AUSTRAC has finalised its transitional and amendment rules under the sweeping AML/CTF reform programme, setting out clear timeframes and requirements for both existing reporting entities and newly regulated businesses to update their systems and processes while continuing to manage ML/TF risks.
The AML/CTF Transitional Rules 2026 came into effect from 31 March 2026 and were made by the Minister for Home Affairs to support a smooth implementation of the reforms.
The rules have been developed in collaboration with the Australian Department of Home Affairs and are designed to give businesses practical time to adapt their compliance infrastructure without compromising ongoing risk management obligations.
One of the most significant changes introduced under the reforms relates to the travel rule, which imposes new obligations on businesses that transfer or receive money, virtual assets, or property on behalf of customers. The travel rule typically applies to financial institutions, remittance service providers, and virtual asset service providers (VASPs), requiring them to collect, verify, and share specific information with other businesses involved in a transfer.
Obligations for new virtual asset services — including travel rule requirements — have been deferred until 1 July 2026, in line with the tranche 2 reforms. Both existing and newly regulated VASPs must implement the travel rule for virtual asset transfers from that date, with no exemption applying.
On customer due diligence, existing reporting entities have been granted a three-year transition period running from 31 March 2026 to 30 March 2029 to move from the current applicable customer identification procedures (ACIP) to the new initial CDD framework. This transitional period does not apply to newly regulated tranche 2 businesses commencing enrolment from 31 March 2026.
Businesses must also pay close attention to compliance officer notification obligations. Existing reporting entities have until 30 May 2026 to notify AUSTRAC of their AML/CTF compliance officer, while newly regulated businesses and newly regulated VASPs have until 29 July 2026 to do so.
For entities that have recently undergone an independent review, the transitional rules offer some relief. Businesses that have completed an independent review shortly before the reforms took effect will be given an extended timeframe for their first post-reform evaluation, acknowledging the administrative burden of back-to-back assessments.
AUSTRAC has made clear that failure to manage ML/TF risks remains a serious regulatory concern, and businesses that are unable to meet their new or changed obligations on time are expected to have a documented implementation plan in place outlining how they will manage risks through the transition period.
Regulatory action, including civil penalty proceedings or the cancellation of registrations, remains a possibility for entities failing to meet their obligations.
From 1 July 2026, new services and entities — known as tranche 2 — will come under AUSTRAC’s regulation, covering sectors including legal, accounting, real estate, and jewellery industries.
Keep up with all the latest FinTech news here
Copyright © 2026 FinTech Global
