AML Check for Australian Businesses: Complete Tranche 2 Guide (2026)

What is an AML check?

An AML check (Anti-Money Laundering check) is a mandatory identity verification process that Australian businesses must perform on all clients from July 1, 2026. This requirement is part of Tranche 2 of Australia's AML/CTF Act 2006, which expands anti-money laundering obligations beyond banks and financial institutions to include professional services and other high-risk sectors.

These industries have been identified as high-risk for money laundering because they can be used to legitimize illegally obtained funds. Criminals use professional services—property transactions, company formation, trust administration, high-value goods purchases—to "clean" dirty money and integrate it into the legitimate economy.

An AML check involves three key components:

• Document verification: Validating government-issued ID (driver's licence, passport, Medicare card)
• Biometric authentication: Selfie + liveness check to confirm the person matches their ID photo
• AML screening: Checking the client against global sanctions lists, Politically Exposed Persons (PEPs) databases, and financial crime watchlists

The result is a Customer Due Diligence (CDD) report that provides proof of compliance for AUSTRAC audits.

Who needs to perform AML checks?

From July 1, 2026, all Tranche 2 businesses must comply. This includes:

There are no exemptions based on transaction value, business size, or client type. Whether you're a sole practitioner or a national firm, AML compliance is mandatory.

When must you verify a client's identity?

Timing is critical. You must verify identity before providing a designated service. AUSTRAC defines timing requirements by sector:

This means you cannot wait until after service delivery or contract completion. Verification must happen upfront, ideally when the client first approaches you.

Step-by-step: How to perform an AML check

Here's the complete AML check process using FreeAML:

Step 1: Collect client details

When a client contacts you, collect their basic information:

• Full legal name
• Email address or mobile number
• Type of service required

For entities (companies, trusts, SMSFs), you'll also need:

• ACN/ABN
• Business name
• Details of all beneficial owners (people with 25%+ ownership or control)

Step 2: Send verification link

Use FreeAML to send a secure verification link to your client's email or mobile. The client receives the link instantly and can complete verification on any device—phone, tablet, or computer.

What the client does:

1. Opens the verification link (no app download required)
2. Scans their government-issued ID (driver's licence, passport, or Medicare card)
3. Takes a selfie with liveness check (anti-spoofing technology ensures they're physically present)
4. Submits the verification (takes under 2 minutes)

Step 3: Receive compliance report

Within minutes of your client completing verification, you receive an AUSTRAC-compliant CDD report via email. The report includes:

• Verified full name and date of birth
• Document type and reference number
• Biometric liveness check results
• AML watchlist screening (sanctions, PEPs, criminal databases)
• Verification timestamp and audit trail
• Compliance certification

The report is stored securely and accessible for the required 7-year retention period.

Step 4: Assess and proceed

Review the CDD report. If the client passes all checks, you can proceed with service delivery. If the client:

• Fails document verification: Request alternative ID or investigate further
• Fails liveness check: May indicate a fake ID or deepfake attempt—do not proceed
• Appears on AML watchlists: You may need to file a Suspicious Matter Report (SMR) with AUSTRAC and cannot proceed without further investigation

Penalties for non-compliance

AUSTRAC has significant enforcement powers, and penalties for non-compliance are severe:

• Civil penalties: Up to $27 million for corporate entities or $5.4 million for individuals per contravention
• Infringement notices: On-the-spot fines for administrative breaches (e.g., failing to keep proper records)
• Injunctions: Court orders to stop you from operating until you comply
• Criminal prosecution: For serious or intentional breaches, including jail time
• Reputational damage: AUSTRAC publishes enforcement actions publicly

Recent enforcement actions against banks show AUSTRAC is willing to pursue maximum penalties. Westpac was fined $1.3 billion in 2020 for AML breaches. While small businesses are unlikely to face billion-dollar fines, penalties in the millions are realistic for systematic non-compliance.

How FreeAML helps businesses

FreeAML was built specifically for Australian businesses facing Tranche 2 compliance. Here's how we make AML checks effortless:

Common scenarios by sector

Real Estate: Selling a property

Your vendor (seller) wants to list their property. Verify their identity before signing the agency agreement. If the property is owned by a trust or company, verify the entity AND all beneficial owners.

Accounting: New client onboarding

A business wants you to prepare their annual accounts and tax returns. Verify the business entity structure and all beneficial owners before providing services.

Legal: Property settlement

A client engages you for conveyancing services. Verify both buyer and seller identities before commencing settlement work.

Jewellers: High-value sale

A customer wants to purchase a $15,000 diamond ring. Verify their identity before completing the transaction.

Preparing your business for July 1, 2026

Don't wait until the deadline. Here's a 90-day action plan:

60-90 days before deadline

• Educate all staff on AML/CTF requirements
• Update client onboarding processes to include identity verification
• Test FreeAML with a few pilot verifications
• Review and update your privacy policy to cover AML data collection

30-60 days before deadline

• Create email templates for sending verification links to clients
• Train staff on how to review CDD reports and identify red flags
• Designate an AML compliance officer within your business
• Develop your AML/CTF program (use AUSTRAC's free templates)

0-30 days before deadline

• Verify all existing clients (anyone you're currently serving)
• Update contracts and engagement agreements to reflect AML requirements
• Run a compliance audit to ensure all systems are in place
• Enroll with AUSTRAC (opens March 31, 2026)

Frequently asked questions

Final thoughts

Tranche 2 represents the biggest compliance change for Australian professional services in decades. The July 1, 2026 deadline is firm, and there will be no extensions or grace periods.

The good news: modern technology makes AML compliance simple. With FreeAML, you can verify clients in under 60 seconds without disrupting your workflow or delaying transactions.

Start verifying clients today. The sooner you integrate AML checks into your process, the smoother your transition will be.