AUSTRAC enrolment: how Australian accounting and legal firms enrol

Since 1 July 2026, accounting practices and legal practices providing certain designated services have been reporting entities under the AML/CTF Act. The first administrative step is enrolment with AUSTRAC, and it is worth using the right word for it. Accounting and legal practices enrol. Registration is a separate and additional process that applies principally to remittance service providers and virtual asset service providers, and most professional firms will never need it. A firm hunting for a registration process for its accounting practice is looking for something that does not apply to it.

A reporting entity is a business that provides one or more designated service under the AML/CTF Act. For accountants the relevant services include assisting with the planning or execution of, or otherwise acting for a client in, the formation or restructuring of a company, partnership or trust; acting as, or arranging for another person to act as, a director, secretary, trustee or nominee shareholder; providing a registered office address or principal place of business address; assisting with the buying or selling of a body corporate or real property; selling or transferring a shelf company; assisting with equity or debt financing for a company or trust; receiving, holding or managing client money or property as part of a transaction; and acting as, or arranging, a partner in a partnership or a power of attorney for a company or trust. The same list of designated services (table 6 in section 6 of the Act) applies to accounting and legal practices alike, and the client money item can catch accountants as well as lawyers. Most firms in our client base provide several of them.

The timing rule is the one most often misunderstood. A firm generally applies to enrol no later than 28 days after it starts providing a designated service. That is a deadline for the administrative act of enrolling, not a grace period on the obligations themselves. The substantive obligations, having AML/CTF policies in place, carrying out initial customer due diligence, and reporting suspicious matters, apply from the point the designated service is provided. A firm that enrols on day 27 having done no customer due diligence in the meantime has met the enrolment deadline and breached the substantive obligations.

Enrolment is completed online through AUSTRAC Online. The firm provides core business details, ABN, ACN, business addresses and ownership structure, nominates a primary contact and an AML/CTF compliance officer, and declares which designated services it provides. The declared services list needs to be accurate: under-declaring is a compliance problem, and over-declaring loads the firm with obligations it does not have. The firm must also identify related reporting entities under common control, which is how AUSTRAC identifies reporting groups.

The compliance officer nomination deserves more thought than it usually gets. The AML/CTF compliance officer must be an individual employed or engaged at management level, with enough authority, independence and access to resources to do the job, who is an Australian resident and a fit and proper person. The officer must be designated within 28 days of first providing a designated service, and AUSTRAC must be notified within 14 days of the designation. Nominating a junior staff member because they have capacity is a common and consequential error.

The other frequent errors are the predictable ones: leaving an obvious reporting entity inside the firm group unenrolled, treating enrolment as the end of the compliance task rather than the beginning, and assuming that because the firm has enrolled it has time before it needs policies and customer due diligence. It does not.

CoSec Partners works with accounting and legal firms on the corporate-secretarial side of AML compliance: customer due diligence on the entities we form, beneficial ownership documentation, and structured handover of compliance information at customer onboarding. We are not AML consultants and we do not prepare or review a firm’s AML/CTF policies. Contact us about the formation-side arrangements, including setting up a reliance arrangement so the same customer is not verified twice.