The AML regime has been live since July. Here’s what the Act asks of accounting firms.

Since 1 July 2026, accountants who provide certain professional services have been reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Four months in, those obligations are part of how the services are delivered.

The compiled AML/CTF Act sets out what that involves: enrolment with AUSTRAC, a risk assessment, written policies, customer due diligence, suspicious matter reporting and record-keeping. Each one is a specific obligation with its own section of the Act.

Much of that work involves collecting documents, checking identities and keeping records. Those are tasks AI tools can help with. The judgement calls stay with the firm.

The regime is triggered by a defined list of professional services in the Act. They include setting up or restructuring a company or trust, holding or managing a client’s money as part of a transaction and acting as a nominee shareholder or director for a client. Helping a client buy or sell real estate or a company is also on the list.

Preparing tax returns, lodging BAS and day-to-day bookkeeping do not appear on that list. Whether a firm is covered depends on whether it provides any of the listed services, so that is the first thing for a firm to check.

These services became designated services from 1 July 2026. A firm that provides one must apply to enrol with AUSTRAC within 28 days of starting. Existing clients get some relief. A client whose relationship with the firm involved only these services at 1 July 2026 does not need the full initial checks. That changes if a suspicious matter arises, or if the nature or purpose of the relationship changes significantly and the client becomes medium or high risk.

Every firm in the regime needs a documented risk assessment and policies to manage what it finds. Under section 26C, the assessment covers the risks a firm may face in providing its services. It must take account of the services themselves and the channels used to deliver them, “including any new or emerging technologies”. The work has to suit the size and complexity of the firm, and a compliance officer at management level must be designated.

Before taking on a new client for a listed service, a firm must carry out customer due diligence. Section 28 requires it to establish “on reasonable grounds” who the client is, who any beneficial owners are and what the relationship is for. Where a firm forms a suspicion about a client, it may need to report it to AUSTRAC as a suspicious matter.

Section 107 then requires a firm to keep “sufficient records to allow the reconstruction of individual transactions” for seven years. AUSTRAC’s guidance for accountants covers these obligations and includes a program starter kit to help small accountancy firms create their AML/CTF program.

The Act already expects firms to think about technology. A firm’s risk assessment has to consider the risks of new or emerging technologies in its services and in how it delivers them.

AI tools fit the mechanical steps: collecting client documents, checking identity details and keeping records in a form that can be retrieved later.

The Act is clear about where the judgement sits. Customer due diligence turns on what the firm can establish on reasonable grounds, and suspicious matter reporting turns on what the firm suspects. Those are decisions a firm needs to be able to explain.

Record-keeping sets a practical test for any tool. If records must allow individual transactions to be reconstructed for seven years, a firm needs to know where its AI tools store information and whether it can be retrieved. That applies to any records an AI tool creates as part of the work.

The type of tool matters here. General-purpose AI tools are designed to handle a broad range of tasks. Compliance work under the Act needs documented records that can be retrieved and tied to the firm’s own clients.

Whatever tools a firm uses, the Act puts a named individual at management level in the compliance officer role. That person oversees the firm’s day-to-day compliance and the effective operation of its AML/CTF policies, which include the systems and controls the firm relies on.

The obligations are now set out in the Act. Choosing tools that can meet them, with records a firm can stand behind for seven years, is the part each firm works through for itself. The compiled AML/CTF Act sets out each obligation in full.

The Great AI Con: Paying for AI trained on Reddit and TikTok to help you with a BAS

AML compliance runs on records a firm can retrieve, document and tie to its own clients. David Boyar, FCA, of The Access Group, sees the client data practices hold as one of the most valuable datasets on the planet. He describes it as “clean, structured, verified, client-rich, domain-specific” data.

His concern is that firms end up paying twice to use it. They pay once for general-purpose AI to work out what it is looking at, and again for it to explain what it means. In the session, he makes the case for specialist AI built for your practice. If your firm is deciding which AI tools to trust with its client records, come and hear his case before you choose.

Wednesday 11 November 2026, 10:00am AEDT

Register for the session

Part of The AI in Practice Summit, 11 and 12 November 2026. Free, online, every session recorded.