AUSTRAC supervises reporting entities under the AML/CTF Act and takes a graduated approach: guidance, education, remediation, and then formal action where conduct is serious or repeated. Formal tools include audits, enforceable undertakings, infringement-style measures where available, civil penalty proceedings and criminal prosecution for the most serious failures. With Tranche 2, professional practices now sit inside that framework. This guide explains what supervision looks like in practice and how a firm should respond, without treating enforcement history as a prediction of what any particular business will face.
How AUSTRAC supervises
AUSTRAC monitors compliance through lodgements, information requests, data analytics, and engagement with individual businesses and industry bodies. It publishes guidance and risk insights, and it can examine a business's records and systems under its statutory powers. A compliance review can cover the risk assessment, the AML/CTF program, CDD records, training, reporting and the governance arrangements behind them.
Supervision is not limited to suspicious matter reporting. AUSTRAC routinely asks reporting entities to show how a customer was identified, how a risk was rated and why an SMR was or was not lodged. The quality of the retained evidence, not the software brand, determines whether a file survives that scrutiny.
The enforcement toolkit
AUSTRAC publishes enforcement outcomes, including enforceable undertakings and penalty decisions, and explains the consequences of non-compliance on its website. The pattern across published matters is consistent: failures in program design, CDD, reporting and record-keeping attract the most scrutiny, especially where a business knew of problems and did not fix them.
- Audits and inspections of records, systems and controls
- Enforceable undertakings that require specific remediation
- Remedial directions and other formal directions where available
- Civil penalty proceedings under the AML/CTF Act
- Criminal prosecution for serious or reckless conduct
- Published enforcement outcomes, which carry reputational cost
The penalty framework
Civil penalties under the AML/CTF Act are calculated in penalty units. From 1 July 2026, the maximum for a body corporate is 100,000 penalty units and 20,000 for another person, which AUSTRAC's published guidance states as A$36.4 million and A$7.28 million respectively. Some provisions carry criminal offences with imprisonment. Penalties are maximums; courts and AUSTRAC consider seriousness, duration, cooperation and remediation.
Individual professionals can be personally exposed. Officers who knowingly or recklessly cause a body corporate to contravene the Act can face civil penalty proceedings, so 'the firm is the reporting entity' is not a complete answer to personal accountability.
Responding to an enquiry
A well-run practice can turn an AUSTRAC enquiry into evidence of its control environment. The response should show the risk assessment, the program, the CDD file, the reporting logic and the training records - the same evidence the program was always supposed to retain.
- Treat every AUSTRAC request seriously and respond within the stated timeframe
- Gather the exact records requested; do not produce a selective subset
- Involve the compliance officer and, where appropriate, external advisers
- Remediate promptly and document what was fixed, when and how
- Do not delete, alter or conceal records; that is a separate and serious problem
Official sources
Confirm the current rules against these primary sources.
Questions
What is the maximum civil penalty under the AML/CTF Act?
From 1 July 2026 the maximum is 100,000 penalty units for a body corporate and 20,000 for another person, stated by AUSTRAC as A$36.4 million and A$7.28 million. Courts determine penalties in individual cases.
Can an individual officer be penalised?
Yes. The Act includes accessorial and officer liability provisions, and civil penalties can apply to persons involved in a contravention. Officers should understand the controls rather than delegate blindly.
What is an enforceable undertaking?
A formal, published commitment by a business to take specified remediation steps. It is one of AUSTRAC's enforcement tools and can include independent reviews, program upgrades and reporting obligations.
How do we prepare for an AUSTRAC audit?
Keep the risk assessment, program, CDD evidence, training records and reporting decisions current and retrievable. When a request arrives, respond completely and on time, and fix anything the review reveals.
General information for Australian professionals, not legal advice. It does not replace the AML/CTF Act, the Rules or AUSTRAC guidance. See our editorial standards.
Keep reading
- Tranche 2 explained5 min
Australia's Tranche 2 AML/CTF reforms now cover tax agents, accountants, lawyers, conveyancers and real estate agents. What changed on 1 July 2026, who is captured, the six core obligations and what to do now.
- Your AML/CTF program3 min
What an AML/CTF program must contain for a small Australian practice: its ML/TF risk assessment, risk-based policies, governance, training, evaluation and evidence that the controls operate.
- SMRs & tipping off3 min
Suspicious matter reporting for newly regulated Australian practices: what forms a suspicion, SMR deadlines, what goes in the report, and the section 123 tipping-off offence every staff member must understand.