AML/CTF for Lawyers and Law Firms: What You Need to Know

The Tranche 2 reforms to Australia's AML/CTF regime bring lawyers, conveyancers, and legal service providers under AUSTRAC's oversight for the first time. From 1 July 2026, law firms providing designated legal services must have a compliant AML/CTF program in place. This guide explains what is changing, how legal professional privilege interacts with the new obligations, and what practical steps your firm should take.

Which Legal Services Are Designated?

Not all legal work triggers AML/CTF obligations. The reforms target transactional services where money laundering risk is highest. Designated legal services include:

• Conveyancing and property transfers — Acting for a buyer or seller in the purchase or sale of real property
• Company formation — Creating, managing, or administering companies, partnerships, or other legal entities on behalf of clients
• Trust establishment and management — Setting up trusts, acting as trustee, or managing trust assets
• Managing client money through trust accounts — Receiving, holding, or disbursing funds through your firm's trust account in connection with a designated service
• Buying or selling business entities — Acting as an intermediary in the acquisition or disposal of a business

Advisory work, litigation, criminal defence, family law, employment law, and other non-transactional practice areas are generally not in scope unless they involve one of the designated services above.

Legal Professional Privilege and AML/CTF

One of the most significant concerns for the legal profession is how AML/CTF reporting obligations interact with legal professional privilege (LPP). AUSTRAC has addressed this directly:

• LPP is preserved in the context of providing legal advice. Communications made for the dominant purpose of obtaining or providing legal advice remain privileged.
• The reporting exemption: Where a lawyer forms a suspicion about money laundering or terrorism financing, and that suspicion arises solely from information covered by LPP, the obligation to file a suspicious matter report (SMR) does not apply.
• However, LPP does not apply to communications made to further a crime or fraud. If a client is using your legal services to facilitate money laundering, the privilege is lost.
• Transactional services are not advisory: When you are acting as an intermediary in a property transaction or managing trust funds, you are providing a designated service, not legal advice. LPP is less likely to apply to CDD information collected in this context.

AUSTRAC has published specific guidance for the legal profession on this intersection. Firms should ensure their AML/CTF program documents how LPP will be assessed in the context of reporting obligations.

Trust Account Obligations

Law firm trust accounts have always been subject to state and territory trust account regulations. The AML/CTF reforms add a new layer:

• Funds received into trust in connection with a designated service must be subject to CDD. You must know who the money is coming from and satisfy yourself about its source.
• Third-party payments into trust accounts are a red flag. If someone other than your client deposits funds into your trust account, enhanced due diligence is required.
• Record keeping for trust account transactions linked to designated services must be maintained for seven years under the AML/CTF Act, in addition to your existing state-based obligations.
• Monitoring — You must monitor trust account activity for unusual patterns, such as funds flowing through trust without a clear legal purpose, or deposits that are inconsistent with the matter at hand.

Conveyancing CDD Requirements

Conveyancing is one of the highest-risk designated services for law firms. For every property transaction, you must:

• Verify the identity of buyers and sellers using government-issued identification documents before settlement
• Identify beneficial owners where the purchaser is a company or trust — anyone who ultimately owns or controls 25% or more
• Assess the source of funds — Where is the purchase money coming from? Is it consistent with the client's known financial position?
• Screen against the DFAT sanctions list — Check all parties against the Department of Foreign Affairs and Trade Consolidated List
• Apply enhanced due diligence for high-risk matters, including foreign buyers, complex ownership structures, and transactions involving high-risk jurisdictions

Law Society vs AUSTRAC Requirements

Legal practitioners now answer to two regulators in the compliance space:

| Area | Law Society / Legal Services Board | AUSTRAC | |------|-----------------------------------|---------| | Trust accounts | State-based trust account rules | AML/CTF record keeping and monitoring | | Client identification | "Know your client" ethical rules | Formal CDD with prescribed verification | | Reporting | Reporting to the Legal Services Commissioner | SMR reporting to AUSTRAC | | Privilege | LPP as a fundamental principle | LPP preserved with defined carve-outs | | Training | CPD requirements | AML/CTF-specific training obligations | | Penalties | Professional discipline | Up to $33 million per contravention (civil) + criminal penalties |

Your AML/CTF program should be designed to satisfy both sets of requirements. In many cases, robust AML/CTF procedures will exceed your existing law society obligations, so compliance with AUSTRAC requirements should keep you well within your professional standards.

Key Dates for Law Firms

| Milestone | Date | |-----------|------| | AUSTRAC enrolment opens | 31 March 2026 | | AML/CTF obligations commence | 1 July 2026 | | Enrolment deadline | 29 July 2026 | | Compliance officer notification to AUSTRAC | 29 July 2026 | | CDD transition period for existing clients | 31 March 2026 – 30 March 2029 |

How to Prepare Your Firm

1. Map your designated services — Review every practice area and identify which services fall within scope. Conveyancing, trust work, and entity formation are the primary triggers.
2. Enrol with AUSTRAC — Registration is now open. You need your ABN, details of designated services, and compliance officer information.
3. Appoint a compliance officer — This must be someone with the competence and authority to oversee the program. In smaller firms, this is typically the managing partner.
4. Develop your AML/CTF program — Document your risk assessment, CDD procedures, reporting processes, trust account monitoring, and training plan. Address LPP in your reporting procedures.
5. Update client engagement processes — Integrate CDD into your intake and onboarding workflow for all matters involving designated services.
6. Train your team — All lawyers and support staff involved in designated services need AML/CTF training within 30 days and on an ongoing basis.
7. Set up record keeping — Ensure seven-year retention for all CDD, risk assessment, and reporting records.

The Cost of Non-Compliance

AUSTRAC's enforcement track record speaks for itself: $700 million (CBA), $1.3 billion (Westpac), $67 million (SkyCity). While these are large institutions, the penalty framework applies equally to smaller entities. The maximum corporate penalty is $33 million per contravention, and individuals face criminal prosecution. Beyond fines, an AUSTRAC enforcement action can end a legal career.

Ready to simplify your AML/CTF compliance? Try ComplyReady free for 14 days.