Tipping off: what you must not tell the client

A search for “aml tipping off” usually wants a sentence to send the client. That is the wrong artefact. When a suspicion forms, the overview of the report itself — the test, the clocks, and the lodgement — is when a Tranche 2 firm must lodge a suspicious matter report. This page is only the tipping-off boundary: what you must not tell the client after that suspicion. Checked against AUSTRAC’s tipping-off page on 2 October 2026. This is general information, not legal advice. This page does not reproduce that guidance, and it does not give you a script. Whether the firm is in the regime is /tranche-2.

What you must not tell the client

AUSTRAC describes tipping off as a criminal offence. The maximum penalty is stated on their page. Read it there. The categories below are the boundary a professional firm has to hold. They are not wording. If a sentence would let the client, or someone close to them, work out that a report is in play, do not send it. Get advice.

• The client is not the only audience. An associate, a journalist, a public page, or a staff conversation the client can overhear can be the same disclosure. Restrict who can open the file.
• An investigation does not have to have started. AUSTRAC says you consider whether the disclosure could prejudice an investigation now or later. Do not wait for a file number before you stop talking.
• Exceptions are not a client script. Disclosures inside the firm, to manage the risk, or to a lawyer for advice on the firm’s own obligations, are discussed on AUSTRAC’s page. So is a narrow path for some legal practitioners and qualified accountants when they dissuade a client from an offence. A conveyancer should not assume that path applies. This page does not turn any exception into sentences for the client.

A customer check is not an explanation of the suspicion

Asking for identity because the program requires customer due diligence is a different job from telling the client why a file worries you. The check is customer due diligence requirements. You still must not disclose the report, the notice, or the suspicion that triggers a report. AUSTRAC’s tipping-off page includes examples of customer conversations. This article does not copy those examples. It does not give you a script, a “safe” paragraph, or a way to hint.

If you are unsure a sentence would disclose the protected information, do not send it. Escalate to the compliance officer. How a non-specialist gets that fact to the officer, the same day and in writing, is AML training for non-specialists. That path is internal. It is not a customer script.

The audit trail proves the file. It is not a script.

A later reviewer asks what you knew, when the suspicion formed, who could see it, and whether the client was sent the grounds. That is the prove-it record. Write the facts, the date, the decision, and that the grounds stayed inside the firm. Do not write a paragraph whose job is to be read aloud to the client. The audit trail supports that proof. It does not draft what you tell them.

The FreeAML firm suite is A$0. It stores that audit trail with the customer file: the note, the date, and who could open it. When the program still requires a verification, the firm sends the request by email and the check is client-pays. The email is the check. It is not an explanation of a suspicion. Current amounts are on FreeAML pricing. FreeAML does not decide reasonable grounds, does not lodge the suspicious matter report, does not write a client script, and does not replace austrac.gov.au.

Frequently Asked Questions