Australia's AML Regulator: Understanding AUSTRAC

Every country with serious anti-money laundering laws has a regulator to enforce them.

In Australia, that regulator is AUSTRAC — the Australian Transaction Reports and Analysis Centre.

If you're a reporting entity (or about to become one under Tranche 2), understanding how the AML regulator works is essential to staying compliant.

Who Is Australia's AML Regulator?

AUSTRAC is Australia's financial intelligence unit and AML/CTF regulator. Established in 1989, it sits within the Attorney-General's portfolio and has two core functions:

1. Financial Intelligence

AUSTRAC collects over 100 million reports annually from reporting entities:

• Suspicious matter reports (SMRs) — when businesses identify potential money laundering or terrorism financing
• Threshold transaction reports (TTRs) — cash transactions of $10,000 or more
• International funds transfer instructions (IFTIs) — cross-border money movements

This intelligence feeds into law enforcement investigations across Australia. Drug trafficking, tax evasion, organised crime, terrorist financing — AUSTRAC's data helps catch them all.

2. Regulatory Oversight

AUSTRAC supervises 17,000+ reporting entities to ensure they meet their AML/CTF obligations. This includes:

• Banks and financial institutions
• Gambling and gaming providers
• Bullion dealers
• Digital currency exchanges
• Remittance providers
• And from July 2026 — accountants, lawyers, real estate agents, and trust service providers

How the AML Regulator Supervises Businesses

AUSTRAC takes a risk-based approach to supervision. Not every business gets the same level of scrutiny.

Risk Assessment

AUSTRAC assesses each sector's money laundering risks and focuses resources accordingly. High-risk sectors face more intensive supervision.

Compliance Assessments

AUSTRAC conducts compliance assessments to check whether businesses:

• Have adequate AML/CTF programs
• Conduct proper customer due diligence
• Submit required reports accurately and on time
• Maintain records as required
• Have appropriate systems and controls

Thematic Reviews

AUSTRAC regularly reviews specific issues across multiple businesses — for example, examining how a sector handles PEP screening or beneficial ownership identification.

The Regulator's Enforcement Powers

AUSTRAC has significant enforcement tools:

Infringement Notices

For less serious breaches, AUSTRAC can issue infringement notices with set penalties. These can be contested in court.

Enforceable Undertakings

Businesses can commit to specific remediation actions. Breaching an enforceable undertaking leads to further enforcement action.

Remedial Directions

AUSTRAC can direct businesses to take specific actions to address compliance failures.

Civil Penalty Proceedings

For serious or systemic breaches, AUSTRAC can seek civil penalties through the Federal Court. Maximum penalties are substantial:

• Up to $22.2 million per contravention for corporations
• Up to $4.44 million per contravention for individuals

Criminal Prosecution

AUSTRAC can refer matters to the Commonwealth Director of Public Prosecutions for criminal prosecution. Serious offences can result in imprisonment.

Major Enforcement Actions

AUSTRAC has imposed Australia's largest corporate penalties:

Westpac — $1.3 billion (2020)

23 million breaches including failure to report international transfers and inadequate transaction monitoring. The largest penalty in Australian corporate history.

Crown Resorts — $450 million (2023)

Systemic failures in AML/CTF compliance at its Melbourne and Perth casinos.

Commonwealth Bank — $700 million (2018)

Failures in transaction monitoring and suspicious matter reporting related to intelligent deposit machines.

These aren't just big banks. AUSTRAC has also taken action against smaller businesses, remittance providers, and digital currency exchanges. Size doesn't exempt you from enforcement.

What the Regulator Expects From You

If you're a reporting entity, AUSTRAC expects:

1. Enrolment

Register with AUSTRAC before providing designated services. For Tranche 2 professions, enrolment opens 31 March 2026.

2. AML/CTF Program

Develop and maintain a written program that addresses your ML/TF risks. This includes policies, procedures, and controls proportionate to your risk profile.

3. Customer Due Diligence

Verify customer identities, identify beneficial owners, assess risk, and apply enhanced measures for higher-risk customers.

4. Ongoing Monitoring

Monitor customer relationships and transactions throughout the business relationship. Update CDD when circumstances change.

5. Reporting

Submit suspicious matter reports within required timeframes. Report threshold transactions and international transfers as required.

6. Record Keeping

Maintain records for 7 years after the business relationship ends. Records must be readily accessible for AUSTRAC examination.

7. Training

Ensure staff understand their obligations and can identify suspicious activity.

Working With the Regulator

AUSTRAC isn't just an enforcement body. They also provide:

• Guidance — sector-specific guidance on how to comply
• Typologies — reports on how criminals exploit different sectors
• Risk assessments — national and sector-level risk assessments
• Education — webinars, resources, and direct engagement

Engaging proactively with AUSTRAC demonstrates good faith and can help you understand emerging risks before they become compliance issues.

Preparing for Regulatory Oversight

If you're entering Tranche 2 in July 2026, start preparing now:

1. Understand your obligations — know what the law requires
2. Build your AML/CTF program — document your policies and procedures
3. Implement systems — manual processes won't scale
4. Train your team — everyone needs to understand their role
5. Test your controls — verify your systems work as intended

ARCaml provides the infrastructure to meet AUSTRAC's expectations — customer due diligence workflows, automated screening, secure record-keeping, and audit trails that demonstrate compliance.

Ready to prepare for regulatory oversight? Contact us to discuss your compliance requirements.