There is no single fixed AUSTRAC penalty. Infringement notices carry set amounts for specified alleged contraventions, while the Federal Court decides civil penalty orders within maximums the Act sets in penalty units. AUSTRAC’s tools run from remedial directions and enforceable undertakings to infringement notices and civil penalty proceedings. For firms regulated from 1 July 2026, one provision matters more than any figure: section 26G requires you to comply with your own AML/CTF policies, and it is a civil penalty provision.
TL;DR:
- Civil penalties are based on penalty units, with the dollar amount depending on the date of the contravention, not the court’s decision date.
- AUSTRAC can use remedial directions, enforceable undertakings, infringement notices or civil penalty proceedings, and the Act does not require it to use them in order.
- Since August 2026 AUSTRAC has issued section 167 notices to businesses that appear to provide designated services without having enrolled, followed by infringement notices to real estate, accounting and jewellery businesses it believes failed to enrol.
- Under section 26G, failing to follow your own AML/CTF policies is itself a civil penalty contravention, so what your staff actually do has to match your policies.
- An infringement notice states a set amount: for failing to enrol, $21,840 for a body corporate and $4,368 for an individual, at the $364 penalty unit. A civil penalty order is set by the Federal Court, within the statutory maximum.
- Effective preparation requires current, senior-manager-approved policies, documented staff training, and organised records that stand up to a review or an AUSTRAC examination.
Table of Contents
- AUSTRAC’s enforcement approach and escalation ladder
- How penalty amounts actually work under the AML/CTF Act
- Civil penalty provisions and the court’s role under Part 15
- What happens if you get an infringement notice or a direction?
- What AUSTRAC has done since 1 July 2026
- Which obligations create the most enforcement exposure?
- How to prepare for governance reviews and AUSTRAC examinations
- A practical example: keeping program documents consistent under one system
- Where compliance officers should focus first
- How AML Guard helps Tranche 2 entities meet these obligations
- Sources
- FAQ
AUSTRAC’s enforcement approach and escalation ladder
The Act gives AUSTRAC a graduated set of tools, from a written notice to fix a problem up to an application to the Federal Court for a civil penalty order. The ladder is a range, not a sequence: nothing in the Act requires AUSTRAC to use a lower tool before a higher one, and it can use more than one at once.
AUSTRAC publishes the enforcement actions it has taken. Each tool has its own basis in the Act:
- External audit notices (section 162): where AUSTRAC suspects non-compliance, a written notice requiring you to appoint an external auditor to review your compliance and give AUSTRAC the audit report.
- Remedial directions (section 191): where AUSTRAC is satisfied a civil penalty provision has been contravened, a written direction to take specified action so it does not happen again or, for certain missed reports, to lodge the report within a set period. Not complying with a direction is itself a civil penalty contravention.
- Enforceable undertakings (section 197): a written commitment you offer and the AUSTRAC CEO accepts, to take or refrain from specified action. AUSTRAC can publish it, and can apply to the Federal Court to enforce it if it is breached.
- Infringement notices (Part 15, Division 3): a written notice to pay a set penalty for certain listed contraventions, such as failing to enrol, lodge a required report or keep required records. Paying within 28 days discharges the liability for that contravention.
- Civil penalty proceedings (Part 15, Division 2): AUSTRAC applies to the Federal Court for a civil penalty order, and the court decides whether a contravention occurred and what penalty to impose.
- Injunctions (section 192): on AUSTRAC’s application, the Federal Court can restrain conduct that contravenes a civil penalty provision, or require a person to do something.
For businesses regulated from 1 July 2026, AUSTRAC’s May 2026 statement of expectations is specific. It expects you to be enrolled, to have an AML/CTF program and an AML/CTF compliance officer, to have trained your staff on the program, and to be ready to have a go at reporting when a suspicious matter arises. It expects “effort, not perfection” during 2026-27, and it says it will take early enforcement action against businesses that fail to enrol and those it suspects of complicity in money laundering.
How penalty amounts actually work under the AML/CTF Act
The Act does not put a dollar figure on a civil penalty. Section 175 sets the maximum in penalty units, with a higher maximum for a body corporate than for other persons. The dollar value of a unit is the one in force on the date the contravention occurred, not the date the case is decided.
That is why a fixed dollar fine quoted for 2026 goes out of date the moment the unit value next changes. AUSTRAC’s guidance on the consequences of not complying confirms that the unit value is set by the date of the contravention, and that it is the Federal Court, on AUSTRAC’s application, that orders a civil penalty.
Contraventions also multiply. Providing a designated service without an up-to-date risk assessment (section 26E), or without AML/CTF policies that meet the Act’s requirements (section 26F), is a separate contravention for each service provided, and each day an enrolment stays overdue is a separate contravention (section 51B). That is how exposure grows without any single figure changing.
Pro Tip: For a civil penalty, don’t rely on a dollar figure you’ve seen quoted. Check the penalty unit value current at the date of the alleged contravention, because that’s the value a court will apply. An infringement notice is different: it states the amount payable.
| What varies | Why it matters |
|---|---|
| Penalty unit value | Set by date of contravention, not date of judgment |
| Maximum penalty | Expressed in penalty units in section 175, with a higher maximum for a body corporate |
| Actual penalty imposed | Set by the Federal Court case by case, having regard to the nature and extent of the contravention, any loss or damage, the circumstances and any prior court finding of similar conduct |
Civil penalty provisions and the court’s role under Part 15
The statutory basis for all of this sits in Part 15 of the AML/CTF Act, which sets out the enforcement mechanisms: Division 2 (civil penalties), Division 3 (infringement notices), Division 5 (remedial directions), Division 6 (injunctions) and Division 7 (enforceable undertakings). AUSTRAC applies to the Federal Court; it does not impose civil penalties itself.
The court’s role has three parts. First, it decides whether the contravention occurred, applying the rules of evidence and procedure for civil matters (section 179). Second, if satisfied, it may order a pecuniary penalty within the statutory maximum, having regard to the nature and extent of the contravention, any loss or damage it caused, the circumstances in which it took place and whether the person has previously been found to have engaged in similar conduct (section 175). Third, on AUSTRAC’s application, it can grant an injunction restraining conduct or requiring a person to act (section 192).
For compliance officers, the practical takeaway is preparation. If a matter reaches this stage, you’ll need dated evidence of your risk assessment, your policies, senior manager approvals, and records showing what staff actually did in practice, not just what the policy said they should do. Under section 26G, a gap between the two can itself be the contravention.
What happens if you get an infringement notice or a direction?
Each tool comes with its own deadline or terms, and how you respond matters more than the first notice.
- Infringement notice issued. The notice sets out the alleged contravention and the penalty. Pay within 28 days, or any longer period AUSTRAC allows, and the liability is discharged: no criminal or civil penalty proceedings can be brought for that contravention.
- Remedial direction issued. The direction specifies the action you must take and, for certain missed reports, the period for lodging it. Keep evidence of each step, because not complying with a direction is a separate civil penalty contravention.
- Enforceable undertaking accepted. You commit in writing to specific actions, and AUSTRAC may publish the undertaking. You can vary or withdraw it only with AUSTRAC’s consent, and a breach can be enforced in the Federal Court.
- Non-payment or non-compliance. If an infringement notice is not paid, AUSTRAC can seek a civil penalty order instead, and the court is not limited to the amount in the notice.
Don’t ignore a notice or a direction. Check the allegation, the deadline and your options promptly, and get legal advice before deciding whether to pay an infringement notice. Paying it discharges liability for that alleged contravention (section 188); if it is not paid, AUSTRAC can still bring civil penalty proceedings (section 189). A breached direction is a contravention in its own right.
What AUSTRAC has done since 1 July 2026
AUSTRAC’s first actions on newly regulated businesses have been about enrolment, which its May 2026 statement named for early enforcement action alongside suspected complicity in money laundering.
| Date | What AUSTRAC did |
|---|---|
| 28 August 2026 | Began issuing section 167 notices to businesses that appear to be providing designated services but have not enrolled, including real estate agents, accountants, lawyers and jewellers. The notices require information to help AUSTRAC determine whether a business is providing regulated services and meeting its obligations (AUSTRAC article). |
| 30 September 2026 | Announced that it had begun issuing infringement notices to businesses in the real estate, accounting and jewellery sectors that it believes failed to enrol within 28 days of providing a designated service. It said the notices were issued at $21,840 for corporate entities and $4,368 for individuals but can accrue on a daily basis, and that around 90 per cent of a group it initially had concerns about had since enrolled or attempted to enrol (AUSTRAC media release). |
A section 167 notice is an information-gathering power in Part 14 of the Act, not a finding that you have breached the Act. Not complying with one is an offence and a civil penalty contravention (section 167(3) and (3A)), and knowingly giving false or misleading information or documents is a separate offence (sections 136 and 137). Our guide to what to do with an AUSTRAC section 167 notice covers the response.
The infringement amounts match the Act’s default for failing to enrol: 60 penalty units per alleged contravention for a body corporate and 12 for any other person, unless the AML/CTF Rules specify a different number (section 186A), at the $364 penalty unit value AUSTRAC gives for contraventions on and from 1 July 2026. The obligation to enrol continues until you apply, each day from the deadline is a separate contravention (section 51B), and one notice can cover more than one alleged contravention (section 185(2)), which is how a total can grow.
If you have not enrolled, our guide to missing the AUSTRAC enrolment deadline explains how to apply late and how an infringement notice works. Check your compliance officer designation at the same time: the Act requires one within 28 days of starting to provide a designated service (section 26K).
Which obligations create the most enforcement exposure?
AUSTRAC has said where it will focus. Its regulatory priorities for 2026-27 expect newly regulated businesses to have enrolled, completed ML/TF risk assessments, appointed governance roles, and established AML/CTF policies embedded in daily operations. Three obligations deserve attention first for firms still building their programs.
- Annual compliance reports now run on a financial year reporting period, with a lodgement window from 1 July to 30 September. Missing or late submission of your annual compliance report can trigger enforcement action on its own, including a remedial direction or an infringement notice. The current reporting period runs from 1 July 2026 to 30 June 2027, so the report for it is due between 1 July and 30 September 2027.
- Enrolment and core reporting carry fixed statutory deadlines, summarised in AUSTRAC’s Tranche 2 obligations factsheet: enrol within 28 days of first providing a designated service, report a suspicious matter within 3 business days of forming the suspicion (24 hours for terrorism financing), and report a threshold transaction within 10 business days. Failing to enrol is the compliance gap AUSTRAC’s May 2026 statement singles out for early enforcement action.
- Internal policy non-compliance is the obligation that changes the calculus for every newly regulated firm. Section 26G requires you to comply with your own AML/CTF policies, and it is a civil penalty provision, so a policy sitting unused in a drawer is a liability in its own right, not just a paperwork gap.
If you’re still mapping which of these applies to your service, our Tranche 2 obligations explainer breaks down enrolment and reporting duties by sector.
How to prepare for governance reviews and AUSTRAC examinations
Reducing enforcement exposure comes down to three habits: current documents, defensible records, and knowing how to handle an examination if one arrives.
Keep your risk assessment and AML/CTF policies under active review, not filed away after initial approval. The Act requires both to suit the nature, size and complexity of your business. It requires the risk assessment to be reviewed when a significant change occurs (before the change, if it is within your control), when AUSTRAC gives you information about the risks of your services, in other circumstances the AML/CTF Rules specify, and in any event at least every three years (section 26D). It also requires a senior manager to approve each version (section 26P). Providing a designated service without an up-to-date risk assessment is itself a contravention, and because your policies must provide for their own review, a stale document usually breaches your own policies as well. Keep the approval trail alongside the document itself.
Pro Tip: If AUSTRAC issues a written notice under section 172A, you can be required to produce documents or to appear before an examiner and answer questions on oath, and failing to comply is an offence. Self-incrimination is not an excuse for refusing to answer (section 172K), but if an individual claims that protection before answering, and the answer might in fact incriminate them or expose them to a penalty, it is not admissible against them in later proceedings, other than proceedings about whether it was false. Your lawyer may attend the examination (section 172F), so get advice as soon as a notice arrives, not during the examination.
Our program documents guide covers how to keep your risk assessment, policies, and training records aligned as one evidentiary set.
A practical example: keeping program documents consistent under one system
Section 26G raises the stakes on something firms often treat as paperwork: whether your risk assessment, your policies and your training actually agree with each other, and with what your staff do.
A system that can pre-fill later documents from the risk assessment, and records each check against the case, can help reduce that mismatch risk:
- Identity checks, screening results and officer decisions are recorded against the case, so the file shows checks performed, not just checks intended.
- Officer review sits in the same case record, so the judgement on each file stays with your team.
- Program documents can be pre-filled from the risk assessment, so later documents start from the risks it identified.
Software supports the evidence trail. It doesn’t replace governance, senior manager approval, or the officer’s own judgement on each file.
Where compliance officers should focus first
Documented, senior-approved policies that are visibly followed count for more than policies that merely exist. For newly regulated businesses, AUSTRAC has set a clear floor for 2026-27: be enrolled, have an AML/CTF program and compliance officer, train your staff on the program, and be ready to have a go at reporting.
Review your enrolment, your policy approvals, your evidence of staff training, and your annual compliance reporting schedule this week, not next quarter.
How AML Guard helps Tranche 2 entities meet these obligations
Real estate agencies, law firms, accounting practices, and trust and company service providers now carry the same civil penalty exposure as longer-regulated sectors, with less time to build mature systems. AML Guard is built specifically for Australian Tranche 2 reporting entities, not adapted from banking software, so the workflows match obligations you actually have to meet.
Guided wizards produce your ML/TF risk assessment, AML/CTF program, customer acceptance policy and training manual, and can pre-fill later documents from your risk assessment. Identity checks, screening and officer review sit in one case record, which records each identity check, screening result and officer decision against the case. For a company, the beneficial ownership determination starts from its ACN, and an officer approves each determination.
AML Guard isn’t self-service. You start by booking a demo. See the full feature set on the features page or check current plans and pricing before your call.
Sources
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) | Federal Register of Legislation
- Enforcement actions taken | AUSTRAC
- Update to regulator statement of expectations, May 2026 | AUSTRAC
- Consequences of not complying | AUSTRAC
- Our regulatory priorities for 2026-27 | AUSTRAC
- AML/CTF obligations factsheet for tranche 2 reporting entities | AUSTRAC
- Annual compliance reports | AUSTRAC
- AUSTRAC issues notices to non-enrolled businesses (28 August 2026) | AUSTRAC
- AUSTRAC begins issuing infringement notices to non-enrolled businesses (30 September 2026) | AUSTRAC
FAQ
What are the new AML regulations in 2026?
The reforms took effect in two stages. Reformed obligations began on 31 March 2026 for businesses already regulated, and from 1 July 2026 extended to designated services typically provided by real estate agents, lawyers, conveyancers, accountants, trust and company service providers, and precious metal and stone dealers. Not following your own AML/CTF policies is a civil penalty contravention (section 26G).
What is the current threshold for reporting a transaction to AUSTRAC?
A threshold transaction is a transfer of physical currency (cash) of $10,000 or more, or the foreign currency equivalent, as part of a designated service. It must be reported to AUSTRAC within 10 business days (section 43). Suspicious matter reporting is a separate duty with no dollar threshold.
What are the fines for AML breaches in Australia?
There is no single fine. The Federal Court sets a civil penalty within the maximum in section 175. An infringement notice states a set amount: for failing to enrol, 60 penalty units for a body corporate and 12 for anyone else, which is $21,840 and $4,368 at $364 a unit (contraventions from 1 July 2026).
What transactions are reported to AUSTRAC?
Reporting entities must report suspicious matters within 3 business days of forming the suspicion (24 hours for terrorism financing, and 5 business days in some legal professional privilege cases), and threshold transactions involving $10,000 or more in physical currency within 10 business days. Businesses that provide international value transfer services also report those transfers. Annual compliance reports are lodged between 1 July and 30 September each year.
Has AUSTRAC fined businesses for not enrolling?
It has issued infringement notices, which are not court-ordered fines: paying one within 28 days ends liability for that contravention. From 30 September 2026 AUSTRAC issued them to real estate, accounting and jewellery businesses it believes failed to enrol, at $21,840 for corporate entities and $4,368 for individuals, after its August information requests.
Will insurance cover an AUSTRAC penalty?
Don’t assume it will. Ask your broker and a lawyer to check, separately, whether your policy covers investigation and defence costs, and whether any penalty itself is legally insurable and covered under your policy.
Does AML Guard have publicly listed pricing?
Yes. Current subscription and per-check prices are published on the pricing page. AML Guard isn’t self-service: firms start with a demo.
Recommended
- AUSTRAC Section 167 Notice: What to Do If You Receive One
- Missed the AUSTRAC Enrolment Deadline? What Happens Next
- Tranche 2 AML Australia: your compliance obligations explained
- Tranche 2 customer due diligence in Australia
- AML/CTF Program Documents for Tranche 2
- AML/CTF policy template for Tranche 2 firms
See How AML Guard Works
Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.