AUSTRAC's New AML Rules: The Front Desk Guide (2026)

The First Fines Are Out

On 30 September 2026 AUSTRAC announced its first infringement notices under the expanded anti-money laundering and counter-terrorism financing (AML/CTF) regime. They went to real estate, accounting and jewellery businesses that AUSTRAC believes failed to enrol within 28 days of providing a designated service, at $21,840 for corporate entities and $4,368 for individuals, with the ability to accrue daily. SmartCompany picked the story up on 14 October.

Enrolment is the easy part. The harder part is running your business the way the law now expects, every day, and a lot of that happens on the phone.

The Sixty Second Version

The test is always the service, not the job title. AUSTRAC's regulation check is the quickest way to find out, and its professional services guidance explains the "active steps" principle with examples.

Six Calls Your Front Desk Will Take

Each of these is a composite of situations AUSTRAC, the ACMA and the property industry describe in their own guidance and reporting. None needs a lawyer at reception. All of them need a rule your team knows before the phone rings.

Call 1: "It's me. I've changed banks, can you update my details?"

The most expensive call in property and professional services. Property settlement scams are classed by Scamwatch as payment redirection scams, and AAP reported in September 2026 that they cost Australians $166.8 million in 2025, up more than nine per cent on 2024. The same report notes fraudsters now use AI to draft convincing messages and clone voices.

What to do: never change bank details, contact details or authority to instruct on an inbound call or an email alone. Say you will call back, then ring the number already on the client file. AUSTRAC's record keeping guidance lists "emails, call notes or signed declarations from the customer confirming changes to their details" as due diligence records, so write down how you confirmed it.

Call 2: The familiar number on the screen

The client's name comes up on the handset, so the call feels safe. It is not proof. The ACMA explains that the number you see may not be the caller's actual number, and that scammers spoof Australian numbers to impersonate banks, government agencies and telcos. Our piece on caller ID and answer rates covers the same problem from the other side.

What to do: treat caller ID as a hint. For anything that matters, the call back rule from Call 1 applies.

Call 3: "Can I just text you a photo of my licence?"

It sounds helpful. It puts a client's identity document on a staff member's phone, outside your file, and possibly in a message thread nobody will ever delete. AUSTRAC's guidance says the Act does not require you to copy identification documents for customer due diligence. You must record what you did to identify the customer and the details you relied on, such as the passport details used to verify identity.

Note also how AUSTRAC's guidance on verifying individuals suggests confirming someone is who they claim to be: comparing them to their photo ID in person, on a video call, or with biometric technology. A voice call is not on that list.

What to do: point the client to the verification method your program specifies, and never collect ID by text, voicemail or a personal mobile.

Call 4: "Why do you need all this ID? I've been a client for years."

Expect this one a lot. AUSTRAC has a page for the public, why you might be asked for ID, which says newly regulated businesses "have a legal obligation to collect information about you before they can provide services to you". Sending clients there takes the argument out of your hands. AUSTRAC's due diligence guidance is also firm: if you cannot establish the required matters on reasonable grounds, you must not start providing the designated service.

Call 5: The cash buyer who wants to split the payment

A jeweller takes a call: a buyer wants a $14,000 piece, in cash, paid as two lots of $7,000 on different days. Buying or selling precious goods for $10,000 or more in cash, in one transaction or linked ones, is a designated service, and cash of $10,000 or more triggers a threshold transaction report. AUSTRAC's suspicious matter guidance gives structuring payments under $10,000 to avoid that report as an example of when to submit a suspicious matter report, and the obligation applies even if you turn the sale down.

What to do: the person who takes the call escalates it to your compliance officer, with a note of what was said. They do not argue about it on the phone.

Call 6: "Have you reported me to someone?"

The call nobody plans for. Tipping off, disclosing information about a suspicious matter report where it could prejudice an investigation, is a criminal offence with a maximum of 2 years' imprisonment, 120 penalty units, or both. AUSTRAC's examples include telling a customer you have reported them, or giving them enough to work it out.

What to do: give reception one neutral line, such as "I can't discuss that, but I'll pass your call to the right person," and pass it to the compliance officer. Nobody confirms or denies anything.

The Obligations Behind Those Calls

The six calls sit on top of the full set of duties in AUSTRAC's summary of obligations:

AUSTRAC publishes free program starter kits for accountants, conveyancers, legal practices, real estate agents and jewellers. Start there.

From Letters to Fines: How AUSTRAC Is Enforcing

The sequence so far has been quick. On 28 August 2026 AUSTRAC began issuing section 167 notices to businesses that appeared to be providing designated services without enrolling. "The time for preparation has passed," CEO Brendan Thomas said. A month later came the infringement notices. AUSTRAC says around 90 per cent of the first group it looked at have since enrolled or tried to, and as at 20 October 2026 it reports 62,710 businesses enrolled across all sectors.

Infringement notices are the lower end. AUSTRAC's page on the consequences of not complying also lists enforceable undertakings, remedial directions and Federal Court civil penalties of up to 100,000 penalty units for a company and 20,000 for anyone else, with a penalty unit worth $364 from 1 July 2026.

Small firms are feeling it. COSBOA chair Matthew Addison told SmartCompany: "A small one-man practice in the suburbs, the regulatory burden is disproportionately imposed upon them." AUSTRAC Deputy CEO Katie Miller's reply in the same piece: "The overwhelming majority of businesses are doing the right thing and taking their obligations seriously."

What to Keep, and for How Long

AUSTRAC's record keeping guidance says records can include audio and video files, emails and other correspondence, logs and databases. Due diligence records are kept for 7 years after the business relationship ends, or after a one off transaction completes. Transaction records are kept for 7 years from when they are made.

• Make the call note part of the file. Who called, the number, what they asked, how you checked, who approved.
• Record with notice. Recording consent rules come from state and territory law and they differ, so announce recording at the start of every recorded call, including any call answered after hours by an AI agent.
• Keep the format. AUSTRAC expects records kept in their original or usual format, so keep a recording as an audio file, not just a summary.
• Limit access. AUSTRAC expects identity details and suspicious matter material to be stored securely and seen only by authorised staff, and says insecure storage raises tipping off risk.
• Mind privacy. AUSTRAC notes that reporting entities have Privacy Act obligations even if they are small businesses.

What a Phone System Can and Cannot Do

VOCPhone includes call recording and runs on a network we own and operate ourselves, hosted in Australia, rather than reselling someone else's. If you want notes drafted from calls, our guide to AI call transcription and CRM notes explains how it works. A person should still check anything that goes on a client file. For how we check identity before changing anything on your phone account, see our customer identity authentication page.

The Front Desk Card

Print this and put it next to every phone. Then make sure it matches your AML/CTF program, because the program is what counts.

Running an agency or practice? See how we set up phones for real estate, accountants and legal practices.

This Is Not Legal Advice

This guide is general information. It is not legal advice and it does not cover every obligation or exemption. Whether you provide a designated service, and what your program needs, depends on your business. Use AUSTRAC's guidance and its Contact Centre on 1300 021 037, and talk to your professional body or a lawyer who works in AML/CTF.

Comparing costs first? Our pricing page works out your monthly figure without a sales call.

Frequently Asked Questions

What to Read Next