An Accountant's Guide to Tranche 2 AML/CTF Obligations in 2026

This is an IT operator’s perspective on the systems and software Australian accounting practices are using to meet AUSTRAC’s Tranche 2 AML/CTF regime. It isn’t legal advice or a compliance opinion. Whether any particular control satisfies your obligations is your AML advisor’s, your compliance officer’s, or your professional body’s call. We implement the technical stack. They sign off on whether it clears the bar.

A 35-seat accounting practice doing company formations and trustee work alongside its tax and assurance lines is the same kind of business AUSTRAC is looking at when it talks about Tranche 2. From 1 July 2026, that practice has the same shape of obligation as a remittance dealer or a bullion trader. The compliance machinery the practice has in place today, almost certainly built around the Tax Practitioners Board’s expectations and the firm’s professional body, does not cover what AUSTRAC is going to ask for.

This is the largest expansion of the AML/CTF regime since the 2006 Act took effect. Accountants are inside it from day one. The firms starting their preparation in the first half of 2026 will be operational on commencement. The firms still treating it as a 2027 problem in May will not.

What does Tranche 2 require from accounting firms?

Tranche 2 captures accounting practices that provide certain “designated services” and brings them into the AML/CTF regime as reporting entities. The captured services are not the firm’s whole offering. They are a defined set of activities. Acting as or arranging for someone to act as a director, trustee, partner, or nominee shareholder. Forming companies, partnerships, or trusts. Buying or selling business entities on behalf of a client. Receiving, holding, controlling, or transferring money or property as part of any of the above.

A pure tax-and-compliance practice with no company-formation work, no trustee appointments, no nominee work, and no client-money handling is probably outside Tranche 2’s scope. A practice doing two of those activities a month is squarely inside it. Most multi-disciplinary firms in CCP’s size band (20 to 250 staff) sit on the inside.

Once captured, the firm enrols with AUSTRAC, nominates a compliance officer (the AUSTRAC term is “AML/CTF compliance officer”), writes a tailored AML/CTF programme, identifies and verifies clients before providing the captured service, monitors the matter, reports suspicious matters and threshold transactions, and retains records for seven years. This is closer to the regime banks operate than to anything CA ANZ or CPA Australia has historically required.

Which accounting practices are most exposed?

Mid-size general practices with a mix of compliance, advisory, and corporate-services work. Specialist insolvency, trustee-services, or virtual-CFO firms that handle client money or take board appointments as a matter of course. Boutique practices doing significant company-formation or trust-establishment volume.

A pure SMSF-administration practice, by contrast, is mostly outside Tranche 2 because SMSF administration generally does not include the captured designated services. A practice doing Tax-Practitioners-Board-only work has its existing TPB obligations and is not pulled in by Tranche 2. A small advisory firm that has trustee appointments incidentally (one or two as a favour to long-standing clients) is captured for those services and needs to decide whether to retain the work, refer it out, or build the programme to support it.

The practical point is that capture is determined by the activity, not the firm’s name on the door. Accountants who sit on a client trustee board are reporting entities for that activity even if they would describe themselves as advisers. The compliance-officer’s first job is to map every captured activity in the firm and decide which are commercially worth retaining once the cost of the AML programme is on the table.

What systems does the regime actually demand?

Identity verification at onboarding, beneficial-ownership verification for company and trust clients, ongoing transaction and matter monitoring, suspicious-matter reporting into AUSTRAC’s portal, immutable record retention for seven years, and audit-grade evidence generation for every claimed control. Six technical building blocks. Most practices have one or two on day one.

The full picture breaks out as follows. Customer due diligence: the firm needs a reliable way to verify who the client actually is, with documentary evidence stored against the client record. For company and trust clients, who ultimately controls the entity, with the beneficial-ownership chain documented to AUSTRAC’s standard. PEP and sanctions screening at onboarding and on an ongoing basis. Ongoing monitoring: the firm needs to detect unusual patterns across the lifetime of an engagement, not just at the start of it. Threshold and suspicious-matter reporting: the plumbing to file SMRs and TTRs into AUSTRAC’s portal within the regime’s reporting windows. Record retention: every document used in customer due diligence, every file note, every transaction record kept for seven years and producible on request. Control evidence: the firm has to demonstrate to an auditor not just that a control exists, but that it actually operated.

What will most accounting practices already have?

Document storage and access control are partially covered if the firm runs a proper Microsoft 365 tenant with retention labels and conditional access. Practice-management systems handle some workflow tracking. Almost nothing else is in place.

The technical baseline that AUSTRAC implies is significantly tighter than what tax-only or assurance-only firms have ever needed. A practice using a basic Microsoft 365 Business Standard tenant, a practice-management system on its default configuration, and a folder-share model for client documents is going to be missing the audit-grade access controls, the retention discipline, and the evidence-generation capability the regime expects. Document storage in folder shares without access controls is a particular weak spot we see often.

The good news is that closing the gap on retention, access, and audit logging is well-trodden ground in Microsoft 365. The licence step-up and the configuration work are predictable. Identity verification, ongoing monitoring, and AUSTRAC reporting integration are the three building blocks that genuinely have to be built or bought from scratch.

When does AUSTRAC’s Tranche 2 start for accountants?

Enrolment opens on 31 March 2026. The firm’s AML/CTF programme has to be in place by 30 June 2026. Operational obligations commence 1 July 2026. Enrolment with AUSTRAC and registration of the compliance officer must be completed by 29 July 2026. Those four dates govern 2026 planning.

Working backwards from 1 July 2026, a practice that wants to commence operationally on day one should have its AML/CTF programme document drafted, its compliance officer trained, its identity-verification workflow tested with real clients, its retention labels applied across the document store, and its threshold-transaction monitoring switched on by mid-May 2026. The buffer between mid-May and 1 July absorbs the bugs, vendor delays, and client-acceptance edge cases that always appear once real engagements start moving through the new workflow.

The most common timeline mistake we see in early conversations is firms assuming they have until 29 July 2026 to be operational because that is the enrolment-closure date. The programme has to be operational on 1 July; the 29 July date is the back-end administrative deadline. Confusing the two compresses the preparation runway by a month.

Is the Tranche 2 rollout staged for smaller firms?

No meaningful staging by firm size has been announced. The obligations apply from 1 July 2026 regardless of firm headcount. AUSTRAC’s transitional rules contain narrow technical accommodations during the commencement window but no carve-out from the core programme obligation.

That is a real burden for smaller practices. A 15-seat firm doing a handful of company formations a year has the same programme obligation as a 200-seat firm doing a hundred. The implementation choices narrow at the small end (less appetite for a six-figure platform spend, less internal capacity to operate sophisticated tooling), but the regime does not grant relief based on size. Smaller practices are increasingly looking at whether the captured work is worth retaining at all once the cost of the programme is in the budget.

What software is worth shortlisting for Tranche 2 in an accounting practice?

Three patterns are working for mid-size Australian accounting firms preparing for Tranche 2. An integrated AML platform built for professional services (First AML, Kyckr, NameScan and similar) that handles identity verification, beneficial-ownership and PEP screening, ongoing monitoring, and SMR filing through a single interface. A layered stack where existing identity tooling integrates with a dedicated identity-verification service, ongoing-monitoring rules run inside the practice-management system, and SMR submissions go through a specialised filing tool. Or a tight bolt-on for practices whose practice-management software already includes an AML module (some Xero Practice Manager, MYOB, and CCH iFirm-adjacent integrations exist, with varying maturity).

The shortlist depends on how much captured work the firm actually does. A firm with a steady company-formation and trustee book benefits from the integrated platform. A firm with sporadic captured work will not get value out of a six-figure platform licence and is better served by layering point solutions.

Two warnings on the platform market. First, the Tranche 2 AML market in Australia is genuinely young. Some vendors that have done excellent work for banks and AFS licensees have less of a track record with accounting workflows; their interfaces and field structures may not match how an accountant captures and verifies a corporate client. Second, practice-management AML modules vary widely in depth. Run a real captured engagement through any module before signing.

Off-the-shelf versus custom build

There is essentially no case for a custom-built AML system in an accounting practice of any size. The regulatory bar is high, the cost of getting it wrong is high, and the off-the-shelf market has competent options. Bespoke is justified only where extreme volume meets a workflow no vendor supports, which is vanishingly rare in Australian accounting.

What is realistic is selecting an off-the-shelf platform and integrating it properly into the firm’s practice-management, document-management, and identity systems. That integration work is where most of the real implementation budget lands.

Microsoft 365 licensing implications

If the firm’s AML/CTF programme depends on Microsoft 365 for record retention, audit logging, and data-loss-prevention controls (most do), the licence tier matters. Microsoft 365 Business Premium covers retention labels and basic DLP. Microsoft 365 E3 with the E5 Security add-on, or full E5, covers the advanced auditing, eDiscovery, and conditional-access features auditors increasingly look for. Practices on Business Standard will struggle to produce the evidence Tranche 2 implies.

The licence step-up is not trivial. Business Premium to E3 plus E5 Security roughly doubles the per-seat cost. It is a real input into the Tranche 2 programme budget and should be modelled before the overall programme shape is locked in.

What does Tranche 2 cost an accounting practice to implement?

For a 20-to-100-seat Australian practice, our current view is a one-off implementation spend in the 25,000 to 75,000 Australian-dollar range depending on platform choice, plus an ongoing licensing and operating cost in the 12,000 to 35,000 dollar range per year. These are estimates that move with vendor pricing, not formal quotes.

The one-off spend covers the AML/CTF programme document, compliance-officer training, platform selection and procurement, integration with the practice-management and document-management systems, workflow design for client onboarding under the new rules, and staff training. A practice with a well-run Microsoft 365 environment and a clean practice-management configuration sits at the lower end. A practice that needs to fix baseline IT hygiene at the same time sits at the higher end, with the Tranche 2 programme acting as a forcing function for long-overdue cleanup.

Ongoing versus one-off

The ongoing cost is the one practices under-estimate. A Tranche 2-captured firm has acquired a compliance function, not just a project. That function runs every month for the life of the firm. Compliance-officer time, quarterly programme review, annual independent review in some configurations, software licensing, and the long tail of new-staff training and new-office incidents all attract ongoing cost.

Budget for the second year of the programme to cost more than the first, once the annual-review cycle and the steady-state training cadence are in operation.

What this means for the managing partner

It means the programme needs senior ownership, and that senior owner needs time to actually own it. The compliance officer is a regulatory requirement, but a compliance officer without partner-level backing cannot get decisions made when they need to be. The shape of the programme depends on partner-level choices about which captured services the firm will continue to offer, what risk the firm is willing to accept on individual clients, and how much technology the firm is willing to fund to operate the programme well.

The practical version of partner backing is three things. A standing partnership agenda item on AML/CTF status for the first year after commencement. Authority for the compliance officer to refuse or escalate client onboarding when the risk picture warrants it (the unfamiliar overseas client wanting an immediate company formation is the classic example). And a willingness to fund the technology properly rather than stretch a practice-management bolt-on past where it can credibly operate.

What CCP does about Tranche 2 for accounting practices

We do not write AML/CTF programme documents. We set up the systems the programme runs on, and we keep them running.

For an accounting practice client preparing for Tranche 2, the work usually breaks into three streams. The Microsoft 365 and identity stream covers retention labels, conditional access, audit logging, and the licence uplift where the existing tier cannot carry the regime’s expectations. This stream tends to move fastest because the configuration is well-understood and vendor-supported. The AML platform stream covers shortlisting the two or three platforms that fit the firm’s captured-work profile, running proofs of concept on real client data, and integrating the chosen platform into the practice-management environment so onboarding does not require staff to context-switch across five interfaces. The evidence stream makes sure every claimed control produces the audit-grade evidence AUSTRAC will look for. This is the part most firms under-invest in and then scramble for at audit time.

The AML/CTF programme document, the legal interpretation of which services fall inside Tranche 2’s scope, and the risk-assessment methodology that underpins the programme remain with the firm’s AML advisor and the compliance officer. Our boundary is explicit. We handle the machinery. They handle the interpretation.

The practices we are seeing start this work in March and April 2026 are going to be comfortable on 1 July. The practices starting in June will ship something that functions. The practices waiting until July will be apologising to AUSTRAC inside six months.

Primary sources

• AML/CTF Reform, AUSTRAC’s overview of the Tranche 2 reforms. Accessed 7 April 2026.
• New industries and services to be regulated, AUSTRAC’s authoritative list of newly captured services. Accessed 7 April 2026.
• AML/CTF transitional rules update, AUSTRAC’s rolling guidance on commencement timing and transitional accommodations. Accessed 7 April 2026.
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), as amended, available via Federal Register of Legislation.