Regulatory Radar

Remittance providers and virtual asset service providers may wish to confirm that their AUSTRAC registration details, including notifications of material changes to the business, are current, since failure to notify such changes was cited as one of the grounds for the actions taken. Businesses that have reduced or paused operations, or that are experiencing financial difficulty, should consider whether their registration status still accurately reflects their current trading position, given AUSTRAC's stated focus on dormant, inactive or insolvent registrants.

This investigation is a useful indicator of the areas AUSTRAC is currently prioritising for scrutiny in the remittance and payments sector, particularly transaction monitoring capability and governance of high risk payment channels. Businesses providing international payment or remittance services could use the scope of this investigation, which focuses on AML/CTF program effectiveness and typology detection, as a prompt to review their own transaction monitoring arrangements. Given the matter is at an investigation stage only, firms should treat it as a signal of regulatory focus rather than as a precedent for any particular finding.

Businesses operating in the real estate, legal, accounting, conveyancing, trust and company services, and precious metals and stones sectors should confirm whether any of the services they provide fall within the designated services captured by the Tranche 2 reforms and, if so, whether they are correctly enrolled with AUSTRAC. Firms that have not yet enrolled, or are unsure whether their services are captured, may wish to review their position before receiving a section 167 notice. A business that does receive a notice should treat it as a priority and ensure any response is accurate and provided within the requested timeframe, given AUSTRAC's stated intention to move from education to active supervision of newly regulated entities.

Businesses that are newly or recently enrolled with AUSTRAC may wish to brief relevant staff, particularly those handling compliance correspondence and payments, on how to verify contact that claims to come from AUSTRAC before acting on it, including checking requests against official AUSTRAC Online channels rather than links or numbers provided in an unsolicited message. Staff should be aware that AUSTRAC will not request payment in cryptocurrency or through messaging apps, and that any request of that kind is a strong indicator of a scam.

Lenders, mortgage brokers, accountants and lawyers involved in residential lending may wish to review their loan application verification processes, including how income, employment and the source of settlement or repayment funds are checked, in light of the patterns identified in Operation Claw. Businesses whose staff or clients are named in referrals arising from the operation should treat any resulting regulatory or law enforcement contact as a priority. More broadly, firms involved in the lending chain could consider whether their internal controls would detect coordinated use of the same broker, accountant or law firm across multiple applications.

Reporting entities operating in the cryptocurrency sector, including virtual asset service providers and crypto ATM operators, may wish to treat this suspension as an example of how AUSTRAC can act quickly once earlier compliance commitments, such as an enforceable undertaking, are not sustained. It would be worth confirming that threshold transaction reporting and other ongoing reporting obligations continue to be met after an enforceable undertaking is accepted, and that any AUSTRAC request for information is responded to promptly, since the failure to do so was a key factor in this suspension.

Law practices that have adopted the AUSTRAC legal profession starter kit as their AML/CTF program may wish to compare their current program against version 1.1, in particular the revised customer due diligence timeframe for conveyancing matters and the shift to financial year compliance reporting. Where a practice has customised the starter kit, it may be worth recording the review of each update and the decision on whether to incorporate it, consistent with AUSTRAC's expectation that practices actively consider, rather than automatically adopt, each new version.

Legal, accounting, conveyancing, trust and company service, real estate and precious metals and stones businesses newly subject to AML/CTF obligations from 1 July 2026 could check their progress against AUSTRAC's stated 2026 to 2027 expectations, namely enrolment and registration, a completed risk assessment, appointed governance roles, documented AML/CTF policies, and evidence those policies are actually followed in daily operations rather than existing only on paper. Businesses already regulated before this expansion may wish to review whether their existing programs reflect the obligations that changed on 31 March 2026, including in relation to customer due diligence and virtual asset services, given AUSTRAC has flagged ongoing implementation as a priority.

Newly regulated businesses could use the AUSTRAC page and accompanying factsheets as a checklist to confirm enrolment has been completed within the 28 day window from first providing a designated service, and that the compliance officer, senior manager and governing body roles required for AML/CTF governance have been formally appointed. It may be worth documenting staff training records and the development of a tailored AML/CTF program against the obligations that commenced on 1 July 2026. Businesses unsure whether they provide a designated service, or whether registration in addition to enrolment applies to them, could use AUSTRAC's self assessment tools before assuming no obligation arises.

Businesses newly subject to AML/CTF obligations from 1 July 2026, including legal, accounting and real estate practices, may wish to confirm they are using the correct threshold transaction report and suspicious matter report forms in AUSTRAC Online from the outset of their obligations. Businesses already enrolled before 30 March 2026 should check whether they intend to rely on the transition arrangements permitting continued use of existing forms until 30 March 2029, and plan their eventual move to the new forms accordingly. It may also be worth reviewing whether any cash handling or fund transfer activity meets the 10,000 dollar threshold that triggers a reporting obligation.

Businesses and advisers conducting due diligence on a counterparty or client whose funds originate from or flow through a virtual asset provider could add a check of the AUSTRAC public register to existing verification steps, to confirm the provider is currently registered rather than relying on the provider's own representations. This may be particularly relevant for professional services firms assessing source of funds in transactions involving cryptocurrency. Compliance teams could also periodically re-check the register for ongoing client relationships, since registrations can be cancelled.

Reporting entities enrolled with AUSTRAC on or before 30 March 2026 have until 30 March 2029 before they must move to the new threshold transaction report and suspicious matter report forms, giving time to plan a transition rather than needing to act immediately. It may still be worth confirming that whoever is responsible for lodging reports has access to the AUSTRAC Online training environment and has had an opportunity to review the new forms ahead of the eventual changeover.

Reporting entities under the AML/CTF Act, including those newly brought into the regime such as law practices providing designated services, may wish to track the Bill's passage given the proposed changes to customer due diligence requirements and to the definitions of domestic and foreign politically exposed persons. Providers of high-risk mechanisms, including cryptocurrency products, should watch for the AUSTRAC CEO's proposed power to restrict or prohibit their use, since this could affect product offerings before Schedule 1's intended 1 January 2027 commencement. The provisions concerning legal professional privilege claims are also worth monitoring as the Bill progresses through Parliament.

Newly regulated businesses, including law practices now subject to AML/CTF obligations, may find it useful to keep a dated record of their implementation plan and the steps taken to identify and manage money laundering and terrorism financing risks, as evidence of genuine progress consistent with AUSTRAC's stated expectations. Businesses should also be aware that this statement has since been supplemented by more recent AUSTRAC priority statements, and may wish to check whether the current regulatory priorities for the 2026 to 2027 financial year affect how their implementation efforts should be prioritised.