AUSTRAC Obligations for Small Businesses: What You Actually Need

If you are a small business owner who has recently learnt that you now have AUSTRAC obligations, you are probably feeling a mix of confusion and concern. The compliance language is dense, the legislation is long, and it can feel like the requirements were designed for banks — not for a two-person conveyancing firm or a suburban real estate agency.

Take a breath. This guide is written specifically for small businesses that need to understand their AUSTRAC obligations without drowning in regulatory jargon.

Why Does AUSTRAC Care About My Small Business?

Australia's AML/CTF regime exists to prevent criminals from using legitimate businesses to launder money or finance terrorism. Historically, the rules applied mainly to banks, remittance providers, and gambling operators. With Tranche 2 taking effect on 1 July 2026, the net has widened to include real estate agents, accountants, lawyers, and conveyancers.

These professions handle transactions and structures that criminals can exploit — property purchases, trust formations, company setups, and client funds. If you provide a designated service, AUSTRAC considers you a reporting entity regardless of your size.

The Good News: Obligations Are Proportionate

AUSTRAC expects your compliance to be proportionate to your size and risk profile. A sole practitioner accountant is not expected to have the same compliance infrastructure as a Big Four firm.

In practice this means:

• Your AML/CTF program can be simpler and shorter than a large organisation's
• Your risk assessment should reflect your actual business, not every conceivable scenario
• Your monitoring processes can be manual rather than automated
• Your training can be straightforward and practical

Proportionate does not mean optional. You must meet each requirement, but the depth should match your business.

The Minimum Requirements: What You Actually Need

Here are the six core AUSTRAC obligations for businesses, in plain language.

1. Register with AUSTRAC

Enrol as a reporting entity through the AUSTRAC Portal. This one-off online process takes around 30 minutes. You will need your ABN, details about your designated services, and your compliance officer's contact information.

Small business reality: Straightforward. Do it early so you are not rushing before the deadline.

2. Have a Written AML/CTF Program

Your program sets out how your business manages ML/TF risks in two parts:

• Part A — Your risk assessment: what ML/TF risks are specific to your business?
• Part B — Your compliance procedures: how do you manage those risks day-to-day?

Small business reality: For a small firm, this might be 15-25 pages. It does not need to be a 200-page manual. What matters is that it reflects your business, not a generic template.

3. Conduct Customer Due Diligence (CDD)

Verify your customer's identity before providing a designated service. For individuals, collect and verify name, date of birth, and address using reliable documents. For companies and trusts, also identify the beneficial owners.

Small business reality: If you already collect ID from clients, you are halfway there. The key addition is a documented process, verification against a reliable source, and keeping records.

4. Train Your Staff

Everyone providing designated services must be trained on your AML/CTF program, CDD processes, red flags, and how to escalate suspicious matters.

Small business reality: If it is just you, ensure you understand the requirements. For staff, initial training might be a one-hour session, followed by annual refreshers. Keep records.

5. Report Suspicious Matters

If you suspect money laundering or terrorism financing, lodge a Suspicious Matter Report (SMR) with AUSTRAC within three business days (24 hours if terrorism is suspected).

Small business reality: Most small businesses will rarely lodge an SMR. But you must know the warning signs and have a process ready.

6. Keep Records for Seven Years

Retain all CDD documents, transaction records, your AML/CTF program, training records, and AUSTRAC reports for seven years.

Small business reality: If you maintain digital client files, this is largely about ensuring nothing is deleted prematurely.

Addressing Your Biggest Concerns

"Do I really need this?"

Yes. There is no small business exemption, no revenue threshold, and no minimum transaction volume. If you provide a designated service — even occasionally — you are a reporting entity with full obligations. Non-compliance can result in civil penalties and enforceable undertakings regardless of business size.

"Can I afford this?"

You cannot afford not to. AUSTRAC infringement notices can exceed $100,000, and civil penalties can reach into the millions. The cost of compliance is modest by comparison — particularly for small businesses taking a proportionate approach.

You do not need a compliance consultant at $300 per hour or enterprise software. Tools like ComplyReady are designed for small businesses newly captured by Tranche 2, with pricing from $99 per month — less than most businesses spend on accounting software.

"What if I get it wrong?"

AUSTRAC has indicated it will take a measured approach during the initial period after Tranche 2 commences, particularly for businesses making genuine efforts. The priority is bringing businesses into compliance, not penalising those who are trying.

That said, having nothing in place will not be treated leniently. An imperfect program that is genuine, documented, and actively being improved is far better than no program at all.

"I don't understand the legislation. Where do I start?"

You do not need to read the AML/CTF Act cover to cover. Start with AUSTRAC's own industry guidance, which is written in plainer language. Focus on the six obligations above and build from there — or use a tool like ComplyReady that generates a tailored program based on your industry and risk profile.

A Simple Compliance Checklist

• [ ] Confirm you are a reporting entity providing designated services
• [ ] Enrol with AUSTRAC through the online portal
• [ ] Appoint an AML/CTF compliance officer (you can appoint yourself)
• [ ] Complete your ML/TF risk assessment (Part A)
• [ ] Write your compliance procedures (Part B)
• [ ] Establish CDD processes for verifying customer identity
• [ ] Deliver AML/CTF training to yourself and any staff
• [ ] Set up a process for identifying and reporting suspicious matters
• [ ] Implement a record-keeping system with seven-year retention
• [ ] Schedule your first annual program review

You Do Not Have to Do This Alone

The AUSTRAC obligations for businesses are real, but they are designed to be achievable — even for the smallest operators. A small business with a simple, well-documented program that genuinely reflects its operations is in a stronger position than a large firm with a glossy manual nobody follows.

ComplyReady was built for exactly this situation. It helps small Australian businesses navigate AUSTRAC's requirements without a compliance background or enterprise budget. For $99 per month, you get a tailored AML/CTF program, risk assessment, CDD workflows, and training resources. Start today at ComplyReady.