100,000 Businesses Must Watch Your Money

There is a diagram on AUSTRAC's website that explains the whole system better than any press release has managed.¹

It puts businesses at the centre. Not police. Not the agency itself. Businesses.

The caption underneath reads: reporting entities are at the front line in identifying criminal activity.

That is the part almost nobody outside the compliance industry understands about how Australia polices dirty money. The government does not watch your bank account. Your bank does, and it is legally required to tell AUSTRAC what it sees.

On 1 July 2026 that obligation was extended to around 100,000 businesses that had never carried it before.² If you run one of them, the deadline to enrol has already passed.

What AUSTRAC actually is

The Australian Transaction Reports and Analysis Centre is two things at once, which is why it confuses people.

It is a regulator. It writes rules for businesses that handle money, supervises them, and takes enforcement action when they fail. It is also a financial intelligence unit, part of the National Intelligence Community, collecting and analysing transaction data.¹

What it is not is a law enforcement agency. AUSTRAC does not arrest anyone, lay charges or prosecute. It builds the picture and hands it over.

Its own description of the logic is blunt. People committing crimes interact with the businesses it regulates in order to move money and hide the proceeds. Those businesses are therefore the point where crime becomes visible.¹

Where the reports go

This is the detail with the most consequence and the least public awareness.

Every transaction report and every suspicious matter report submitted to AUSTRAC is directly available to designated users within federal, state and territory partner agencies.¹

Not available on request. Not available after a warrant. Directly available.

So a report filed by a suburban accountant in Melbourne sits in a database that police, intelligence and revenue agencies across the country can query.

AUSTRAC describes four channels through which that intelligence moves. Government partnerships, working with agencies at state and federal level. International partnerships, sharing with financial intelligence units and regulators overseas. The Fintel Alliance, an AUSTRAC initiative pairing government with private sector organisations. And joint task forces, where it supplies financial intelligence to national security and organised crime operations.¹

What has to be reported

Three things, broadly.⁵

Threshold transaction reports, for physical cash movements of $10,000 or more.

Suspicious matter reports, filed when a business forms a suspicion that a transaction, or even a proposed transaction, may be connected to an offence. The clock is tight: 24 hours for terrorism financing matters, three business days for money laundering and other offences.

And international funds transfer instructions, covering money moving in or out of the country.

The suspicious matter report is the one that catches people out. The trigger is suspicion, not proof. A business does not have to know anything is wrong. It has to form a reasonable suspicion and report it, and it is generally prohibited from telling the customer it has done so.³

What changed on 1 July

For twenty years the regime covered what the industry calls tranche one: banks, casinos, remittance providers, bullion dealers. Roughly 17,000 entities.

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act received royal assent on 10 December 2024.² It brought in the sectors Australia had been criticised internationally for leaving out.⁷

From 1 July 2026, the following are reporting entities under the Act:

• Lawyers and conveyancers
• Accountants
• Real estate agents, buyer's agents and property developers
• Trust and company service providers
• Dealers in precious stones and precious metals
• Virtual asset service providers, including crypto exchanges

The compliance industry calls them gatekeepers, on the theory that criminal money entering the legitimate economy usually passes through a professional who arranges the transaction.

Estimates put the number of newly captured businesses at around 90,000 to 100,000. That is roughly six times the existing regulated population, and the largest expansion of the regime in its history.

The deadlines that have already gone

Enrolment on the AUSTRAC Reporting Entity Roll opened on 31 March 2026 and closed for these sectors on 29 July 2026.⁴

Obligations commenced 1 July 2026.

Newly regulated entities had until 29 July 2026 to notify AUSTRAC of their AML/CTF compliance officer, who must sit at management level.⁴

Enrolment is administrative, but it is not optional. Providing a designated service without being enrolled is itself a contravention.³

If you are a conveyancer, a bookkeeper doing company formations, a property developer or a small agency, and none of the above is familiar, the honest position is that you are already behind. That is not unusual. It is the predictable result of adding 100,000 businesses to a regime most had never heard of.

What compliance actually requires

Four things, in plain terms.⁴

Enrol with AUSTRAC.

Appoint an AML/CTF compliance officer at management level.

Write and implement an AML/CTF program, built on your own assessment of the money laundering risk your specific business faces. The reforms deliberately moved away from generic templates toward a risk-based approach, which means a boilerplate document downloaded from the internet is not compliance.

Conduct customer due diligence, keep records, monitor on an ongoing basis, and report.

Penalties for failure are civil penalty orders, and AUSTRAC has previously pursued very large ones against major institutions.

The point most coverage misses

The framing in AUSTRAC's own material is worth sitting with, because it is not the framing most businesses expect.

The agency says it regulates businesses to protect them and the Australian community from serious crime. It describes providing guidance and education to help businesses protect themselves from being exploited by criminals.¹

That is a different proposition from being policed. The premise is that a business which does not know who its customers are is not just a compliance risk, it is a target.

Whether 100,000 small operators experience the new regime that way, or experience it as a cost imposed on them for someone else's problem, is the real question of the next two years.

AUSTRAC has published sector-specific starter kits and guidance.⁶ For most affected businesses, that is the first place to go, and the second is an adviser who has read the Rules rather than a template vendor who has not.

This article is general information, not legal or compliance advice. Businesses should obtain advice on their own obligations.