Skip to content
FortiOS 7.6 flaw CVE-2026-121530 lets RADIUS admins sign in with an invalid two-factor token
Black Shard

Loading

    When do law firms have to comply with AML/CTF obligations in Australia?

    Law firms have had to comply since 1 July 2026 if they provide a designated service listed in table 6 of the AML/CTF Act; enrolment with AUSTRAC opened on 31 March 2026. A firm providing a designated service needs an AML/CTF program, customer due diligence, suspicious matter reporting and records.

    Compliance readinessPublished Reviewed

    In detail

    A law firm is regulated from 1 July 2026 when it provides a designated service listed in table 6 of subsection 6(5B) of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, with a geographical link to Australia, in the course of carrying on a business. Enrolment through AUSTRAC Online opened on 31 March 2026.

    AUSTRAC says a business providing a designated service must comply with the Act and Rules from 1 July 2026. Most businesses only need to enrol; a business that intends to provide remittance or virtual asset services must also apply for registration.

    The professional services in table 6
    ItemService
    1Assisting in the planning or execution of a transaction to sell, buy or transfer real estate
    2Assisting in the planning or execution of a transaction to sell, buy or transfer a body corporate or legal arrangement
    3Receiving, holding, controlling or managing a person's property to help in the planning or execution of a transaction
    4Assisting in organising, planning or executing a transaction for equity or debt financing relating to a body corporate or legal arrangement
    5Selling or transferring a shelf company
    6Assisting in the planning or execution of the creation or restructuring of a body corporate or legal arrangement
    7 and 8Acting, or arranging for someone to act, on behalf of a person in particular positions in a body corporate or legal arrangement, including as a nominee shareholder
    9Providing a registered office address or principal place of business address of a body corporate or legal arrangement

    Table 6 covers work on matters that are in progress or will occur in the future. Drafting or reviewing documentation to create a body corporate is an item 6 service; advising, after the body corporate is created, on whether the creation was lawful is not.

    Drafting a consent order to settle litigation, or drafting and executing a binding financial agreement, is not a designated service either. AUSTRAC says litigation generally falls outside table 6, and drafting a will and creating a testamentary trust is not a designated service.

    AUSTRAC's test is whether the firm's work involves active steps that move the transaction or outcome forward. Planning and organising extend to preliminary and preparatory steps that directly advance the outcome; assistance that merely influences a transaction does not on its own make a designated service.

    A conveyancing firm giving general advice on the process for buying real estate has not started the service; once a buyer is successful at an auction that meets reserve and the firm acts to advance the transfer, it has.

    Items 1 and 2 carry an exception: a transaction to sell, buy or transfer real estate, a body corporate or a legal arrangement pursuant to an order of a court or tribunal is not a designated service. Item 3 does not apply in the circumstances in subsection 6(5C) of the Act, such as payment for goods or services.

    A regulated firm enrols, meets its AML/CTF obligations, and completes the steps to know its customer before it starts to provide a designated service. AUSTRAC says a conveyancer can delay initial customer due diligence where that is essential to avoid interrupting the ordinary course of business and the additional money laundering and terrorism financing (ML/TF) risk is low.

    AUSTRAC publishes a legal profession program starter kit to help a firm create its AML/CTF program, and lists exemptions that include legal aid commissions, community legal centres and barristers acting for Australian government bodies.

    Initial customer due diligence is due before the service starts: for conveyancing, when a buyer and seller agree a price or a bid succeeds at an auction that meets reserve; for company or trust work, when the firm accepts and acts on the instruction.

    1. Map the firm's matters against table 6.
    2. Enrol through AUSTRAC Online.
    3. Build the program from the legal profession program starter kit.
    4. Complete initial customer due diligence before the designated service starts.

    For an Australian organisation

    The obligations come from the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and the Rules, administered by AUSTRAC.

    If the Privacy Act 1988 covers the firm, a data breach involving personal information it collects for customer due diligence and likely to result in serious harm must be notified to affected individuals and the OAIC under the Notifiable Data Breaches scheme.

    Talk to us about compliance readiness.