Privacy requirements for tranche 2 AML/CTF reporting entities

On 1 July 2026, AML/CTF obligations will commence for entities previously not subject to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).

This change brings additional requirements for new reporting entities under privacy law.

New regulated entities

The Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) (AML/CTF Amendment Act) amends the AML/CTF Act to extend the application of the AML/CTF Act to services that are generally provided by the following businesses:

Real estate professionals
Conveyancers
Dealers in precious metals, stones and products
Lawyers
Accountants
Trust and company service providers.

These entities are known as "tranche 2 entities".

From 1 July 2026, AML/CTF obligations commence for tranche 2 entities.

Small businesses must comply with the Privacy Act

All AML/CTF reporting entities (including authorised agents of reporting entities) must comply with the Privacy Act 1988 (Cth) (Privacy Act) when collecting and handling personal information in the course of performing AML/CTF obligations (section 6E(1A) of the Privacy Act). This obligation extends to reporting entities that are small businesses and would otherwise be exempt from complying with the Privacy Act.

The Office of the Australian Information Commissioner has released privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act. This guidance provides useful information to help reporting entities understand their privacy obligations when collecting and handling personal information for AML/CTF purposes.

Key takeaways

Small businesses may be subject to the Privacy Act for the first time as a result of the expansion of AML/CTF obligations to tranche 2 entities.

Tranche 2 entities should now review their information collecting and handling practices for compliance with the Privacy Act and AML/CTF record retention obligations. Identified gaps should be addressed prior to 1 July 2026.

Get in touch

For more information about the AML/CTF reforms and how the reforms affect your organisation's privacy law obligations, please contact our team of experienced privacy and AML/CTF lawyers.

All information on this site is of a general nature only and is not intended to be relied upon as, nor to be a substitute for, specific legal professional advice. No responsibility for the loss occasioned to any person acting on or refraining from action as a result of any material published can be accepted.