The 1 July Deadline Accountants Can't Ignore: AML/CTF Tranche 2 and Entity Management

The 1 July Deadline Accountants Can't Ignore: AML/CTF Tranche 2 and Entity Management

For decades, Australian accountants, lawyers, and financial advisers operated outside the formal anti money laundering regime. That changes on 1 July 2026.

AML/CTF Tranche 2 brings professional service providers — including accountants, tax agents, real estate agents, and financial advisers — into the scope of Australia's Anti Money Laundering and Counter Terrorism Financing Act 2006. The AUSTRAC enrolment window opened on 31 March 2026. Obligations go live in 91 days.

For firms managing entity and trust portfolios, the impact goes beyond ticking a compliance box. The regime requires you to understand — and document — who actually controls the structures you work with. Ultimate Beneficial Owner (UBO) mapping, customer due diligence records, and ongoing monitoring are now legal requirements, not best practice.

This guide explains what Tranche 2 means for accountants, what you need to have in place before 1 July, and where entity management software fits into a defensible compliance program.

Australia's AML/CTF framework was originally introduced through the Anti Money Laundering and Counter Terrorism Financing Act 2006 and applied primarily to financial institutions, banks, and remittance providers — the so called Tranche 1 entities.

Tranche 2 extends these obligations to designated non financial businesses and professions (DNFBPs) , a category that now includes:

Accountants and tax agents Lawyers and conveyancers Real estate agents Trust and company service providers Financial advisers providing certain services

This expansion brings Australia into alignment with the Financial Action Task Force (FATF) recommendations — the global standard for AML compliance — which Australia has been criticised for lagging on for years.

Why It Matters for Accountants Specifically

Accountants are at the centre of entity creation, restructuring, and ongoing administration in Australia. You register companies, establish trusts, advise on ownership structures, and maintain the records that define who controls what. That central role is exactly why AUSTRAC is bringing the profession into scope.

Under Tranche 2, if your firm provides services that touch the formation, operation, or management of legal entities — companies, trusts, partnerships — you are a reporting entity with obligations under the Act.

The AUSTRAC enrolment window opened 31 March 2026. If you haven't started the process, start now. Enrolment is completed via the AUSTRAC Online portal and requires you to identify your firm's designated services, nominate a compliance officer, and confirm your AML/CTF program is in place.

2. Develop and Implement an AML/CTF Program

Your AML/CTF program must be a written, risk based framework that covers:

How you identify and verify clients (Customer Due Diligence) How you assess the risk of each client and matter How you detect and report suspicious matters Staff training obligations Independent review requirements

The program must be tailored to your firm — a one size fits all template from a trade association does not satisfy the requirement. AUSTRAC's guidance for professional services firms is the starting point.

CDD is where entity management becomes central. For every client that is a legal entity — company, trust, partnership, SMSF — you must:

Identify the entity : registered name, ABN/ACN, address, type of entity Verify the entity : using reliable, independent sources (ASIC registry data qualifies) Identify and verify the UBO : the individual(s) who ultimately own or control the entity, typically defined as holding 25% or more of the ownership or voting rights Understand the nature and purpose of the relationship

For a family trust with a corporate trustee, a discretionary beneficiary class, and an appointor who can replace the trustee — UBO identification is not trivial. It requires a full ownership map, not a single name on a form.

Any transaction or activity that raises a suspicion of money laundering, terrorism financing, or a proceeds of crime issue must be reported to AUSTRAC via a Suspicious Matter Report (SMR). The obligation to report exists even if you don't proceed with the matter.

All CDD records, transaction records, and AML/CTF program documents must be retained for seven years . These records must be available for inspection by AUSTRAC on request.

The UBO Problem: Why Entity Management Software Matters

The hardest part of Tranche 2 compliance for most accounting firms isn't the paperwork — it's the underlying data.

UBO mapping requires you to trace ownership chains through potentially multiple layers of entities: a trust whose trustee is a company, whose shares are held by another trust, whose beneficiaries include individuals and a family holding company. In a portfolio of 50–200 entities across a client base, this is not something you can manage reliably in a spreadsheet or by scanning documents.

It's static : A spreadsheet reflects ownership as of the day you updated it. If a director changes, shares are transferred, or a new trust deed replaces an old one, your UBO map is immediately out of date. It doesn't handle complexity : Cross ownership, circular structures, and layered trust arrangements require algorithmic calculation — not manual tallying. It's not auditable : A regulator asking "how did you identify this beneficial owner, and when?" needs more than a spreadsheet cell.

EntityFlo's Ownership Map automatically calculates UBO chains across your entire entity portfolio. For each entity under management, the platform:

Traces ownership through all layers — companies, trusts, holding structures, nominees Identifies all individuals with 25%+ direct or indirect beneficial interest Flags ownership chains that require review — for example, where a trust deed limits disclosure or where a nominee arrangement may obscure the true controller Updates automatically when underlying entity data changes

This is not a manual process. It's an automated, auditable record that satisfies the UBO identification and verification requirement in real time.

Registry Sync keeps your entity data current by pulling live information from ASIC, so the ownership map is always built on verified, up to date records — not stale internal notes.

Document Vault gives you a secure, searchable repository for your CDD records: identity verification documents, trust deeds, shareholder agreements, and correspondence. Seven year retention is built in.

Compliance AI monitors your entity portfolio for changes that may trigger a CDD refresh — director appointments, share transfers, amendments to trust deeds — and alerts you before a compliance gap develops.

Non compliance with the AML/CTF Act 2006 carries serious consequences:

Breach type Potential consequence Failure to enrol with AUSTRAC Civil penalty up to $18.5 million (body corporate) Failure to conduct CDD Civil penalty per contravention Failure to report a suspicious matter Civil and criminal penalties Failure to maintain records Civil penalty Tipping off a subject about an SMR Criminal offence

These are not nominal fines. AUSTRAC has demonstrated a willingness to pursue major institutions — Westpac's $1.3 billion penalty in 2020 remains the largest corporate fine in Australian history. Tranche 2 extends that same regulatory reach to professional services firms.

Beyond financial penalties, non compliance with AML/CTF obligations can trigger referrals to professional bodies (CPA Australia, CA ANZ, TPB) with professional registration consequences.

If you're managing entity portfolios and haven't started, here is the minimum viable compliance roadmap:

[ ] Assess your designated services — which services you provide bring you into scope under the Act [ ] Enrol with AUSTRAC — via AUSTRAC Online before 1 July 2026 [ ] Appoint a compliance officer — the individual responsible for your AML/CTF program [ ] Draft your AML/CTF program — risk based, documented, tailored to your firm [ ] Audit your entity records — are your ASIC data, trust deeds, and UBO records current and complete? [ ] Implement a CDD workflow — including UBO identification for all entity clients [ ] Set up record retention — seven years, AUSTRAC accessible [ ] Train your staff — documented, role appropriate AML/CTF training

Does AML/CTF Tranche 2 apply to all accountants, or only large firms? The obligations apply to any accounting firm that provides designated services — including entity formation, trust administration, company secretarial services, or financial advice relating to those structures. Firm size does not create an exemption. However, the required AML/CTF program must be risk proportionate , meaning a sole practitioner managing 10 family trust structures has different requirements than a mid tier firm with hundreds of entity clients.

What counts as an Ultimate Beneficial Owner under Australian AML law? Under the AML/CTF Act 2006 and AUSTRAC's guidance, a UBO is generally an individual who ultimately owns or controls 25% or more of the entity's ownership interests or voting rights, or who exercises ultimate effective control through other means. For trusts, the analysis includes settlors, trustees, appointors, and beneficiaries — the "25% threshold" test must be applied across all layers of the ownership chain.

Can EntityFlo replace a formal AML/CTF program? No — EntityFlo is not a substitute for a written AML/CTF program, which is a legal requirement. What EntityFlo provides is the underlying entity data infrastructure that your program needs to function: current UBO maps, verified ASIC records, secure CDD document storage, and change monitoring. Think of it as the data layer that makes your compliance program defensible.