AUSTRAC Tranche 2: what your firm needs to have in place

Whether a specific engagement counts as a designated service is a legal and regulatory determination for your firm to make, using AUSTRAC's own guidance. Vertical Flows does not make this determination for you.

• Read AUSTRAC's designated-service list for your sector
• Confirm with your professional body or legal adviser if a specific engagement is in scope
• Document the decision so it can be reviewed later

Done when: Your firm has a documented, reviewed position on whether it provides a designated service

If your firm was already providing a designated service when Tranche 2 commenced on 1 July 2026, you must apply to enrol with AUSTRAC by 29 July 2026. If your firm starts providing a designated service after that date, you generally have 28 days from when you start. Enrolment is a regulatory step your firm completes directly with AUSTRAC. Vertical Flows does not lodge enrolment on your behalf and does not decide whether your firm is a reporting entity.

• Apply to enrol with AUSTRAC by 29 July 2026 if you were already providing a designated service on 1 July 2026
• If you start providing a designated service later, enrol within 28 days of starting
• Enrol directly through AUSTRAC's systems
• Keep a record of your enrolment confirmation

Done when: Your firm has enrolled with AUSTRAC, or has documented why enrolment does not apply

An AML/CTF program sets out how your firm identifies and manages money-laundering and terrorism-financing risk. Vertical Flows supports the structured intake, evidence capture and review workflow a program relies on. It does not draft or certify the program itself.

• Assess your firm's money-laundering and terrorism-financing risk
• Document policies, procedures and controls
• Assign an AML/CTF compliance officer

Done when: A documented, approved AML/CTF program is in place

Customer due diligence means collecting, verifying and recording identity information for clients before providing a designated service, and periodically after that. Vertical Flows can structure the intake checklist, evidence upload and review trail. Your firm makes the final risk and compliance decision.

• Collect identity evidence for individuals, companies and trusts
• Verify documents against a reliable and independent source
• Record what was collected, when, and who reviewed it

Done when: Every in-scope client has a completed, reviewed customer due diligence record

For non-individual clients, AML/CTF obligations generally require identifying beneficial owners: the people who ultimately own, control or benefit from the entity. Exact thresholds are set out in AUSTRAC's rules. This is evidence to collect and keep, not a determination Vertical Flows makes for you.

• Identify individuals with a significant ownership or control interest
• Collect supporting evidence for each beneficial owner
• Refresh the record when ownership changes

Done when: Beneficial ownership evidence is on file for every in-scope entity client

Source-of-funds and source-of-wealth information helps your firm assess whether a transaction or client relationship is consistent with what you know about them. Vertical Flows can structure the request and evidence trail. Assessing risk stays with your firm.

• Ask for a plain-English explanation of the funds involved in the matter
• Collect supporting evidence where the risk assessment calls for it
• Escalate anything inconsistent or unclear to your compliance officer

Done when: Source-of-funds and source-of-wealth evidence is recorded for higher-risk matters

Ongoing customer due diligence means reviewing and refreshing client information as circumstances change, and monitoring for anything inconsistent with what you know about a client. This is a continuing obligation, not a one-off intake step.

• Set a review cadence for higher-risk clients
• Refresh identity and ownership evidence when it goes stale
• Record what changed and why at each review

Done when: A documented review cadence exists and is being followed

Your firm needs to retain customer due diligence records, transaction records and program documentation, with a clear trail of who reviewed what and when. Vertical Flows can generate an evidence package from a completed workflow. Retention policy and duration remain your firm's responsibility.

• Confirm your exact record-keeping duration with AUSTRAC's current guidance
• Keep evidence, decisions and reviewer identity together, not scattered across systems
• Make records retrievable for audit or regulator request

Done when: Records are retained in one reviewable place with a clear audit trail