After 1 July 2026: AML/CTF in the systems firms already use

A firm can have an AML/CTF program on paper and still be unable to show, on the file staff actually open, which work is covered, who was checked, and where the evidence sits.

From 1 July 2026, specified legal, accounting and real-estate services in Australia sit inside the Commonwealth anti-money laundering and counter-terrorism financing regime. Firms are now operating under those rules, so the written process has to work in the systems people use every day.

Ryoss works on integrations, internal systems and the way information moves between business applications. We are not deciding whether a particular firm or instruction is captured; that stays with the organisation and its advisers. The technology problem here is how the AML/CTF process becomes part of the matter, sale or engagement staff already work with.

Which work is covered

The obligations apply to particular kinds of work, which AUSTRAC calls designated services. They do not apply automatically to every file a firm opens. A practice or agency may only need the AML workflow for some of what it does.

For legal and related professional services, that can include certain property transactions, company or trust creation and restructuring, some nominee, director or trustee arrangements, registered-office services, and related transactional work. Whether a given instruction is covered depends on the facts of the work. AUSTRAC’s page on professional designated services is the place to check the current list.

Accounting and bookkeeping firms are judged the same way. Ordinary bookkeeping, lodgements and recurring compliance work are not enough, on their own, to put every engagement inside the AML workflow. Providing a registered office, or helping to create or restructure a company or trust, can be. A firm can have obligations because of one service line without treating every client file as a regulated matter.

In real estate, brokering a sale or purchase is a designated service, and AUSTRAC treats both buyer and seller as customers. Managing a rent roll or ordinary residential leasing does not, by itself, put a property-management business inside the regime. Some developer and in-house sales models can be captured when the business sells real estate without an independent agent. AUSTRAC’s real estate designated services page sets out the current detail.

In each of these businesses, staff still need a reliable way, when work is accepted, to record whether this matter, sale or engagement is covered.

Where the process has to live

A single matter, sale or engagement often passes through several systems. Intake might happen in one place, identity checks somewhere else, the work itself in the practice or agency system, and money or documents somewhere else again. If those systems do not share a simple record of whether the work is covered, who was checked and where the evidence sits, staff rebuild the file by hand when they are asked to prove what was done. Two systems can disagree. An exception can sit in email instead of on the record that will be reviewed later. The written program and the tools people use day to day stop describing the same work.

Someone has to decide, when the work is accepted, whether this matter, listing, sale or engagement is a designated service, and that decision has to be recorded where the work is actually run. The people the Act treats as customers of that service are not always the same names the firm already stores as “the client.” Related parties have to be collected as well. Customer due diligence, meaning the identity and background checks the regime requires, has to sit with that work. The evidence has to remain retrievable for the period the Rules require, and available to the people who need it, without becoming a second unofficial file.

In some real-estate workflows the Rules allow a limited delay before customer due diligence is completed on the party the agent is not acting for. That only works if the sales or matter system can see the relevant contract and settlement dates. AUSTRAC currently bounds that delay by the earlier of 28 days after exchange of contracts, or at least three days before the initially agreed settlement date; the party the agent acts for still has to be checked before the service is provided to them. Legal and conveyancing work on a buyer’s real-estate transaction has a published delay bound to the same markers. The delayed initial customer due diligence page is the current reference. A verification product that only collects identity at listing time does not finish that job.

If stopping work, escalating a suspicion or recording why a delay was used sits with whoever happens to be on the file, and nowhere in the system, the organisation has a process it cannot show.

This is ordinary integration work: joining the systems the firm already has so that coverage, the customer record, the evidence and the dates travel with the matter, sale or engagement. The legal reading of whether a service is captured, the trust account, and AUSTRAC enrolment remain the organisation’s responsibility.

The file the staff already open

Each of these businesses already has a primary record. The AML information has to fit there, rather than become a second administration that people maintain beside the real work.

A legal practice usually keeps that record on the matter: the instruction, the parties, the documents, the trust movements and the correspondence. Coverage, customer due diligence and related parties need to attach there. If identity checks, costs disclosure and AML due diligence share one checkbox, the file can look complete and still be unable to answer a specific question later.

A property agency already organises a sale around listing authority, offer, exchange and settlement. Seller checks belong when the agency agrees to broker the sale. Buyer checks belong when the transaction is reasonably expected to proceed, typically when an offer is accepted and the contract is signed, subject to the delayed timing above. Tenant and landlord records in a property-management system are a poor place to keep that sales evidence, even when the same agency runs both businesses.

An accounting or company-services firm may have no matter and no sale. The record might be a client engagement, a company, or the provision of a registered office. AUSTRAC’s example for a registered-office service treats the company using the address as the customer, which may not be the individual the firm thinks of as the client.

Trust and office ledgers vary by profession. They do not need to become the AML system, but they do need to point at the same parties and the same file. If training talks about customers while the software talks about clients, vendors, buyers and sellers, the files will drift. The work is to make the required customer visible on the record staff already open.

What a firm should be able to show now

A principal or operations lead should be able to show the following from the systems the firm is running today.

• Which work is treated as covered, recorded on the matter, sale or engagement when it is accepted.
• Who the workflow treats as customers and related parties, including the other party where that is required.
• Where the identity and customer due diligence evidence sits, who can see it, and whether it can still be retrieved after staff change and for the required retention period.
• The contract and settlement dates that govern any delayed checks.
• How a suspicious-matter or threshold-transaction report would be prepared from that file, and who can stop or escalate the work.
• The same parties in the trust or office ledger, without someone reconstructing the mapping by hand.

The written program can say that customer due diligence occurs. That only helps if the practice, sales or CRM system can store the result and staff can retrieve it later from the matter, sale or engagement.

Identity-verification products may produce some of the evidence. The firm still needs that material connected to the matter, sale or engagement so staff can find it later. Conveyancing and tenancy verification of identity is a separate obligation; completing one does not complete the other.

What we are still watching

Enrolment, the content of the program and any independent evaluation stay with the organisation and its AML advisers.

AUSTRAC is still publishing and updating guidance as organisations settle into the new regime. Ryoss will keep watching changes that affect how this work has to sit in existing practice, sales and accounting systems. We will write again when there is something material to explain.