AUSTRAC is no longer just warning Tranche 2 businesses. Since obligations started on 1 July 2026, it has sent information notices to businesses that appear to be unenrolled and, from 30 September, begun issuing infringement notices to businesses it believes failed to enrol on time. This article explains the penalties available under the AML/CTF Act, what AUSTRAC has done so far, and what ‘reasonable steps to comply’ looks like for a small business.
\nUnder the AML/CTF Act, civil penalties for non-compliance can reach up to 20,000 penalty units for individuals and 100,000 penalty units for body corporates, applied per contravention. From 1 July 2026, with the Commonwealth penalty unit valued at $364, that equates to maximum penalties of up to $7.28 million for individuals and up to $36.4 million for corporations. These are maximum penalties a court can order, not fixed fines, but they show how seriously the regime treats non-compliance.
\nIf your business provides a designated service under Tranche 2, as many real estate agents, lawyers, conveyancers, accountants, trust and company service providers and dealers in precious metals and stones do, this liability now applies to you. It sits in the same Act that has produced some of the largest corporate penalties in Australian history.
\nThe first months of the regime have followed a clear sequence.
\nAugust 2026: information notices. On 28 August, AUSTRAC began issuing section 167 notices to businesses that appeared to be providing designated services but had not enrolled. The notices went to businesses including real estate agents, accountants, lawyers and jewellers, and required them to give AUSTRAC information to help it work out whether they are regulated and meeting their obligations.
\nSeptember 2026: infringement notices. On 30 September, AUSTRAC announced it had begun issuing infringement notices to businesses in the real estate, accounting and jewellery sectors that it believes failed to enrol within 28 days of providing a designated service. The notices were issued at $21,840 for corporate entities and $4,368 for individuals, and AUSTRAC said they can accrue daily.
\nAUSTRAC also said that of the group of businesses it first looked at, around 90 per cent have since enrolled or attempted to enrol, and that it is actively looking for businesses that have not enrolled and will issue more notices where necessary.
\nFor businesses that began providing designated services on 1 July 2026, the 28-day enrolment window closed on 29 July.
\nAUSTRAC has said its focus remains on helping businesses understand and meet their obligations, but that businesses ignoring the law should expect regulatory scrutiny. Its first actions have targeted the most basic obligation: enrolment. A business that has enrolled, appointed a compliance officer, built a risk-based AML/CTF program and started customer due diligence is in a very different position from one that has done nothing.
\nThat difference is not a free pass. AUSTRAC assesses effort on evidence and records, not verbal assurances. If your business has no AML/CTF program, no compliance officer and no due diligence process when AUSTRAC asks, ‘we were planning to get to it’ will not stand up.
\nAUSTRAC has already secured two of the largest corporate penalties in Australian regulatory history: AUD 700 million from Commonwealth Bank in 2018 and AUD 1.3 billion from Westpac in 2020, both for reporting and monitoring failures. Those cases involved large banks with very different risk profiles from a newly regulated small business, but they show that AUSTRAC pursues enforcement through the courts and wins.
\nA small real estate agency or accounting practice will not be treated like a major bank. The same Act, the same regulator and the same civil penalty regime now apply, though, and the infringement notices issued in September show AUSTRAC is willing to act against smaller businesses on basic obligations.
\nReasonable steps means a genuine, documented compliance effort rather than good intentions claimed after the fact. For a Tranche 2 business, that means four things:
\nEach of these needs to be demonstrable, not just described. AUSTRAC and the courts look at records: screening logs, due diligence files, dated versions of the compliance program and report submission history.
\nThis is where a pay-as-you-go screening tool helps a small or mid-sized business. Running PEP, sanctions and adverse media checks through NameScan creates a timestamped record for each customer check, the kind of evidence AUSTRAC expects to see when assessing whether a business took reasonable steps, without the fixed cost of an enterprise platform built for banks.
\nThis article is general information, not legal advice.
\nWhat are the maximum penalties under the AML/CTF Act?
\nCivil penalties can reach up to 20,000 penalty units for individuals and 100,000 penalty units for corporations per contravention: up to $7.28 million for an individual and up to $36.4 million for a body corporate at the penalty unit value applying from 1 July 2026.
\nWill AUSTRAC target small businesses newly regulated under Tranche 2?
\nAUSTRAC has said it is focused on helping businesses comply, but it has shown it will act against those that ignore their obligations. From late August 2026 it issued information notices to businesses that appeared to be unenrolled, and from 30 September 2026 it began issuing infringement notices to real estate, accounting and jewellery businesses it believes failed to enrol on time. Being a small business does not exempt you if you provide a designated service.
\nHas AUSTRAC actually fined companies before?
\nYes. AUSTRAC secured an AUD 700 million penalty from Commonwealth Bank in 2018 and an AUD 1.3 billion penalty from Westpac in 2020. In September 2026 it also began issuing infringement notices to Tranche 2 businesses that failed to enrol.
\nWhat counts as ‘reasonable steps to comply’ for a small business?
\nEnrolment, a risk-based AML/CTF program, an appointed compliance officer, documented customer due diligence (including PEP, sanctions and adverse media screening) and on-time reporting to AUSTRAC, each supported by records.
\nHow much is an AUSTRAC infringement notice for failing to enrol?
\nThe notices AUSTRAC announced on 30 September 2026 were issued at $21,840 for corporate entities and $4,368 for individuals, and AUSTRAC said they can accrue on a daily basis.
\n\n","protected":false},"excerpt":{"rendered":"
AUSTRAC is no longer just warning Tranche 2 businesses. Since obligations started on 1 July 2026, it has sent information notices to businesses that appear to be unenrolled and, from 30 September, begun issuing infringement notices to businesses it believes failed to enrol on time. This article explains the penalties available under the AML/CTF Act, […]
\n","protected":false},"author":9,"featured_media":14130,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Tranche 2 penalties","_yoast_wpseo_title":"Tranche 2 Penalties and AUSTRAC's First Infringement Notices","_yoast_wpseo_metadesc":"AUSTRAC is issuing infringement notices to Tranche 2 businesses that missed enrolment. Understand its enforcement powers and what to do next.","footnotes":""},"categories":[85],"tags":[231,127,95,232,233,206],"class_list":["post-14116","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-post","tag-aml-ctf-act","tag-austrac","tag-compliance","tag-enforcement","tag-penalties","tag-tranche-2"],"yoast_head":"\n