AUSTRAC imposes two separate obligations that apply to different businesses. Enrolment on the Reporting Entities Roll is required for every entity providing a designated service with a geographical link to Australia. Registration is an additional step for remittance service providers and virtual asset service providers (VASPs). The obligation depends on the service provided, rather than the business's industry label. On 1 July 2026, the Tranche 2 reforms brought about 80,000 businesses into the regime. Their enrolment deadline was 29 July 2026. Enrolment adds a business to the Roll; compliance also requires an AML/CTF program and ongoing controls. Equilex assists with AUSTRAC registration in Australia.
Enrolment or Registration: Two Different AUSTRAC Obligations
Enrolment places a business on AUSTRAC's Reporting Entities Roll. It is required of every entity that provides a designated service listed in section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act). Failure to enrol is a strict liability offence under section 51B of the Act, meaning AUSTRAC does not need to prove intent. Enrolment alone does not satisfy the entity's AML/CTF obligations. The entity must separately implement the controls that apply to its designated services.
Registration is a separate, additional step. It applies only to two categories: remittance service providers (independent remittance dealers, network providers and affiliates) and virtual asset service providers. Registration does not replace enrolment. A crypto exchange, for example, must do both: enrol on the Roll and apply for VASP registration. A law firm captured by Tranche 2 enrols only.
Who Must Enrol: Designated Services, Not Industry Labels
The trigger for AUSTRAC enrolment is not an industry classification. It is the provision of a designated service listed in the tables under section 6 of the AML/CTF Act. A business falls within scope if it provides one or more of those services and has a geographical link to Australia: either carrying on business in Australia or providing services directed at persons in Australia from abroad.
Once a business begins providing a designated service, it has 28 days to submit an enrolment application through AUSTRAC Online. This applies equally to a newly formed Australian company and to a foreign entity directing services into the Australian market. AUSTRAC publishes its own scope-check tool to help businesses determine whether their activities are captured. The scope check is a starting point; it does not substitute for a review of the designated services tables against the actual activities of the business.
Tranche 2: The Sectors That Joined on 1 July 2026
The AML/CTF Amendment Act 2024, passed by Parliament on 29 November 2024, extended AML/CTF obligations to services commonly provided by lawyers, conveyancers, accountants, real estate professionals and property developers, dealers in precious metals and stones, and trust and company service providers. These sectors are commonly described as designated non-financial businesses and professions (DNFBPs).
AUSTRAC opened Tranche 2 enrolment on 31 March 2026. Obligations commenced on 1 July 2026, and the deadline for submitting an enrolment application was 29 July 2026. AUSTRAC estimated that about 80,000 businesses would enter the regime.
Businesses that did not enrol by the deadline remain subject to the applicable obligations. AUSTRAC has stated that its early enforcement priorities include entities that willfully ignore the requirement to enrol or are suspected of complicity in money laundering. A late applicant should submit the enrolment form and address its AML/CTF program, compliance officer, staff training, customer due diligence, and reporting processes without further delay.
Who Must Also Register: Remittance and Virtual Asset Services
Two categories of reporting entity must complete registration on top of enrolment.
Remittance service providers include independent remittance dealers, remittance network providers, and affiliates. The registration requirement depends on whether the business provides a registrable remittance designated service. An incidental transfer made in connection with another professional service does not necessarily require registration and should be assessed against the statutory definitions.
The virtual asset service provider category replaced the former digital currency exchange (DCE) category on 31 March 2026. Its broader scope includes exchanges between virtual assets and fiat currency or other virtual assets, virtual asset transfers, and safekeeping or administration services. Existing DCE registrants did not need to submit a new enrolment and registration application, but AUSTRAC required them to complete the DCE-to-VASP transition and update their details by 29 July 2026. They must also comply with the obligations that apply to the services selected during that transition.
AUSTRAC does not charge a government fee for enrolment or registration. Assessment of a registration application can take up to 90 days, and the clock resets if AUSTRAC requests additional information. The AUSTRAC registration service page explains the process for virtual asset service providers.
What Changed for Existing Reporting Entities
From 31 March 2026, the reformed AML/CTF framework also changed the requirements for existing reporting entities, subject to applicable transitional rules. The former two-part AML/CTF program structure was replaced by a single program based on the entity's money laundering, terrorism financing, and proliferation financing risk assessment.
Section 26J of the Act requires the AML/CTF compliance officer to be an employee or person engaged by the reporting entity at management level. If designated services are provided at or through a permanent establishment in Australia, the officer must be an Australian resident. A foreign-owned business operating through an Australian permanent establishment therefore cannot rely solely on an overseas compliance officer for this role.
Core Obligations After Enrolment
Enrolment does not create the substantive compliance obligations. Those obligations apply when the entity provides designated services and include the following controls:
A written AML/CTF program must address the business's risk profile and receive governing body approval. Initial customer due diligence generally takes place before a designated service is provided, followed by ongoing due diligence throughout the customer relationship. Controls should cover identity and beneficial ownership verification, sanctions and politically exposed person screening, and enhanced measures where risk warrants them. Reporting obligations include suspicious matter reports, threshold transaction reports for qualifying cash transactions of A$10,000 or more, and reports on international value transfer services where required.
Relevant AML/CTF records must generally be retained for seven years. The starting point varies by record type. Transaction records are generally kept for seven years from completion of the transaction, while customer due diligence records are retained for at least seven years after the business relationship ends. The record-keeping policy should account for the specific rules that apply to each category.
Penalties and Late Enrolment
AUSTRAC can seek civil penalty orders, injunctions, infringement notices, enforceable undertakings, or remedial directions for breaches of the AML/CTF Act. Depending on the contravention, a Federal Court civil penalty can reach 100,000 penalty units for a body corporate and 20,000 penalty units for another person. The applicable outcome depends on the breached provision and the circumstances; the Act also contains separate offenses for specified conduct.
A business that missed the 29 July 2026 deadline should submit its enrolment application and address the remaining compliance work in parallel. Completing the form does not remedy gaps in the AML/CTF program, governance, due diligence, reporting, or record keeping.
If you are assessing whether AUSTRAC enrolment or registration applies to your business, schedule a call with the Equilex licensing team to map your designated services, compliance officer requirements and registration path.
Australia in Context
Crypto businesses considering Australia can review its requirements alongside the EU, the United States, and other jurisdictions in Best Countries to Get a Crypto License in 2026. A business dealing in financial products may also need an Australian Financial Services License (AFSL) from ASIC. AFSL authorization is separate from AUSTRAC enrolment and registration. For a crypto business, VASP registration with AUSTRAC is the Australian equivalent of the licences issued elsewhere, and it is obtained through the process described above rather than through a separate licensing regime. The crypto licensing hub provides an overview of other licensing jurisdictions.
FAQ
What is the difference between AUSTRAC enrolment and registration?
Enrolment places a business on AUSTRAC's Reporting Entities Roll and applies to everyone providing a designated service. Registration is an additional step required only for remittance service providers and virtual asset service providers. Businesses in those two categories must complete both; everyone else enrols only.
Who had to enrol with AUSTRAC by 29 July 2026?
Businesses captured by the Tranche 2 reforms: lawyers, conveyancers, accountants, real estate professionals, property developers, dealers in precious metals and stones, and trust and company service providers. Obligations commenced on 1 July 2026 and apply regardless of whether enrolment was completed on time.
Do I need to re-register if I already hold a DCE registration?
No. Existing digital currency exchange registrants did not need to submit a fresh enrolment and registration application. However, AUSTRAC required them to complete the DCE-to-VASP transition in AUSTRAC Online, update their details by 29 July 2026, and comply with the obligations that apply to their virtual asset services.
Does AUSTRAC charge a registration fee?
AUSTRAC does not charge a government application fee for enrolment or registration. Businesses still incur implementation and operating costs for the risk assessment, AML/CTF program, management-level compliance officer, customer due diligence systems, staff training, reporting processes, and independent evaluation.
Can a foreign company register with AUSTRAC?
Yes. The obligation attaches to providing a designated service with a link to Australia, including from offshore where services are directed at people in Australia. Where services are provided through a permanent establishment in Australia, the AML/CTF compliance officer must be a resident of Australia.
