What Tranche 2 Requires and Where the Real Work Sits
Since 1 July 2026, Australian law firms that provide certain legal services have been reporting entities under the AML/CTF Act. As a result, firms must now verify a client’s identity, identify who ultimately owns or controls them, and understand where their money comes from. These checks apply before the firm acts and continue throughout the relationship.
The legal obligation is well documented. Applying it is often harder. Consider an Australian trustee company owned through a Hong Kong holding company by individuals in Singapore: identifying who actually controls it takes registry searches across three jurisdictions. For many firms, the challenge is less about understanding the rules and more about having the research capacity to apply them, particularly on complex or cross-border matters.
This guide explains what Tranche 2 requires, walks through a beneficial ownership trace step by step, and looks at the practical options for resourcing the research.
This article is general information only and is not legal advice. Firms should refer to AUSTRAC guidance and seek legal or compliance advice on their specific obligations.
Key Takeaways
- Law firms providing designated services, including property transactions, company and trust structuring, business sales, nominee roles and managing client money, must complete initial customer due diligence before providing the service.
- Enhanced due diligence is mandatory for high-risk clients, foreign politically exposed persons (PEPs) and certain high-risk jurisdictions, and usually means establishing source of wealth and source of funds.
- Beneficial ownership checks must look past the person signing the engagement letter to the individuals who ultimately own 25% or more of, or control, the client.
- Offshore ownership tracing, PEP and sanctions screening, and source of wealth verification are specialist research tasks, not checklist items.
- Firms can have a third party carry out parts of this research, but they remain responsible for their AML/CTF obligations.
What Is Customer Due Diligence Under AML/CTF Law?
Customer due diligence (CDD) is the process of identifying a client, verifying that identity against reliable and independent sources, understanding the nature and purpose of the relationship, and assessing the client’s money laundering and terrorism financing (ML/TF) risk.
The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) imposes these obligations on businesses that provide a “designated service”. The Tranche 2 reforms, passed in late 2024 through the AML/CTF Amendment Act 2024, added a set of professional services to that list. Lawyers, accountants, real estate professionals and trust and company service providers became reporting entities from 1 July 2026.
CDD is not a one-off onboarding form. It has two stages: initial CDD before the service is provided, and ongoing CDD for the life of the relationship. If a firm cannot complete an initial CDD, it generally must not provide the designated service.
Which Legal Services does Tranche 2 Capture?
A law firm becomes a reporting entity when it provides a designated service, regardless of its size or practice focus. For lawyers, designated services broadly include:
- Assisting with buying, selling or transferring real estate, including conveyancing
- Assisting with buying, selling or transferring a company, trust or other legal arrangement, including business acquisitions and sales
- Creating or restructuring companies, trusts and other legal arrangements
- Acting as, or arranging for someone to act as, a nominee director, company secretary, shareholder or trustee
- Providing a registered office or business address for a company or legal arrangement
- Receiving, holding or disbursing client money, accounts or assets in connection with these transactions
- Assisting with equity or debt financing for a company or legal arrangement
Each service has specific conditions and exemptions, so firms should map their matter types against the service descriptions in the Act rather than relying on a summary list. Reporting entities must also enrol with AUSTRAC, adopt an AML/CTF program based on an ML/TF risk assessment, and appoint an AML/CTF compliance officer.
Risk-Based CDD in Practice: Low, Medium and High-Risk Workflows
CDD is not a single fixed checklist. The depth of checking required scales with the client’s assessed risk.
| Risk Tier | Example Client | Core Checks Required |
| Low | Local couple buying a first home with an Australian bank loan | Verify ID against an independent source; record purpose and address; risk-rate as low |
| Medium | Business owner setting up a company to acquire an existing business, part-funded by an overseas relative | Verify director and company details; collect beneficial ownership information; apply ongoing monitoring for repeat transactions |
| High | Overseas client establishing a trust and holding company to acquire shares in an Australian start-up, funded from Singapore via Hong Kong | Trace beneficial ownership through each layer; apply enhanced due diligence; screen all parties against PEP and sanctions lists; escalate for senior approval |
The risk rating determines not just how much information a firm collects, but how far it must trace ownership and funding before it can safely act.
Enhanced Due Diligence Triggers and Requirements
Enhanced due diligence (EDD) is a stricter set of checks that applies when a client relationship carries elevated ML/TF risk. A firm must apply EDD when a client is rated high risk, is a foreign PEP, is linked to a high-risk jurisdiction, or is part of a transaction with no clear economic or lawful purpose.
Under EDD, a firm must establish two distinct things. Source of wealth (SoW) is how the client built their overall wealth. For example, through business ownership, investments, or inheritance. Source of funds (SoF) is where the money for this specific transaction came from. For example, a company distribution or the sale of an asset.
Both require documentary evidence, not a client’s verbal explanation. This is where CDD moves from a compliance checklist into a genuine research task.
Beneficial Ownership Verification: Why It’s the Hardest Part of CDD
Beneficial ownership verification means identifying the individuals who ultimately own or control a client entity, not just the person who signs the engagement letter. A director, trustee, or company representative is often not the true economic owner of the matter they are instructing on.
Firms must look past the first layer. If a trustee company is itself owned by an offshore holding company, the firm must trace ownership through to the individuals who ultimately control it and verify their identity to the same standard as any other client.
This tracing exercise is where most CDD delays occur, and it’s often where firms first bring in a research consultancy, an Australia-based specialist who can support offshore registry checks that go beyond what an in-house team can access efficiently.
The Research Burden Behind AML/CTF Compliance
Most guidance explains what a firm must verify, not who inside the firm is meant to do it. Tracing beneficial ownership through offshore structures, verifying the source of wealth, and screening parties against PEP and sanctions lists is specialist desk research. Not a task most fee-earners are resourced for.
This is a capacity problem as much as a compliance one. Few firms have foreign-registry tracing skills in-house, and paralegal time spent chasing offshore filings is time not spent on billable work.
Many firms address this issue by engaging legal research support services to conduct the desk research, beneficial ownership tracing, and screening, while the compliance decision stays with the firm. This approach is a form of knowledge process outsourcing, sitting alongside the business intelligence services & solutions and corporate research services firms already use for due diligence in M&A or litigation support.
Can law firms outsource AML/CTF due diligence research?
Yes, with one important limit. The AML/CTF framework allows a reporting entity to have a third party carry out parts of its CDD work. The firm remains responsible for meeting its obligations, even when someone else does the research.
That distinction shapes how outsourcing should work in practice:
| Stays with the firm | Can be carried out by a third party |
| Risk rating the client | Tracing ownership through Australian and offshore registries |
| Deciding whether EDD applies | PEP, sanctions and adverse media screening |
| Accepting or declining the matter | Gathering and summarising source of wealth and funds evidence |
| Senior manager approval | Flagging gaps, inconsistencies and red flags |
| Lodging SMRs with AUSTRAC | Preparing a documented research report for the file |
Options for resourcing CDD research
Firms generally take one of three approaches, or a mix of them:
- In-house: Compliance staff, paralegals or junior lawyers carry out the searches and screening. This keeps the work close to the matter but requires training, registry access and time away from other work.
- Technology tools: Electronic identity verification and screening platforms can automate identity checks and PEP and sanctions screening. They are less suited to tracing layered offshore ownership, which usually needs manual research.
- External research providers: Specialist research firms carry out registry searches, ownership tracing and source of wealth research, and report findings back to the firm for review.
The right mix depends on matter volume and risk profile. A firm handling mostly low-risk domestic conveyancing has different needs from one regularly acting on cross-border acquisitions. Whichever approach a firm uses, the work needs to meet the standard its AML/CTF program sets.
Consequences of Getting CDD Wrong
AUSTRAC’s enforcement tools range from formal warnings, infringement notices and enforceable undertakings to civil penalty proceedings. Maximum civil penalties are substantial, and serious breaches can lead to criminal charges.
AUSTRAC has shown it will pursue systemic CDD and monitoring failures. Its actions against Westpac, Commonwealth Bank and Crown Resorts ended in penalties of $1.3 billion, $700 million and $450 million respectively. Law firms are unlikely to face penalties on that scale, but the same failings, weak beneficial ownership checks and inadequate monitoring, featured in each case.
Beyond regulatory action, a firm connected to a money laundering matter may also face questions from its professional regulator and insurer.
Where Vista Information Fit with your AML/CTF Compliance Research
Tranche 2 has made CDD a live obligation for law firms providing designated services. The requirements are set out in the Act, the AML/CTF Rules and AUSTRAC guidance. Applying them well, especially on high-risk and cross-border matters, depends on thorough research into who owns and controls a client and where their money comes from.
Firms reviewing their approach may find it useful to:
- Map their matter types against the designated services list
- Review how their AML/CTF program sets out CDD and EDD procedures
- Consider how beneficial ownership and source of wealth research will be resourced on complex matters
- Check AUSTRAC’s guidance for legal professionals for updates
Vista Information is an Australian business research firm providing desk research, including corporate and ownership research. Contact Vista Information to discuss how our research consultancy services can support your firm’s AML/CTF customer due diligence obligations.