Thousands of small businesses are facing a new compliance burden under Australia’s Tranche 2 reforms to the Anti-Money Laundering and Counter-Terrorism Financing Act, which now require them to collect and secure some of their customers’ most sensitive personal information.
What Tranche 2 actually requires
The reforms, which commenced on 1 July 2026 under the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024, extend AUSTRAC’s oversight to so-called “gatekeeper” professions for the first time, among them lawyers, accountants, conveyancers, real estate agents and dealers in precious metals and stones. AUSTRAC opened enrolment on 31 March 2026, with a deadline of 29 July 2026. Affected businesses now need to verify clients, identify who ultimately controls companies and trusts, monitor suspicious activity, and maintain compliance records and a formal AML/CTF program.
AUSTRAC has already begun enforcing the new rules. In late September, the regulator confirmed it had started issuing infringement notices for businesses that failed to enrol, with penalties of $21,840 for companies and $4,368 for individuals. Charles Sturt University financial crime expert Dr Michael King estimates the reforms bring roughly 100,000 additional businesses under AUSTRAC’s oversight.
It’s not the first time an expansion of anti-money laundering rules has drawn criticism from small business groups. When similar levies and obligations were introduced in previous years, industry bodies including CPA Australia argued compliance costs were falling disproportionately on smaller operators without dedicated compliance teams.
A new compliance burden
Richard Mallam, founder and CEO of identity verification company VO, says the obligation has landed on businesses that have never had to manage this kind of regulatory responsibility before. “A small suburban accounting practice or real estate agency can now be collecting highly sensitive customer information while carrying privacy obligations they might never previously have had to deal with,” he said. “These businesses must conduct customer due diligence, verify identities, assess risk, maintain compliance programs and keep records, and they are telling me they are already struggling to comply.”
Under the changes, small businesses with an annual turnover below $3 million are now also subject to fines under the Privacy Act, a threshold that previously exempted many smaller operators from parts of that legislation.
A bigger privacy risk
Mallam says the law’s intent, stopping criminals from moving illicit funds, has created a separate problem: smaller businesses now store large volumes of identity documents with limited cybersecurity infrastructure. “We’re basically creating thousands of honeypots of identity data with these small businesses now the frontline of the nation’s financial crime defences,” he said. “They’ve become custodians of valuable personal details, making them a risk to cyber criminals.”
“Australia’s sweeping new anti-money laundering laws have created a privacy ticking time bomb for thousands of small businesses now having to collect personal identification details and shoulder unprecedented responsibility for keeping that information secure,” Mallam said. “Extending this law to these businesses was aimed at stopping criminals moving dirty money but has created a parallel privacy crisis at a time when cybercrime is becoming more sophisticated.”
Mallam also raised concerns about the regulatory messaging businesses are receiving. “On one hand you have AUSTRAC telling consumers there’s nothing to be alarmed about, but consumers are losing control of their data which could be shared in 100 places, and the privacy commission is just saying well if businesses do the wrong thing they’ll be fined, which is cold comfort for consumers,” he said.
What’s being done about it
AUSTRAC itself has acknowledged the compliance burden facing smaller Tranche 2 entities, releasing sector-specific AML/CTF program starter kits for small legal, conveyancing and accounting practices, along with an online tool businesses can use to check whether they’re regulated under the new rules.
Separately, Mallam’s company, VO, has partnered with identity verification provider VerifiMe on a digital identity product called VerifiOnce, designed to let customers verify their identity once and reuse those credentials across participating businesses, rather than submitting a passport or driver’s licence to every business individually.
“Australians have become conditioned to sending a passport or driver’s licence every time they need to prove who they are,” Mallam said. “But once you hand over a high-value identity document, you can lose visibility and control over where that information goes, who has access to it and how long it remains in a system.”
Whether tools like VerifiOnce reduce the volume of sensitive data businesses need to store remains to be tested at scale. What’s clear from the reforms themselves is that a growing number of small businesses, many with no prior experience managing this kind of regulatory or data security obligation, are now required to collect, secure and account for some of their customers’ most sensitive personal information, with real financial penalties attached if they get it wrong.