Insight

How to practically achieve AML/CTF compliance for the Legal Industry

insight featured image
Quick summary
  • Achieving AML/CTF compliance in the legal industry is a multi-faceted challenge requiring early preparation, clear mapping of services, robust governance, and a strong focus on both technical and human elements of change. 
  • Firms should start now, leverage available guidance, and ensure both their systems and people are ready for the new regime. 
Australia has commenced reforming its Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) regime including the ‘Tranche 2’ reforms, which expand AML/CTF compliance to apply to additional professions including lawyers.

There are a number of key steps that law firms must take to achieve AML/CTF compliance by 1 July 2026. Compliance with these obligations is not box-ticking exercise. It is a dynamic, risk-based process that must be embedded in client onboarding, ongoing relationship management, and compliance culture. It requires careful timing, robust documentation, staff training, and thoughtful integration with other compliance activities. 

Law firms must enrol as reporting entities with AUSTRAC from 31 March, before providing any designated services. This is a legal obligation and must be kept up to date. Failure to enrol can result in significant daily fines. 

Create a formal AML/CTF programme that includes: 

  • A comprehensive risk assessment (covering services, client types, engagement methods, and jurisdictions). 
  • Policies and procedures tailored to the firm’s risk profile. 
  • Clear documentation of how risks are identified, mitigated, and managed. 
  • Firms must establish clear governance: a governing body (board or risk committee), a responsible senior manager, and a compliance officer (the “glue” of the program).
  • Appoint a compliance officer (fit and proper) to oversee day-to-day compliance. 
  • Establish a clear governance structure, including a governing body (board or risk committee) and a responsible senior manager. 
  • Train all relevant staff on AML/CTF obligations, designated services, and how to identify and escalate suspicious activity. Staff must be trained to understand when CDD is required, how to conduct it, and how to recognise when a client’s risk profile may have changed (triggering ongoing or enhanced CDD).
  • Only firms providing “designated services” are captured by the regime. It’s critical to map out exactly what services your firm provides, when, and to whom, as scope creep can trigger AML obligations unexpectedly. 
  • Designated services include: assisting with real estate transactions, M&A, managing client money, equity/debt financing, selling shelf companies, and acting as a director or power of attorney, among others. Each service must be analysed for its AML/CTF implications.

CDD must be performed before providing a designated service, and may require ongoing or enhanced due diligence for higher-risk clients.  

The way you conduct CDD can significantly affect the client experience and your ability to service clients efficiently. Well-designed CDD processes should balance compliance with minimal disruption to clients. 

  • Initial CDD:  Collect and verify client information, and assess the risk the client presents before any designated service is provided. 
  • Ongoing CDD:  For ongoing client relationships (not just one-off matters), you must periodically review and update client information to ensure it remains accurate. 
  • Enhanced Due Diligence:  For higher-risk clients, you must collect more information and conduct deeper risk assessments.

Robust record-keeping is essential. You must keep records of all CDD activities, including what information was collected, how it was verified, and the rationale for risk assessments. This is vital for demonstrating compliance to AUSTRAC. 

There is a tension between CDD (and related reporting) and legal professional privilege. The legislation provides mechanisms for managing this, including a 10-day window for suspicious matter reporting to allow for privilege considerations.

  • Implement processes for transaction and compliance reporting (including suspicious matter reporting, with a 10-day window for legal professionals). 
  • Maintain robust records to demonstrate compliance—record keeping will be a focus of AUSTRAC’s supervision. 
  • Use robust project management to ensure timely and effective implementation. 
  • Apply change management and stakeholder engagement to embed compliance into the firm’s culture and daily operations. 

AUSTRAC’s expectations and timeline 

  • Pre-July 2026: Law firms must prepare for compliance, including enrolling with AUSTRAC (from 31 March), developing an AML/CTF program, appointing a compliance officer, and training staff. Many firms are planning a “soft launch” before 1 July to iron out issues. 
  • Post-July 2026: AUSTRAC will shift to enforcement. Non-enrolment can result in significant daily fines. Firms must demonstrate ongoing, reasonable steps toward compliance—perfection is not expected, but diligence is. 

 

We are here to help  

Whilst the new AML/CTF requirements won't be a requirement until 31 March 2026 for existing reporting entities and 1 July 2026 for new reporting entities, it is vital to start planning and preparing for compliance now. 

With a short lead time to compliance and limited AML/CTF experts across Australia, demand will only continue to increase as the compliance date approaches.   

Contact one of our AML/CTF experts if you would like to discuss any of the above. 

Learn more about how our Anti-Money Laundering reforms services can help you
Visit our Anti-Money Laundering reforms page
Learn more about how our Anti-Money Laundering reforms services can help you