AML Tranche 2 for accountants: which services are designated?
From 1 July 2026, AML/CTF Tranche 2 makes your practice an AUSTRAC reporting entity only where you provide a "designated service": for example forming or restructuring companies and trusts, holding or disbursing client money, or acting as a nominee director or trustee. Preparing tax returns, financial statements and tax advice, and doing BAS, bookkeeping, audit and payroll, are not designated services.
By Jon Oates, Founder of Privaproof · Last updated
General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.
The regime regulates services, not professions
Tranche 2 of the Anti-Money Laundering and Counter-Terrorism Financing Act commences 1 July 2026. The professional-services provisions were inserted by the AML/CTF Amendment Act 2024 and are widely described as Table 6 of s 6 of the AML/CTF Act. The point that trips people up: the obligation attaches to the service, not to the job title. Being an accountant, bookkeeper or tax agent does not make you a reporting entity. Providing a designated service does. So most general practices are caught, if at all, only for a subset of their engagements, and many are not caught at all.
The services that are designated
The designated services in the professional-services table that most commonly reach an accounting practice include:
- Forming or restructuring a company or trust, including setting up a corporate trustee for an SMSF.
- Selling a shelf company.
- Holding, managing or disbursing a client's money (for example running money through a trust account on their behalf).
- Arranging equity or debt finance for a client.
- Acting as, or arranging for another person to act as, a nominee director, secretary, trustee, holder of a power of attorney, or nominee shareholder.
- Providing a registered office or business address for a client.
- Assisting a client to buy, sell or transfer real estate or a business.
*The exact statutory text and provision cite of each Table 6 item for accountants is not restated here; treat the list above as the effect of the designated-service provisions, and confirm the precise item against the AML/CTF Act with AUSTRAC.
The services that are not designated
This is where most vendor messaging overstates the position. The following are not designated services:
- Preparing and lodging tax returns.
- Preparing financial statements.
- Giving tax advice.
- BAS and GST work.
- Bookkeeping.
- Audit.
- Payroll.
A practice that does only this work is not an AUSTRAC reporting entity and does not enrol. That is the majority of practices. Do not let an AML kit vendor tell you the whole profession is now inside AML.
The line that decides it: advice out, execution in
If you cannot tell whether an engagement is designated, the working test is advice out, execution in. Advising a client on whether to restructure into a company or trust is not a designated service. Actually forming or restructuring that entity, or holding the client's funds to do it, is. The same client, the same matter, can sit on either side of the line depending on what you actually do. Because the trigger is the service, a single practice can provide a designated service on one engagement and none on the next.
What being a reporting entity does to your Privacy Act position
Being caught by AML is not the end of the story, because it pulls a privacy obligation in behind it. Where a designated service makes an otherwise-exempt small practice a reporting entity, Privacy Act s 6E treats you as an organisation, but only for the activities you carry on for the purposes of, or in connection with, the AML/CTF Act. So the Australian Privacy Principles reach the AML/KYC/CDD identity data you collect for that service, not your general tax files, ledgers, payroll or CRM, which stay under the small-business exemption unless another trigger (such as the TFN Rule) applies. Read: does becoming an AML reporting entity trigger the Privacy Act for accountants?
This is the gap the AML software leaves open. An AML kit gets you enrolled and sets up your KYC collection; it does not deliver the privacy policy, collection notices and breach plan the Privacy Act then expects for that AML/KYC data. Read: AML kit vs privacy kit, what your AML software leaves out.
Enrolment timing
Enrolment for newly regulated firms opened 31 March 2026. Existing providers of a designated service enrol by around 29 July 2026. New entrants have a separate enrolment window and a compliance-officer notification step whose exact timing you should confirm directly with AUSTRAC, because some vendor guides conflate the two.
At a glance
| Question | The accurate answer |
|---|---|
| Does AML Tranche 2 catch all accountants? | No. It catches a practice only where it provides a designated service. Most tax and bookkeeping practices provide none. |
| Are tax returns, BAS and bookkeeping designated? | No. They are outside the designated-service table. |
| What is a designated service, roughly? | Forming or restructuring entities, holding or disbursing client money, arranging finance, acting as or arranging a nominee, providing a registered office, or assisting to buy or sell real estate or a business. |
| If I am caught, what does the Privacy Act reach? | Under s 6E, the AML/KYC identity data you collect for the designated service, not your whole practice. |
| When do I enrol? | Enrolment opened 31 March 2026; existing providers enrol by around 29 July 2026. Confirm your firm's date with AUSTRAC. |
Common questions
Is my whole firm regulated once I provide one designated service?
No. Being a reporting entity does not remove the small-business exemption across the practice. Under Privacy Act s 6E the Privacy Act reaches the AML/KYC identity data you collect for the designated service, not your general tax, ledger, payroll or CRM records.
I set up companies and SMSF corporate trustees for clients. Am I caught?
Forming or restructuring a company or trust, including setting up an SMSF corporate trustee, is described as a designated service, so this is one of the engagements most likely to make an accounting practice a reporting entity. Confirm your exact position and the precise provision with AUSTRAC.
I only do tax returns, BAS and bookkeeping. Do I need to enrol?
On the current designated-service list, no. That work is not a designated service, so a practice doing only tax compliance and bookkeeping is not an AUSTRAC reporting entity. Note that a separate obligation, the Privacy (Tax File Number) Rule 2015, still binds you for the individual TFNs you handle, regardless of AML. Read: the TFN Rule 2015, what accountants must do.
Keep reading
- Privacy Act compliance for accountants and bookkeepers (the cornerstone)
- Does becoming an AML reporting entity trigger the Privacy Act for accountants?
- AML kit vs privacy kit: what your AML software leaves out
- How long can an accountant keep a client's TFN?
- The Privacy (Tax File Number) Rule 2015: what accountants must do
General information and compliance tools, not legal advice. Privaproof is not a law practice and does not provide legal advice. This page does not assess your obligations under the AML/CTF Act itself, which are administered by AUSTRAC, and does not tell you whether a specific engagement is a designated service. Privaproof's accountant documents are self-authored and are not independently reviewed by a solicitor. The AML/CTF Act and the Privacy Act 1988 (Cth) change over time, so check you are working from a current version and confirm your firm's position with AUSTRAC.