Tipping Off Offences: Section 123 Explained

Tipping off is a criminal offence under section 123 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). It applies when a reporting entity, or one of its officers, employees or agents, discloses that a suspicious matter report (SMR) has been given or is required, or discloses the report or its contents, and the disclosure would or could reasonably be expected to prejudice an investigation. The maximum penalty is imprisonment for 2 years or 120 penalty units, or both. Since Tranche 2 obligations commenced on 1 July 2026, real estate agencies, conveyancers, law firms, accountants and trust and company service providers are all within its reach.

The offence is not a blanket gag. It turns on prejudice to an investigation, and understanding that test is what lets your staff keep doing customer due diligence (CDD) without putting themselves or the business at risk.

TL;DR

• Section 123 prohibits disclosures about an SMR, or about a section 49 or 49B notice, that would or could reasonably be expected to prejudice an investigation. It does not matter whether an investigation has started.
• The maximum penalty is imprisonment for 2 years or 120 penalty units, or both. It can apply to individual staff, not only the business.
• Reasonable questions, enhanced CDD before an SMR obligation arises, and telling staff or advisers who need to know are generally not tipping off.
• Give customers genuine reasons for further checks, such as meeting AML/CTF obligations, and never hint at suspicion.
• Your AML/CTF program needs safeguards: restricted access, confidentiality undertakings, staff training and a record of who saw what.

Table of Contents

• What section 123 prohibits
• Who can commit the offence
• The penalty
• What is not tipping off
• Genuine reasons to give a customer
• Scenarios in a real estate agency
• The narrow exception for lawyers and accountants
• Safeguards your AML/CTF program needs
• Our perspective
• Putting the controls into practice
• FAQ
• Sources

What section 123 prohibits

AUSTRAC describes tipping off as the disclosure of certain information to another person where the disclosure would or could reasonably be expected to prejudice the investigation of a Commonwealth, State or Territory offence, or a proceeds-of-crime matter. It does not matter whether an investigation has started. A suspicion that has not yet reached investigators can still be damaged by a careless remark.

The prohibited information falls into four groups:

1. The existence of an SMR. Telling someone that an SMR has been given, or that you are required to give one.
2. The contents of an SMR. Reproducing information from the report, in whole or in part.
3. A section 49 or 49B notice. Revealing that AUSTRAC has issued a notice requiring information or documents, or revealing what you provided in response.
4. Anything that lets the listener infer these facts. You do not have to say the words “we reported you”. Communicating enough for a customer or an associate to work it out is covered where it could prejudice an investigation.

The fourth group is where most accidental breaches happen. A tone of voice, an abrupt cancellation of a transaction, or a comment such as “head office is looking at your file” can say more than a formal statement.

The prejudice test

Section 123 was reformed with effect from 31 March 2025, replacing a more prescriptive approach with a test centred on whether the disclosure could prejudice an investigation. AUSTRAC’s guidance says that whether a disclosure could do so will often depend on what is disclosed, to whom, how and when.

In practice the question to ask before any disclosure is a simple one: could this reach the customer or someone connected to them, and could it help them avoid detection? If the answer is yes or maybe, stop and escalate to your AML/CTF compliance officer.

Who can commit the offence

The offence is not limited to the business. According to AUSTRAC, it applies to reporting entities and former reporting entities, their officers, employees and agents, and to people required to respond to section 49 or 49B notices.

For a real estate agency, that means:

• the principal and licensee in charge;
• sales agents, property managers and auctioneers who deal with buyers and sellers;
• administration and trust accounting staff who see payment records;
• contractors or outsourced providers acting as agents;
• the compliance officer, who sees the most sensitive material.

An agent at a front desk who mentions an SMR to a seller over coffee is personally exposed. This is why training reaches beyond the compliance team, and why we cover AML training for real estate agencies as an obligation in its own right.

The penalty

The maximum penalty under section 123 is imprisonment for 2 years or 120 penalty units, or both. Penalty units are the Commonwealth’s indexed unit for expressing fines, so the dollar figure changes over time. Check the current value of a Commonwealth penalty unit on the Attorney-General’s Department site when you need the amount in dollars.

The penalty is only part of the exposure. A tipped-off customer may move funds, restructure a transaction or destroy records, and the agency may also face supervisory scrutiny of its program and training.

What is not tipping off

Because the offence depends on prejudice, many ordinary activities fall outside it. AUSTRAC’s guidance identifies examples where sharing may be lawful, because the disclosure would not or could not reasonably be expected to prejudice an investigation:

• Reasonable questions and enhanced CDD. Asking a customer for further information, or carrying out enhanced CDD, before an SMR obligation arises is generally not tipping off.
• Telling staff or advisers who need to know. Passing information to colleagues, or to professional advisers giving AML/CTF advice, so the business can manage its obligations.
• Internal or group risk management.
• Merger or acquisition due diligence.
• Fintel Alliance activities.
• Compliance with another law.
• Disclosures to Australian enforcement, intelligence or regulatory agencies.

AUSTRAC also reminds reporting entities that other laws, including privacy law, still apply. A disclosure that is not tipping off can still breach the Privacy Act 1988 (Cth) or a duty of confidence if it goes to people with no need to know.

The need-to-know principle

The safest working rule is to share SMR-related information only with people who need it to do their part of the compliance process. In a typical agency that is the principal, the compliance officer and, where relevant, the AML/CTF adviser. The salesperson running the campaign usually needs to know what to do next (for example, “hold the transaction and refer all questions to the compliance officer”), not why.

The information-sharing exception that is not yet in operation

Section 123(5) creates an exception for disclosure to another reporting entity to detect, deter or disrupt money laundering, terrorism financing, proliferation financing or other serious crimes, subject to conditions prescribed by regulations. AUSTRAC’s guidance states that this exception is not yet in operation. Until it is, do not rely on it to share SMR information with another agency, a bank or a law firm. Disclosures need to be justified under the prejudice test or another established exception.

Genuine reasons to give a customer

Staff often worry that any extra question will alert a customer. It will not, provided the explanation is genuine and does not point to suspicion. AUSTRAC’s guidance says staff can explain that further information is needed to meet AML/CTF obligations, that customer details need verifying, or that a standard process is being followed.

The operative word is genuine. Do not invent a false reason. Choose from reasons that are true for every customer:

• “We are required by law to verify the identity of everyone in a transaction.”
• “We need to confirm who ultimately owns and controls the company or trust that is buying.”
• “Our AML/CTF program requires us to understand the source of funds for this purchase.”

Compare these with phrases that risk crossing the line: “We’ve flagged your account”, “We can’t proceed until compliance clears this”, “We have to report anything unusual”. The second set implies suspicion and could allow the customer to infer that a report is under way.

Scenarios in a real estate agency

The table shows how the test applies to everyday situations. It is a guide to thinking, not legal advice. Take advice from your AML/CTF adviser or lawyer on a specific matter.

Where an SMR obligation has arisen, the suspicious matter reporting process for Tranche 2 firms sets out when you must report and what the report involves. The tipping off offence sits on top of that process: the more clearly the process is documented, the easier it is for staff to know what they may and may not say.

The narrow exception for lawyers and accountants

Section 123(4) creates a crime-prevention exception for a legal practitioner, a legal-services partnership or company, a qualified accountant, an accountancy partnership or company, or another person specified in the AML/CTF Rules. It applies where the information concerns a customer and the disclosure is made in good faith to dissuade the customer from conduct that constitutes, or could constitute, an offence.

Two features keep it narrow. First, it is limited to the listed professions. A real estate agent, buyers agent or developer cannot rely on it. Second, it requires good faith and a specific purpose: dissuading the customer. It is not a general licence to discuss an SMR with a client, and it should be used only after the firm has taken advice on exactly what may be said.

Safeguards your AML/CTF program needs

An AML/CTF policy that mentions tipping off in one sentence does not meet the standard. The policies must include safeguards, as the AML/CTF Rules 2025 (Rules 5-13) set out. AUSTRAC’s guidance lists the controls it expects agencies to consider:

1. Identify sensitive information and risky disclosure situations. Map where SMR-related information lives and when staff are most likely to be asked about it.
2. Restrict access. Limit SMR and notice material to named roles.
3. De-identify broader reporting. Management and board reports should not reveal customer details or SMR status to people who do not need them.
4. Review access audit trails. Check who has opened sensitive records.
5. Use confidentiality undertakings. Have those with access sign them.
6. Secure and password-protect records, and securely destroy paper copies.
7. Assess third-party controls. Outsourced providers and software vendors that handle your records must protect them too.
8. Conduct employee due diligence on those with access.
9. Train staff who access relevant information, including customer-facing staff.

A useful test for training: can a salesperson, without notes, say what they would tell a buyer who asks why a file is on hold? If not, practise scripts with the genuine reasons above until it is routine.

Our perspective

Tipping off is rarely a deliberate act. It happens when a busy team, a frustrated customer and an unclear process meet, and someone says one sentence too many. The safeguard is not more caution at the front desk; it is a process that tells people exactly what to say and who decides.

That is why we build AML Guard around one case record. Each identity check, screening result and officer decision sits in one place, rather than in emails and conversations that travel further than they should.

The platform automates the lookups and the record keeping, not the decisions. Its guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so the safeguards your policies set out start from the risks you assessed.

AML Guard

Putting the controls into practice

AML Guard keeps one case record holding each identity check, screening result and officer decision, which your compliance officer can review. AML Guard is not self-service; every firm starts with a demo. See the pricing page for the subscription and per-check fees.

Book a demo to see how the case record works on a file like yours.

FAQ

Can I ask a customer more questions after I have lodged an SMR?

Yes, but take care. Reasonable questions and enhanced CDD before an SMR obligation arises are generally not tipping off, and you can keep to your standard processes afterwards. Give only genuine reasons that do not indicate suspicion, and refer anything unusual to your compliance officer.

Is it tipping off to tell my colleagues about an SMR?

Not where the colleague needs to know in order to perform a compliance function, and the disclosure would not prejudice an investigation. Keep the circle small, record who has been told, and remember that privacy law still applies. Most staff need only an instruction on what to do, not the reason.

Does tipping off apply if no investigation has started?

Yes. The offence covers disclosures that would or could reasonably be expected to prejudice an investigation, and it does not matter whether one has begun. A disclosure can still be an offence if it could alert someone before investigators act.

What is the penalty for tipping off?

The maximum penalty is imprisonment for 2 years or 120 penalty units, or both. Individuals such as officers, employees and agents can be prosecuted, as well as the business itself.

Can a real estate agent rely on the good-faith exception in section 123(4)?

No. That exception is limited to legal practitioners, qualified accountants, their practices and others specified in the AML/CTF Rules. Agents should use the genuine-reasons approach and take advice before saying anything about a customer’s file.

Sources

• Tipping off | AUSTRAC
• Changes to tipping off offence in effect from today | AUSTRAC
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006, section 123 (Federal Register of Legislation)

Recommended

• AUSTRAC penalties 2026: how enforcement works
• Property Laundering Typologies in Australia
• AUSTRAC Section 167 Notice: What to Do
• TCSP AML in Australia: which services count