Since 1 July 2026, Australia’s Anti-Money Laundering and Counter-Terrorism Financing Act (AML/CTF) reforms have been in force. A range of professional services businesses are now covered by the regime, including certain lawyers, accountants, real estate professionals and other service providers (Tranche 2 entities).
However, AML/CTF obligations are not the only laws that apply to Tranche 2 entities. Any organisation that becomes a reporting entity under the AML/CTF legislation must also comply with the Privacy Act 1988 (Cth) in respect of its AML/CTF activity — even if it does not meet the $3 million annual turnover threshold that would otherwise trigger Privacy Act obligations. For many small businesses in these sectors, including sole traders, this is a significant new compliance obligation.
The question is not simply whether your business meets its AML/CTF obligations — it is also whether, under the Privacy Act and the Australian Privacy Principles (APPs), you are collecting more personal information than you need, keeping it longer than necessary, or failing to protect it properly.
Which businesses are now covered by the expanded AML/CTF regime?
The expanded regime now applies to the following Tranche 2 entities:
- Lawyers and conveyancers;
- Accountants;
- Real estate professionals;
- Trust and company service providers; and
- Dealers in precious metals and stones.
Why do privacy obligations now matter for AML/CTF compliance?
The Privacy Act has always applied to AML/CTF reporting entities. With the expansion of the AML/CTF regime to include Tranche 2 entities, the scope of the Privacy Act has expanded accordingly.
This means everyday AML/CTF steps, such as client onboarding, identity verification and ongoing monitoring, may also trigger privacy obligations. Tranche 2 entities need to consider how they collect, use, store and protect client identity information at each of these stages.
OAIC guidance on retention of documents
In February 2026, the Office of the Australian Information Commissioner (OAIC) released guidance for AML/CTF Act reporting entities. The guidance applies to both existing reporting entities and newly captured Tranche 2 entities.
The OAIC was clear: reporting entities must limit their collection of personal information to what is “reasonably necessary” for AML/CTF purposes. This means entities should not retain copies of identity documents; a practice that has been widespread. Instead, they should record the relevant personal information, the type of document sighted and the outcome of the AML/CTF process.
What privacy risks arise when businesses collect personal information for AML/CTF compliance?
The key message is simple: only collect what you need. Under both the AML/CTF Act and the Privacy Act, this means limiting collection to what is reasonably necessary for the specific compliance purpose.
In practice, this means avoiding “just in case” collection of personal information, taking a sensible and proportionate approach to identity checks, and making sure any personal information you do collect is accurate, secure and properly controlled.
The bottom line: the more you collect, the more you can lose. The OAIC has made its expectations clear, and entities that suffer data theft involving identification document copies can expect to face regulatory scrutiny.
How does cyber security fit into AML/CTF compliance?
By the very nature of the AML/CTF laws, the information reporting entities must collect is highly personal and specific – and therefore a prime target for cyber threats and data theft.
Cyber security is now part of the compliance picture. If AML/CTF information is accessed, lost or disclosed without authorisation, businesses may be required to notify affected individuals and the OAIC under the Notifiable Data Breaches scheme.
At a minimum, businesses should think about practical controls such as access restrictions, multi-factor authentication, audit logging, regular system updates and patching, and a clear data breach response plan. To limit their exposure footprint, Businesses should think carefully about what they actually need to collect, noting OAIC guidance.
What should Tranche 2 entities do now?
AML/CTF compliance, privacy and cyber security now go hand in hand. For Tranche 2 entities, the focus should be on:
- having clear and compliant privacy policies;
- ensuring that the personal information collected is genuinely necessary for compliance with the AML/CTF regime.
- not retaining copies of drivers’ licences, passports and other identification documents and ensuring secure destruction of any copies taken.
- having an action plan ready in the event that you are the target of data theft.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
