AML changes are a ‘valuable opportunity’ for law firms, in-house teams to evolve compliance culture

The transformative legislative updates extend the AML/CTF regime to certain designated services provided by real estate professionals, lawyers, accountants, and trust and company service providers, and aim to improve the effectiveness of the regime by making it easier for businesses to comply with their obligations, as well as modernise the regime to reflect changing business structures, technologies, and illicit financing methodologies.

The new regime is the focus of the upcoming AML Edge event, being hosted on 21 October in Sydney. As previously reported, AUSTRAC deputy CEO Katie Miller is set to speak at the event.

Prepare early

In conversation with Lawyers Weekly, Holding Redlich partner Jessica Tsiakis and special counsel David Chambers said the changes aren’t just a regulatory update – they demand a shift in compliance culture by aiming to close long-identified gaps in Australia’s financial crime framework.

“Businesses that prepare early will not only avoid regulatory pain but will also demonstrate their commitment to responsible corporate conduct in an increasingly transparent business environment,” Tsiakis said.

Chambers added that businesses must use this new financial year to assess risk exposure, understand new obligations, and build a solid AML/CTF compliance program.

VIEW ALL

“Prioritise by having risk assessment conducted, appoint key personnel, and develop policies and training programs. Engage expert legal advisors to ensure your approach is tailored and compliant. Preparing now will reduce pressure closer to 29 July 2026, the deadline for enrolment,” he said.

Impacts upon the legal profession

Norton Rose Fulbright senior adviser in risk advisory Jeremy Moller said the looming changes impact the legal profession in three key ways.

“First, lawyers in private practice who provide a ‘designated service’ will need to enrol with AUSTRAC and comply with the obligations. Second, in-house lawyers at real estate agencies, real estate developers or accounting firms, who provide a designated service, will need to support their business as they also become regulated. Finally, in-house lawyers in existing reporting entities, such as banks and payment providers, will not be further regulated as lawyers, but they will be advising their financial crime compliance teams on the changes,” he said.

“This comes at a busy time where they will already be responding to the evolving legal and regulatory landscape across privacy, scams, international sanctions and payments regulation.”

The current focus of many existing and new reporting entities is the speed of regulatory change and limited time to comply, Moller continued.

“The draft AML/CTF Rules, which are currently under consultation, are expected to be finalised in early August. However, that only leaves eight months for existing reporting entities to comply, while new reporting entities like lawyers will have under a year.”

“With this in mind, legal practitioners should prioritise assessing whether they provide a designated service, conduct a risk assessment of the money laundering and terrorism financing risk, and consider the forthcoming guidance about steps to comply,” he said.

With an anticipated 90,000 new reporting entities, Moller noted, it is also important that consideration is given to how to operationalise this through resourcing, systems, and technology.

“For example, relevant questions will be: who is going to be the AML/CTF compliance officer? Do we need to train or hire somebody for this role? Do we need to invest in technology, or can we utilise existing systems? What should be budgeted for AML/CTF compliance to ready our business in the next financial year?

“These questions will be vital to ensure an optimal service is provided to clients, while meeting legal and regulatory obligations,” he said.

Actions and challenges

When asked what practical steps law firms and in-house teams need to take to get ready for the regime ahead of 1 July 2026, Tsiakis said Tranche 2 entities first need to understand which designated services are covered by the legislation and check whether they are captured using AUSTRAC’s tool.

If captured, she said, “entities should seek legal advice to clarify their obligations, audit their services to identify which activities fall within scope, segment their client base to assess where money-laundering, terrorism financing or proliferation financing risks may arise, and engage with AUSTRAC and industry bodies for guidance”.

“They then need to conduct a risk assessment, draft an AML/CTF compliance program specific to their business, and appoint a dedicated compliance officer in preparation for enrolment with AUSTRAC within 28 days of providing a ‘designated service’,” she said.

There will be, however, various headwinds that firms and their teams will face in properly implementing the right steps ahead of the next financial year – Chambers said that the greatest challenge is how extensive and detailed the AML/CTF requirements are.

“Businesses not only need to undertake a risk assessment but are also required to have written policies, procedures, systems, and controls that are tailored to their operations based on the money laundering, terrorism financing and proliferation financing risks they may face,” he said.

“The higher the risk, the stronger and more detailed the program must be. Many firms underestimate how much time it takes to interpret multiple legal instruments and apply the outcome of the risk assessment to meet the specific requirements under the AML/CTF compliance program, which comprises Part A and Part B and is of significant volume.”

For example, Chambers continued, “Part A requires entities to conduct a business-wide risk assessment, ensure board or senior management oversight, appoint a suitable AML/CTF compliance officer, carry out ongoing employee and customer due diligence, deliver AML/CTF risk training, implement robust systems for reporting, regularly update the program and undertake an independent review at least every three years”.

“Businesses subject to the regime need to begin preparing now,” he said.

Responsible corporate conduct and opportunities

Firms and in-house teams looking to ensure best practice will have to appreciate, Chambers said, that responsible corporate conduct under the new regime means more than mere compliance – it’s about prioritising genuine risk management.

“Best practice requires engaging legal and compliance professionals early to tailor an AML/CTF compliance program specifically to its business and enrolling by the due date on 29 July 2026,” he said.

“The initial development and ongoing steps to maintain the AML/CTF program requires conducting proper risk assessments, designating an AML/CTF compliance officer and senior manager for oversight, training staff, regularly reviewing, and updating the program, ensuring timely implementation of those reviews, identifying ‘red flags’, escalating and reporting suspicious transactions internally and externally within prescribed time frames, and keeping records to ensure compliance.”

This all said, the new regime gives firms and in-house teams a “valuable opportunity”, Tsiakis said, to strengthen their risk management frameworks and build a compliance culture that protects both their reputation and clients’ trust.

“Proactively managing financial crime risks saves costs and avoids significant penalties, which can reach up to $33 million for businesses,” she said.

“While the obligations do not commence until 1 July 2026, the preparation required is significant. Businesses should capitalise on this opportunity to identify any hidden risks, rethink existing processes and ensure they are not unknowingly facilitating financial crime.”