From 1 July 2026, small business owners will face another layer of compliance and red tape.
New Anti-Money Laundering (AML) and Counter-Terrorism Financing (CTF) obligations, regulated by AUSTRAC, now require accounting firms to take a more formal approach to verifying the identity and business details of their clients when providing certain professional services.
These measures are intended to reduce the risk of Australia’s financial system being misused. For small business owners, this may mean answering more questions, completing additional identity checks, providing extra documentation and, in some cases, paying additional compliance-related fees when becoming a client or updating existing information.
While the changes are designed to strengthen the financial system, they also create additional administration, time and cost for both accountants and small businesses. In this article, we explain why the new requirements have been introduced, what they may mean for you and how Extrado will help you manage the additional compliance in a clear, practical and transparent way.
What this means for small business owners
Costs and Fees: What to Expect
We want to be upfront about the cost of meeting these new obligations. AML/CTF compliance introduces additional software, verification and regulatory costs for accounting firms, as well as the time required to complete checks, maintain records and manage ongoing monitoring.
These costs generally fall into two categories:
- Direct costs, including identity and entity verification fees; and
- Compliance time, including the time required to complete checks, review results, maintain records and meet our ongoing obligations.
1. Initial Verification
As part of Extrado’s AML/CTF compliance procedures, we will verify the identity of our clients and relevant individuals and entities.
For new clients, these checks will generally be completed as part of the onboarding process. Existing clients will be required to complete verification as their annual company statement is processed, or if a change is made to the structure, whichever comes first.
The following one-off verification fees will apply:
- Individuals: $10 + GST per person
- Companies: $150 + GST per company
- Trusts/SMSFs: $150 + GST per trust
Where a trust or SMSF has a corporate trustee, the trust/SMSF and the trustee company must be checked separately, and a verification fee will apply to each entity.
Additional fees may apply where an ownership structure is complex, information is incomplete or further verification is required.
2. Ongoing Monitoring
The initial verification process is generally completed once. However, our AML/CTF obligations do not end after the identity check.
Where the legislation applies, we must continue to monitor relevant client relationships, keep information current, maintain appropriate records and respond to changes in ownership, control, activities or risk.
We have invested in technology and automated processes to reduce the amount of manual work involved.
At this stage, we are not going to charge any additional ongoing annual AML/CTF compliance fees.
Frequently Asked Questions
Australia is updating its laws to align more closely with the international standards set by the Financial Action Task Force.
Accountants, lawyers, real estate professionals and dealers in precious metals and stones are being brought into the AML/CTF regime because the services provided by these professions can be misused by criminals to launder money, sometimes without the professional being aware of it.
The reforms were passed into law on 10 December 2024 and apply to newly regulated accounting services from 1 July 2026.
Yes, although for most clients the process should be relatively straightforward.
You may notice some changes in the way we work with you, particularly when you first become a client, when your details change or when we provide certain services.
This may include requests for identification documents, further questions about the purpose of a transaction or requests for supporting information before we can proceed.
These steps form part of our legal obligations rather than being additional requirements Extrado has chosen to introduce.
No.
Identity checks and other verification procedures are standard requirements under the AML/CTF framework. They are not necessarily prompted by concerns or suspicions about an individual client.
The process is similar to the identity checks already undertaken by banks and financial institutions. It is a legal requirement and not a personal judgement about you or your business.
No. The rules apply when an accounting practice provides certain activities known as designated services.
Whether the AML/CTF requirements apply depends on the type of work being undertaken, not simply on the fact that you use an accountant.
Preparing a standard tax return or providing general tax advice may not be a designated service on its own. However, business accounting engagements often involve additional services, entities and transactions that bring the client relationship within the AML/CTF framework.
Most business clients are likely to be affected in some way, particularly where their structure includes companies, trusts, partnerships or multiple individuals connected with those entities.
The main difference between clients will usually be the type and extent of the verification required.
Accounting practices that provide designated services must enrol with AUSTRAC as reporting entities.
Enrolment opened from 31 March 2026, with the new obligations applying from 1 July 2026.
This is a requirement placed on Extrado rather than on you as a client. However, it is the reason you will notice new verification and compliance processes when working with us.
The rules apply to certain professional services involving financial transactions, legal structures or the control of money and property.
Examples may include:
- assisting with the purchase, sale or transfer of real estate;
- assisting with the purchase, sale or transfer of a company or trust;
- holding, managing or controlling client money, accounts or property;
- assisting with equity or debt financing transactions;
- establishing or restructuring companies, trusts or other legal arrangements;
- acting as, or arranging for another person to act as, a director, secretary, trustee or partner; and
- providing a registered office or business address on behalf of a client.
Where Extrado assists with services of this nature, the AML/CTF requirements may apply.
It depends on the services we provide.
Preparing a straightforward individual tax return may not be a designated service on its own. However, the requirements may apply if we also assist with matters such as:
- establishing a company or trust;
- managing or restructuring an entity;
- assisting with a business sale;
- dealing with director loan arrangements;
- assisting with financing; or
- providing a registered office address.
Because Extrado works with a number of businesses, entities and family groups rather than only preparing standalone individual tax returns, we expect the requirements to apply to a significant portion of our client base.
There may be some additional time required at the beginning of an engagement, particularly while the initial identity and entity checks are completed.
Once the required verification has been finalised, the process for most ongoing services should be relatively seamless.
For many clients, the experience will be similar to completing an identification check with a bank or financial institution.
The legal responsibility rests with the accounting firm providing the designated service.
This means Extrado must complete the verification process, maintain the required records and document the checks in an appropriate way.
We will provide clear instructions about what information is required and guide you through the formal process.
The AML/CTF laws require us to verify the identity of clients and other relevant individuals before providing certain designated services.
This process is known as customer due diligence.
It is a legal obligation and may apply to both new and existing clients. Banks and financial institutions already complete similar verification procedures.
You will generally be asked to provide details such as your:
- full legal name;
- date of birth; and
- residential address.
We will usually verify this information using a government-issued photo identification document, such as a current driver licence or passport.
For companies, trusts and other entities, we may also require information about directors, trustees, shareholders, beneficial owners and other people who control the entity.
In many cases, we may already hold documents such as:
- trust deeds;
- company constitutions;
- ASIC extracts;
- financial records; and
- details of directors, trustees and shareholders.
Where possible, we will use the records already held by Extrado and only ask you for information that is missing, inconsistent or requires updating.
The main item many existing clients will need to provide is current photo identification.
We understand that this may feel unnecessary after a longstanding relationship.
However, the new requirements mean that we need to formally record and verify identification for clients and connected individuals where relevant services are provided.
For most clients, this will be a one-off process to bring the information held on file up to the required standard.
Not necessarily.
The level of checking required will depend on the nature of the client, the service being provided and the level of risk involved.
For most Australian residents with straightforward business structures, the process should be simple. Additional information may be required where there are:
- complex ownership arrangements;
- overseas individuals or entities;
- unusual transactions;
- higher-risk activities; or
- inconsistencies in the information available.
Being asked to complete additional checks does not necessarily mean that anything is wrong. It is part of the risk-based compliance process.
In some circumstances, particularly where a transaction involves large amounts, complex structures or international parties, we may need to ask about:
- the source of funds being used for a transaction; and
- how your overall wealth has been accumulated.
These are standard risk-assessment questions required under the AML/CTF framework and do not necessarily indicate that we have concerns about you.
A Politically Exposed Person, or PEP, is someone who holds or has previously held a prominent public position.
This may include a:
- government minister;
- senior public servant;
- judge;
- senior military officer; or
- person holding another significant public role.
The definition may also include close family members and associates of those individuals.
We are required to ask about PEP status as part of the due diligence process. It is a standard question and does not imply suspicion or wrongdoing.
We may be unable to provide you with certain services.
The law requires us to complete the relevant verification before providing a designated service. If we cannot verify your identity or obtain the required entity information, we may need to delay or limit the work we can undertake.
Providing the requested information promptly will help avoid unnecessary delays.
Yes, You may be asked to complete a short electronic form containing the personal or business information required for identity verification and risk assessment.
We are implementing software to make this process as straightforward as possible and will guide you through each step.
We are required to protect the information collected and only use or disclose it for permitted purposes.
AML/CTF records must generally be retained for at least seven years. We must also comply with our privacy and information-security obligations when storing and handling your information.
Your information will not be shared outside Extrado except where authorised or required by law, or where necessary to complete the verification process using our approved service providers.
We are required to conduct ongoing due diligence in relation to the services we provide.
This means we must keep client information current and may ask you to confirm or update your details from time to time.
Where something unusual comes to our attention during the course of providing services, we may be required to assess the circumstances.
Our ongoing monitoring processes may include:
- identifying suspicious transactions or behaviour that could require further investigation;
- screening clients and connected individuals against the DFAT Consolidated List;
- monitoring politically exposed person information;
- carrying out adverse media searches where appropriate;
- reviewing and reverifying information where its accuracy is uncertain or a client’s risk changes;
- monitoring significant changes in the nature or purpose of the business relationship;
- reviewing transaction information for physical cash transactions of $10,000 or more;
- lodging threshold transaction reports where required;
- lodging suspicious matter reports where the required level of suspicion exists;
- completing Extrado’s annual AUSTRAC compliance reporting; and
- arranging for Extrado’s AML/CTF program to be independently evaluated.
These processes form part of our legal obligations and do not mean that we have personal concerns about a particular client.
The initial identity verification will generally be completed as a one-off process.
However, our obligations are ongoing. We must keep relevant client and entity information current and may need to ask you to update or confirm details from time to time.
Additional checks may be required where your circumstances change significantly, such as when:
- you move overseas;
- your business restructures;
- ownership or control changes;
- a new entity is introduced; or
- the nature of the services we provide changes.
Yes. If we form a reasonable suspicion that a transaction or activity may relate to money laundering, terrorism financing or another serious offence, we may be legally required to lodge a suspicious matter report with AUSTRAC.
These reports assist authorities in detecting and disrupting serious and organised crime.
No. In some circumstances, we are legally prohibited from telling a person that a suspicious matter report has been made or may be required.
Disclosing this information may amount to an offence commonly referred to as tipping off.
If we are unable to fully explain why certain questions have been asked or why a particular action has been taken, this may be because we are subject to these legal restrictions.
In some circumstances, yes.
We may need to decline or stop providing a designated service if:
- we cannot satisfactorily complete the required verification;
- the necessary information has not been provided;
- our risk assessment identifies concerns that cannot be appropriately managed; or
- continuing the service would be inconsistent with our AML/CTF program.
This is expected to be uncommon, but it forms part of our compliance obligations.
Yes.
Providing a registered office or business address on behalf of a client is treated as a designated service under the AML/CTF rules.
This means we will need to complete the relevant identity and entity checks for companies using Extrado’s address as their registered office.
We may already hold much of the required company information, which should help make the process relatively straightforward.
For more information about what a registered office is, what the service involves and the implications of using your home address instead, read Your Company’s Registered Office: Why the Address Matters.
We need sufficient documentation to verify the existence, structure and relevant parties of a trust.
Where the trust deed cannot be located, we may be unable to provide a designated service to the trust until the position has been resolved.
Depending on the circumstances, this may require legal advice about options such as:
- applying to the relevant court to confirm the terms of the trust; or
- winding up the existing trust and establishing a new trust.
If you believe a trust deed is missing, please raise it with us as soon as possible, as resolving the issue may take time.
Each entity receiving a designated service will generally need to be separately verified.
However, an individual involved in several entities should not usually need to complete the same personal identity check multiple times.
For example, where a person is a director of two companies and also connected with a trust, we will coordinate the verification across the group to make the process as efficient as possible.
The process can generally be completed remotely.
Depending on the circumstances, we may use electronic identity verification or request appropriately certified identification documents.
We will explain the available options and help you complete the process without needing to attend our office in person.
The new obligations require Extrado to invest in:
- compliance software;
- identity and entity verification;
- ongoing screening and monitoring;
- staff training;
- record keeping;
- risk assessment; and
- independent review of our AML/CTF program.
These requirements create both direct out-of-pocket costs and additional time costs.
Whether these costs are included in your existing fees or charged separately will depend on the services and entities involved. Any applicable verification or ongoing compliance charges will be clearly disclosed to you.
For most clients, no immediate action is required.
However, you may be asked to provide identification or additional information before we can proceed with certain services.
Responding promptly will help us complete the required checks and minimise delays.
Where you have already received a request to complete an identification form or upload documents, this forms part of the new AML/CTF process.
The most helpful steps are to:
- make sure your photo identification is current;
- keep your residential and contact details up to date with Extrado;
- ensure important documents such as trust deeds are stored safely;
- advise us promptly of changes to directors, trustees, shareholders, ownership or control; and
- complete any verification requests as soon as possible.
We will let you know exactly what is required and guide you through the process.
AUSTRAC has published further information and guidance at austrac.gov.au. However, the simplest approach is to contact us directly. We can explain which of our services are affected, what information you will need to provide and how the process will work for your circumstances.
If you have any questions about how the new AML/CTF requirements may affect you, please get in touch. The Extrado team is here to guide you through the process and clarify anything not covered here.
