AUSTRAC Tranche 2 penalties: what real estate agencies face for non-compliance — AML Simple

The penalties for failing to comply with AUSTRAC Tranche 2 are not symbolic. Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, a body corporate faces up to $33 million per contravention. An individual faces up to $6.6 million per contravention.

Penalties also stack. Missing your enrolment, having no AML/CTF program, and failing to conduct CDD are three separate potential contraventions.

This post explains how AUSTRAC's enforcement framework works and what the realistic risk picture looks like for a typical real estate agency.

Start with the fastest path to protection

The most effective way to reduce your enforcement risk is to have your compliance foundations in place before 1 July 2026. Three steps cover the essentials — around 22 minutes:

Sign up to AML Simple — around 2 minutes. Enter your ABN, your profile is pre-filled.
AUSTRAC Enrolment Cheat Sheet — around 5 minutes. Every enrolment field pre-filled from your account.
AML/CTF Program Generator — around 15 minutes. Your program document generated and ready for senior management sign-off.

An agency that is enrolled, has a documented program, and starts CDD from 1 July 2026 is in a fundamentally different legal position from one that has done nothing.

How AUSTRAC enforces the rules

AUSTRAC's enforcement posture is described as "supportive but firm." It has committed to working with businesses making genuine, good-faith efforts to comply. It has also said the deadline will not be extended.

Under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, AUSTRAC's enforcement toolkit includes:

Compliance assessments: AUSTRAC can request documentation and evidence of your AML/CTF program at any time. You must be able to produce your program, your CDD records, your training records, and your screening results.

Directed audits: AUSTRAC can order you to appoint an external auditor at your own cost and provide the findings to AUSTRAC within a specified timeframe. This power was used in April 2026 against a payment platform that lacked adequate monitoring controls — three months before Tranche 2 obligations begin.

Enforceable undertakings: Binding agreements to fix specific compliance failures within set timeframes.

Civil penalties: Up to $33 million per contravention for a body corporate; up to $6.6 million per contravention for an individual.

Criminal penalties: In serious cases involving deliberate non-compliance or facilitating money laundering.

Source: AUSTRAC compliance and enforcement

What counts as a contravention?

Each distinct compliance failure is potentially a separate contravention. Here are the failures most commonly cited in AUSTRAC enforcement actions:

Failing to enrol: You are required to enrol with AUSTRAC by 29 July 2026. Operating as a regulated entity without being enrolled is a contravention.

No AML/CTF program: Failure to have a documented AML/CTF program in place when you commence regulated activity from 1 July 2026 is a contravention. Source: AML/CTF Act 2006, s 81.

Failing to conduct CDD: Not performing customer due diligence before providing a designated service is a contravention. Every transaction where CDD is not done is a potential separate breach. Source: AML/CTF Act 2006, s 34.

Failing to screen against sanctions lists: Failure to screen clients against the DFAT Consolidated Sanctions List and screen for PEPs is a contravention.

Not filing SMRs: If you have reasonable grounds to suspect money laundering or terrorism financing and you do not file a Suspicious Matter Report within the required timeframe (24 hours for terrorism; 3 business days for money laundering), that is a contravention.

Not keeping records: Failing to retain AML/CTF records for 7 years is a contravention. Source: AML/CTF Act 2006, s 107.

Not training staff: Allowing staff to perform AML-relevant duties without having received appropriate training is a contravention.

What does "per contravention" actually mean?

Consider an agency that:

Did not enrol by 29 July 2026
Has no AML/CTF program
Conducted 10 property sales without doing CDD

That is potentially: 1 (enrolment) + 1 (no program) + 10 (CDD failures) = 12 separate contraventions.

At the maximum civil penalty for an individual: 12 × $6.6 million = $79.2 million.

In practice, AUSTRAC is unlikely to seek maximum penalties against a small agency making genuine efforts to comply. Enforcement actions against small businesses have typically resulted in enforceable undertakings, directed improvements, and civil penalties well below the statutory maximum.

The point is that penalties are not capped at a single amount per business. They scale with the number and nature of the failures.

The enforcement timeline to understand

July 2026 FATF evaluation: Australia is scheduled for a FATF (Financial Action Task Force) mutual evaluation in July 2026. The FATF assesses whether Australia's AML/CTF regime is effective. AUSTRAC has explicitly stated this makes any softening of the 1 July 2026 deadline unlikely.

AUSTRAC is already active: In April 2026 — three months before Tranche 2 obligations commence — AUSTRAC directed a payment platform to appoint an external auditor due to inadequate monitoring controls. Enforcement is not waiting for July.

Post-deadline grace period: AUSTRAC has indicated a supportive posture toward businesses making genuine good-faith efforts. An agency that enrolled, built a program, and was doing CDD but had minor gaps is in a different position than one that did nothing. Document your compliance efforts.

Source: AUSTRAC media release on MHITS directed audit, April 2026

What "good-faith effort" looks like

AUSTRAC's stated approach favours businesses that can demonstrate genuine effort. In practice, that means:

You enrolled with AUSTRAC by the deadline (or as soon as practically possible)
You have a documented AML/CTF program — even if imperfect
You were conducting CDD from 1 July 2026 — even if your procedures needed refinement
You kept records of your compliance activities
When you identified gaps, you documented them and took steps to fix them

The highest-risk position is one where you can show no evidence of effort at all — no enrolment, no program, no CDD records, and no training.

The realistic risk for a typical agency

For a typical suburban agency that was simply unaware of the requirements and made no preparation:

The most likely enforcement scenario is not a $33 million penalty. AUSTRAC's stated posture is to work with entities making good-faith efforts. The most likely outcome for an agency that is behind but actively working to comply is an enforceable undertaking — a binding commitment to get compliant within a set timeframe.

That is still a serious regulatory intervention. It requires legal assistance, ongoing reporting to AUSTRAC, and operational disruption.

The cost of getting compliant before the deadline — around $79 per month with AML Simple — is materially lower than the cost of managing an enforcement action afterwards.

For the full picture of your Tranche 2 obligations, read the complete AUSTRAC Tranche 2 guide for real estate agencies.

This content is general information only and does not constitute legal or AML/CTF advice. For tailored advice, consult a licensed AML/CTF advisor. AML Simple is a compliance tool, not a law firm.

Want a personalised Tranche 2 readiness score for your agency? Take the free 5-minute Readiness Check → amlsimple.com/check