Under the AML/CTF Act, civil penalties for non-compliance can reach up to 20,000 penalty units for individuals and 100,000 penalty units for body corporates, applied per contravention. From 1 July 2026, with the Commonwealth penalty unit valued at $364, that equates to maximum penalties of up to $7.28 million for individuals and up to $36.4 million for corporations. These are maximum penalties available to a court, not fixed fines, but they show the seriousness of non-compliance under Australia’s AML/CTF regime.
\nIf your business now falls under Tranche 2 (real estate agents, lawyers, accountants, and other designated services), this is no longer a theoretical liability. It is written into the same Act that has already produced some of the largest corporate penalties in Australian history.
\nAUSTRAC has publicly signalled that its initial enforcement focus for newly regulated Tranche 2 entities will fall on businesses that wilfully ignore their obligations, not those making genuine, good-faith efforts to comply. A business that has appointed a compliance officer, built a risk-based AML/CTF program, and started customer due diligence is in a fundamentally different position than one that has done nothing at all.
\nThis distinction matters, but it is not a free pass. AUSTRAC will assess good-faith efforts based on evidence and records, not verbal assurances. If your business has no AML/CTF program, no appointed compliance officer, and no due diligence process in place by the time AUSTRAC comes asking, ‘we were planning to get to it’ will not stand up as a defence.
\nAUSTRAC has already secured two of the largest corporate penalties in Australian regulatory history. Commonwealth Bank paid an AUD 700 million penalty in 2018 for breaches related to reporting and monitoring failures. Westpac paid an AUD 1.3 billion penalty in 2020 for similar systemic non-compliance. Both cases involved large financial institutions with far bigger transaction volumes and different risk profiles than a newly regulated SME, but they establish something Tranche 2 businesses should not overlook: AUSTRAC pursues enforcement action through the courts and has a demonstrated willingness to seek, and win, penalties at scale.
\nA small real estate agency or accounting firm is not going to be treated the same way as a major bank on day one of Tranche 2. But the same Act, the same regulator, and the same civil penalty regime now apply. The question for a newly regulated business is which side of ‘good-faith effort’ versus ‘wilful disregard’ it wants to be on when scrutiny eventually arrives.
\n‘Reasonable steps to comply’ means demonstrating a genuine, documented compliance effort rather than claiming good intentions after the fact. In practice, for a Tranche 2 business, that means four concrete things:
\nEach of these needs to be demonstrable, not just described. AUSTRAC and the courts look at records: screening logs, due diligence files, dated compliance program versions, and report submission history. A business that can produce this evidence is in the ‘reasonable steps’ category. A business that cannot is exposed regardless of intent.
\nThis is precisely where a pay-as-you-go screening tool changes the calculus for a small or mid-sized Tranche 2 business. Running PEP checks, sanctions screening, and adverse media searches through NameScan’s API creates a timestamped, auditable record for every customer check – the kind of evidence AUSTRAC expects to see when assessing whether a business took reasonable steps, without the fixed overhead of an enterprise compliance platform built for banks.
\nWhat are the maximum penalties under the AML/CTF Act?
\nCivil penalties can reach up to 20,000 penalty units for individuals and 100,000 penalty units for corporations per contravention. That has been reported as up to $7.28 million for individuals and up to $36.4 million for a body corporate, per contravention.
\nWill AUSTRAC immediately target small businesses newly regulated under Tranche 2?
\nAUSTRAC has indicated its initial enforcement focus will be on entities that wilfully ignore their obligations, not those making good-faith efforts to comply. Businesses with a documented AML/CTF program, an appointed compliance officer, and active due diligence are in a materially different risk position than businesses that have done nothing.
\nHas AUSTRAC actually fined companies before, or is this just a theoretical risk?
\nAUSTRAC secured an AUD 700 million penalty from Commonwealth Bank in 2018 and an AUD 1.3 billion penalty from Westpac in 2020, both for AML/CTF compliance failures. These cases involved large banks under different circumstances than a newly regulated SME, but they confirm AUSTRAC pursues and wins large enforcement actions through the courts.
\nWhat counts as ‘reasonable steps to comply’ for a small business?
\nReasonable steps means having a risk-based AML/CTF program, an appointed compliance officer, documented customer due diligence (including PEP, sanctions, and adverse media screening), and on-time reporting to AUSTRAC. The key requirement is that each of these is demonstrable with records, not just claimed after the fact.
\n","protected":false},"excerpt":{"rendered":"What Are the Penalties for Not Complying With Tranche 2? Under the AML/CTF Act, civil penalties for non-compliance can reach up to 20,000 penalty units for individuals and 100,000 penalty units for body corporates, applied per contravention. From 1 July 2026, with the Commonwealth penalty unit valued at $364, that equates to maximum penalties of […]
\n","protected":false},"author":9,"featured_media":14130,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[85],"tags":[231,127,95,232,233,206],"class_list":["post-14116","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog-post","tag-aml-ctf-act","tag-austrac","tag-compliance","tag-enforcement","tag-penalties","tag-tranche-2"],"yoast_head":"\n