If your firm creates or restructures companies or trusts, sells shelf companies, acts or arranges for others to act as directors, trustees, partners or nominee shareholders, or provides a registered office address, those services have been regulated under the AML/CTF Act since 1 July 2026. You need an AML/CTF program (a business-wide ML/TF risk assessment and AML/CTF policies), customer due diligence that reaches the people who really own and control your customer, and records kept for usually 7 years.
TL;DR:
- The Act regulates specified services, not professional titles; accountants and lawyers are covered only when they provide them, and some activities are excluded, such as testamentary trusts and a power of attorney for an individual.
- The business-wide risk assessment must cover money laundering, terrorism financing, and proliferation financing; rate each service line and customer type separately.
- For trust CDD, usually obtain the deed and variations, verify each trustee, identify the beneficiaries (or each class of them) and the beneficial owners, including anyone who can appoint or remove trustees.
- Customer due diligence records are kept for 7 years after the business relationship ends or the occasional transaction is completed (section 111), and transaction records for 7 years after they are made (section 107); records should show your reasoning and let a transaction be reconstructed.
- A suspicious matter report is due within 3 business days of forming a suspicion on reasonable grounds (24 hours for terrorism financing), and a threshold transaction report within 10 business days of receiving or paying $10,000 or more in physical currency.
Table of Contents
- Which services make you a TCSP under the Act?
- How does AUSTRAC’s program-development guidance apply to your services?
- What must a section 26C risk assessment cover?
- What does initial customer due diligence for a trust involve?
- What records must you keep, and for how long?
- Which reports must you lodge?
- What program documents do you need to produce and approve?
- What should you do first, and in what order?
- How do you meet AUSTRAC’s expectations on independent evaluation and governance?
- When should you escalate?
- How does AML Guard support TCSPs under Tranche 2?
- FAQ
- Sources
Which services make you a TCSP under the Act?
“TCSP” is not the Act’s term. The AML/CTF Act regulates services, listed in table 6 of subsection 6(5B): selling or transferring a shelf company (item 5); assisting to plan or execute, or acting in, the creation or restructuring of a body corporate, such as a company, or a legal arrangement, such as a trust or partnership (item 6); acting as, or arranging for another person to act as, a director or secretary of a company, a power of attorney of a company or trust, a partner, a trustee of an express trust or an equivalent position (item 7); acting as, or arranging, a nominee shareholder (item 8); and providing a registered office or principal place of business address (item 9). A business that provides any of these in the course of carrying on a business is a reporting entity for that work.
That includes accountants and lawyers who offer these services alongside their core practice; they are regulated for that work, not for everything they do. AUSTRAC’s professional services guidance sets out what falls outside. Item 6 does not cover testamentary trusts, trusts not created intentionally or in writing, or corporations under the Corporations (Aboriginal and Torres Strait Islander) Act 2006. Item 7 does not cover a power of attorney for an individual, trustees or executors of testamentary trusts, trustees of trusts not created in writing, court-ordered fiduciary roles, or the trustee of a regulated debtor’s estate. General advice, or simply influencing how a client proceeds, is not enough: the service has to directly advance the outcome.
The item also decides who your customer is: the buyer or transferee of a shelf company (item 5), the person who instructs you on a creation or restructure (item 6), the nominator for director, trustee, nominee and similar roles (items 7 and 8), and the person you provide the address to (item 9). When you create a company, the proposed beneficial owners and directors are customers too; when you create an express trust, so are the proposed trustee, settlor and beneficiaries.
How does AUSTRAC’s program-development guidance apply to your services?
AUSTRAC’s program development guidance works through governance, risk assessment, policies and controls, then review and independent evaluation. For a TCSP, each step attaches to a specific service line:
- Governance and personnel: appoint an AML/CTF compliance officer and set out who approves what, particularly for director, trustee and nominee appointments.
- Risk assessment: rate company formation, shelf company sales, nominee shareholding and registered office provision separately, because their exposure differs.
- Customer due diligence and controls: apply trust and company CDD before you create, restructure or act for an entity.
- Document, approve and review: record the reasoning and approvals, then revisit them when your services or customers change.
The risk worth naming is concealment. Nominee arrangements and registered office services can hide who really controls an entity. That is why beneficial ownership, tested by both ownership and control, is the core of CDD in this sector. Ownership is a stake; control is influence, and a nominee can hold the first while someone else holds the second.
What must a section 26C risk assessment cover?
The business-wide ML/TF risk assessment is the foundation of your program. It must identify and assess the money laundering, terrorism financing and proliferation financing risks you may reasonably face, having regard to the kinds of services you provide, your kinds of customers, your delivery channels, the countries you deal with, and information from AUSTRAC (section 26C). Policies follow from it, not the other way round. For a TCSP, the risk factors that usually deserve their own rating include:
- Nominee director, shareholder and trustee services
- Corporate trustees acting for trusts with layered structures
- Non-resident beneficiaries and foreign-controlled entities
- Customers who are politically exposed persons
- Unclear source of funds or source of wealth
- Registered office arrangements used by customers you never meet
Record the rating you assign, the reasons for it, and the decision that flows from it. AUSTRAC’s record keeping guidance lists records of the steps taken to conduct, review and update the risk assessment, so keep why you rated a service medium or high, not only that you did. When a rating changes, the policy that depends on it changes too, and the record should show both moves together.
Pro Tip: Rate each service line and each customer type on its own row. A single firm-wide “medium” rating rarely survives a review of how you actually operate.
What does initial customer due diligence for a trust involve?
AUSTRAC’s initial CDD guidance for trusts says you must establish, on reasonable grounds:
- The identity of the trust itself.
- Anyone on whose behalf the trust receives the service, which includes all beneficiaries or, where they cannot be identified individually, each class of beneficiary.
- Anyone acting on behalf of the customer, including any trustee, and their authority to act.
- The beneficial owners.
- Whether any of those people is a politically exposed person or designated for targeted financial sanctions.
- The nature and purpose of the business relationship or occasional transaction.
You then collect KYC information appropriate to the ML/TF risk and verify it as required. Beneficial ownership here is wider than a shareholder test. AUSTRAC’s trust guidance lists the individual trustees, the beneficial owners of a corporate trustee, settlors, appointors, guardians, protectors and any other individual with control over the trust, including in some cases beneficiaries. Our explainer on beneficial ownership for trusts, SMSFs and companies goes deeper.
In practice, obtain the trust deed and any deeds of variation, verify each trustee, and where the trustee is a company, identify it from the ASIC register and work out its own beneficial owners, by ownership and by control. Record who decided and why, and apply enhanced CDD where the risk is high.
Pro Tip: Read the deed for who can appoint or remove the trustee. That power is often the real control, and it is rarely named in the ownership summary a customer gives you.
What records must you keep, and for how long?
AUSTRAC’s record keeping guidance says records are usually kept for 7 years, and must be enough to show you are meeting your obligations and to reconstruct individual transactions. The start of the 7 years depends on the record: transaction records run from when they are made (section 107), customer due diligence records from when the business relationship ends or the occasional transaction is completed (section 111), documents a customer gives you about a transaction from when they are given (section 108), and program records from when they stop being relevant to showing compliance (section 116). Keep:
- AML/CTF program documents and each approved version
- Initial, ongoing and enhanced CDD records
- Transaction records
- The rationale behind risk ratings and CDD decisions
- Suspicious matter report and threshold transaction report paperwork
- Evidence of approvals
Store them securely and in a way that shows who changed what and when. Reviewers look for reasoning, not only collected documents; our guide to AML record keeping in Australia makes the same point.
Which reports must you lodge?
A suspicious matter report (SMR) is due when you suspect, on reasonable grounds, that information about a customer or a service may be relevant to money laundering, terrorism financing or another offence: within 3 business days of forming the suspicion, or 24 hours if it relates to terrorism financing (section 41). Where some of the information may be subject to someone else’s legal professional privilege, and the suspicion does not relate to terrorism financing, the report is due within 5 business days. Typical TCSP triggers include identity documents that do not hold together, a nominee arrangement that appears to conceal the person in control, or unusual activity through a trust.
A threshold transaction report (TTR) is due within 10 business days when you receive or pay $10,000 or more in physical currency in providing a designated service (section 43). Every reporting entity also gives AUSTRAC an annual compliance report: the first covers 1 July 2026 to 30 June 2027 and is due by 30 September 2027. Our guide to AUSTRAC reporting covers all three.
- Record why you formed the suspicion, not just what you saw.
- Attach or reference the supporting documents.
- Keep the report and its working papers with the customer file.
What program documents do you need to produce and approve?
The reforms replaced a ‘check-box’ approach with a program focused on identifying, assessing and mitigating risk, as the Department of Home Affairs overview of the reforms puts it. The program itself is two documents, the business-wide ML/TF risk assessment and the AML/CTF policies; a compliance action plan and a staff training manual help you run it. Key documents:
- The business-wide ML/TF risk assessment
- The AML/CTF policies
- The compliance action plan
- The staff training manual
A senior manager approves the risk assessment and the AML/CTF policies (section 26P), the governing body must oversee the program (section 26H; for a sole trader, that is you), and the AML/CTF compliance officer runs it day to day. Use version control, and tie every policy change to a dated update of the risk assessment. Our guide to Tranche 2 program documents describes each artefact in more detail.
What should you do first, and in what order?
Work through these in sequence, and start the quick wins in parallel:
- Complete the business-wide risk assessment.
- Draft the AML/CTF policies and have a senior manager approve both documents, before you provide your first designated service.
- Designate an AML/CTF compliance officer within 28 days of starting (section 26K) and notify AUSTRAC within 14 days of designating them (section 26M).
- Enrol with AUSTRAC within 28 days of starting (section 51B). If you were already providing these services on 1 July 2026, both 28-day deadlines have passed: act now.
- Map your trust and company CDD workflow, so it runs before each service starts.
- Set up record-keeping and reporting processes.
- Plan the first independent evaluation.
Quick wins: document every officer approval from day one, begin staff training, and keep a compliance calendar. Longer tasks include automating beneficial ownership checks and ongoing monitoring, and surfacing compliance status in your CRM. Our checklist for real estate agents can be adapted for your intake.
Pro Tip: Run one real customer file through your draft workflow before you finalise the policies. Gaps show up in a single live example faster than in a review meeting.
How do you meet AUSTRAC’s expectations on independent evaluation and governance?
The Act builds governance into the program. The governing body must oversee it (section 26H) and, unless the business is an individual, your policies must keep the governing body informed of the risks (section 26F(4)(a)). A senior manager approves the risk assessment and policies, and an AML/CTF compliance officer is designated. Your policies must also set how often the program is independently evaluated, appropriate to your business and at least once every 3 years (section 26F(4)(f)). For a business newly regulated in 2026, the Transitional Rules 2026 require the first evaluation to be completed before 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030, depending on the last two digits of its AUSTRAC enrolment identifier. Feed each finding back into the policies and the risk assessment. Keep as evidence:
- Appointment letters for each governance role
- Meeting minutes showing oversight
- Independent review reports and your responses
- Staff training logs
When should you escalate?
When the customer is a company, identify it from the ASIC register and trace its beneficial owners by ownership and by control before CDD moves on, and record who decided and why. Apply enhanced CDD when the risk is high, including when control stays unclear after verification. If you suspect on reasonable grounds that the structure is being used for money laundering, tax evasion or another offence, or that someone is not who they claim to be, a suspicious matter report is due (section 41).
How does AML Guard support TCSPs under Tranche 2?
AML Guard is built for Australian reporting entities, trust and company service providers among them. Its guided wizards produce the risk assessment, AML/CTF policies, compliance action plan and training manual as one linked set. It also covers:
- Identity verification with biometric liveness, sanctions and PEP screening, and enhanced CDD
- ACN company determinations through ASIC registry data, with officer approval before CDD proceeds
- The officer’s decision and reasoning on a suspicious matter, recorded for the report you lodge
- An 8-year tamper-evident audit trail, above the Act’s seven-year minimum
Firms start with a demo: book a demo and see our pricing.
FAQ
Who counts as a TCSP under Australian AML/CTF law?
The Act regulates services, not job titles. Creating or restructuring companies and trusts, selling shelf companies, acting as or arranging a director, secretary, partner, trustee of an express trust, nominee shareholder or power of attorney of a company or trust, and providing a registered office address are the services in table 6. Accountants and lawyers offering them are covered for that work.
How long must a TCSP keep AML/CTF records?
Usually 7 years, but the start point depends on the record: customer due diligence records run from when the business relationship ends or the occasional transaction is completed (section 111), transaction records from when they are made (section 107), and program records from when they stop being relevant (section 116). Records must show your reasoning, not only the documents you collected.
What does an AML/CTF program consist of now?
It consists of a business-wide ML/TF risk assessment under section 26C and AML/CTF policies that follow from it. The assessment must cover proliferation financing as well as money laundering and terrorism financing. The earlier two-part program structure no longer applies.
Who is a beneficial owner of a trust?
It can include the individual trustees, the beneficial owners of a corporate trustee, settlors, appointors, guardians, protectors and, in some cases, beneficiaries. Test both ownership and control, because control often sits with whoever can appoint or remove the trustee.
Sources
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth)
- Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026
- Professional designated services | AUSTRAC
- Initial CDD for trust | AUSTRAC
- Record keeping overview | AUSTRAC
- Overview of the AML/CTF Amendment Act | Department of Home Affairs
Recommended
- AML/CTF Compliance Checklist for Real Estate Agents: What You Need Before 1 July 2026
- SMSF AML checks: the fund and its people
- Trust KYC in Australia: what the Rules require
See How AML Guard Works
Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.