AML Compliance Guide
Log in Create Free Account

AML/CTF program for Lawyers — 2026 AUSTRAC Guide

If your law practice provides a designated service from 1 July 2026, you must have a written AML/CTF program. For lawyers, this obligation is aimed at work where the practice helps move, hold or structure money or assets in connection with transactions, not ordinary legal work across the board. If you do not finalise a compliant program by 31 December 2026, AUSTRAC can take enforcement action, civil penalties can reach $33.5 million per contravention, and intentional breaches can also attract criminal penalties.

Your AML/CTF obligations

  1. 1. AUSTRAC enrolment
  2. 2. Compliance officer
  3. 3. ML/TF risk assessment
  4. 4. AML/CTF program
  5. 5. Customer due diligence
  6. 6. Sanctions screening
  7. 7. Suspicious matter reporting
  8. 8. Record keeping (7 years)
  9. 9. Staff training

Your AML/CTF program is the written system your firm uses to identify and control money laundering, terrorism financing and proliferation financing risk. It has two parts. First, a written ML/TF risk assessment that rates the risks in your legal practice across your clients, services, delivery channels and geographic exposure. Second, the policies, procedures, systems and controls your practice will actually follow, including client verification, beneficial ownership checks, sanctions screening, suspicious matter escalation, record keeping, governance and staff training. Senior management must approve the program, and you must complete the risk assessment before you finalise the program.

Deadline and sequence

Lawyers captured by the tranche 2 reforms start being regulated on 1 July 2026. Enrolment with AUSTRAC is due by 29 July 2026 if you are already providing a designated service, and your AML/CTF program must be finalised by 31 December 2026. Do the work in this order: confirm whether your legal services are designated services, enrol, complete the risk assessment, then finalise and approve the program.

What a small law practice should do

  • Map which matters in your firm are designated services and which are not. A common dividing line is between pure legal advice, which is generally not designated, and legal work involving client money, companies, trusts, property transactions or other asset movement, which may be.
  • Write a risk assessment based on how your firm actually works: conveyancing, property development work, trust or company setup, managing client funds, remote onboarding, overseas clients, cash-intensive clients and politically exposed persons.
  • Set practical procedures for each high-risk point in the matter lifecycle: matter opening, source of funds questions, client and beneficial owner verification, sanctions screening, escalation to a principal, and deciding whether to stop acting.
  • Approve the program at principal or partner level, train staff who open files or deal with clients, and keep the program updated whenever your practice changes materially.

For lawyers, the program should fit the way legal matters are opened and supervised. If you run a conveyancing practice, the program should deal with purchase funds, third-party payments, overseas buyers, trusts and companies, and urgent settlement pressure. If you establish companies or trusts, it should cover beneficial ownership, control structures and clients using nominees or layered entities. If you receive money into trust or help direct funds as part of a transaction, your program should tell staff exactly when to pause a matter, ask further questions, escalate concerns or refuse instructions.

Common mistakes in legal practices

Do not assume every legal service is regulated. Pure legal advice is generally not a designated service. But do not make the opposite mistake and ignore AML/CTF because you are a law firm. If your practice handles money or assets in connection with transactions, the obligation can apply. Another common error is copying a generic template that does not match your matter types, trust account processes or client base. AUSTRAC will expect a program that reflects your actual legal work.

Keep the program usable. Build it into your costs agreement, new matter form, trust account checks and file opening checklist so fee earners are not trying to remember separate compliance steps. Nominate who signs off on high-risk matters, who reviews sanctions matches, and who decides whether an SMR is required. Keep records for 7 years after the client relationship ends, and retrain staff whenever you update the program. A short, specific program that your lawyers and support staff actually follow is far safer than a long document that sits unread.

A lightweight AML platform, built exclusively for Tranche 2

Get AUSTRAC's mandates done as fast and effortless as possible.

  • Built around AUSTRAC's actual requirements
  • Single maintained compliance file
  • No compliance expertise required
  • 25 minute initial compliance setup
  • Obligations calendar & reminders
  • Instant data export
Setup: ~25 minutes Ongoing: minutes per client Price: $8 per KYC
See the product →

Frequently asked questions

Does every legal matter in my firm need to be covered by the program?
No. The program is required if your firm provides a designated service, and it should be built around the designated services you actually provide. Pure legal advice is generally not a designated service for lawyers, but matters involving handling money or assets in connection with transactions may be. You need to identify where that line falls in your own practice areas.
I only do conveyancing a few times a year. Do I still need a full written program?
Yes, if those conveyancing matters involve a designated service, the obligation still applies even if the volume is low. The program can be proportionate to a small practice, but it still must be written, approved by senior management and finalised by 31 December 2026. A smaller firm can keep it concise, but it cannot skip the risk assessment or the required procedures.
Can I just use AUSTRAC's legal profession starter kit and leave it at that?
You can use AUSTRAC's starter kit as a base, and that is a sensible starting point for a small practice. But you still need to tailor it to your firm’s actual services, client types, trust account arrangements, staff roles and risk profile. A template on its own will not be enough if it does not reflect how your matters are opened and managed.
What will this usually cost a small law firm?
AUSTRAC enrolment is free. The real cost is staff time spent working out whether you provide designated services, preparing the risk assessment, tailoring the program, training staff and updating file-opening processes. Many small firms will be able to do much of this internally if their work is straightforward, but more complex firms may want external legal or compliance help.
What if my firm starts offering a new service after the program is finished?
You must update the ML/TF risk assessment whenever the business changes materially, and then update the program to match. For a law firm, that could include starting property development work, adding trust and company establishment services, expanding into overseas clients or changing how you receive client instructions. Do not wait for an annual review if the new service changes your risk profile.

Related guides