the relationship:

• Customer identification / KYC — verify the identity of customers (and, for entities, their beneficial owners). See KYC vs KYB vs AML.
• Ongoing monitoring — keep customer information current and watch for unusual activity.
• Reporting — submit suspicious matter reports and required transaction reports.
• Recordkeeping — retain records for seven years.
• Maintain an AML/CTF programme proportionate to your risk.

How identity verification helps

The customer-identification step is where most of the manual effort — and risk — sits, and it's the part that automates cleanly:

• Read the customer's ID with ID document OCR and confirm it's genuine.
• Confirm a real, present person with liveness detection.
• Bind the person to the document with 1:1 face matching.

Together these give you a repeatable, auditable KYC step you can stand behind — see the use cases for how it fits regulated onboarding.

Getting started

1. Confirm whether you provide "designated services" and enrol with AUSTRAC if so.
2. Write an AML/CTF programme sized to your risk.
3. Put a reliable identity-verification step in your onboarding.
4. Set up ongoing monitoring, reporting and seven-year recordkeeping.

Frequently asked questions

When do the Tranche 2 reforms start?

Obligations commence on 1 July 2026. AUSTRAC enrolment opened on 31 March 2026, with a 29 July 2026 enrolment deadline for those already providing designated services on 1 July.

Who does Tranche 2 apply to?

Newly regulated sectors include lawyers, conveyancers, accountants, real estate agents, property developers, trust and company service providers, and dealers in precious metals and stones.

What identity checks does AML/CTF require?

You must verify customer identity (KYC), and for entities identify beneficial owners — typically via document verification plus a biometric check that the person is real and matches the ID.

How many businesses are affected?

Around 100,000 previously unregulated Australian businesses. This is general information; confirm your specific obligations with AUSTRAC.