What happens if I miss the 1 July 2026 AUSTRAC deadline?
The civil and criminal exposure for non-compliance with AUSTRAC Tranche 2, how contraventions accumulate, and what enforcement is likely to look like in the early period.
In short
From 1 July 2026, every designated service provided without a compliant programme is a civil-penalty exposure. Maximum is $33M per contravention (body corporate). Enrolment is due by 29 July 2026. AUSTRAC has signalled education over prosecution for genuine early-stage efforts, but doing nothing is what attracts enforcement.
The obligations apply from 1 July 2026. An agency that has not complied by that date is exposed to civil penalties from the moment the first designated service is provided without a compliant programme. There is no soft-landing period in the legislation, though AUSTRAC's stated enforcement stance for Tranche 2 emphasises education over immediate prosecution for newly regulated entities making genuine efforts.
The penalty structure. Penalties are assessed per contravention. For bodies corporate: up to $33 million per contravention (100,000 penalty units at $330 per unit). For individuals: up to $6.6 million per contravention (20,000 penalty units). These are statutory maxima; courts have discretion to impose lower amounts, and AUSTRAC's major actions have involved negotiated outcomes. The per-contravention structure is what produced the headline figures in the bank cases.
How contraventions accumulate. CBA's $700 million penalty arose from more than 53,000 individual contraventions of a single provision. Westpac's $1.3 billion penalty arose from more than 23 million contraventions. For a real estate agency, each sale completed without a CDD process is a contravention, each failure to screen against the DFAT consolidated list is a contravention, each failure to file an SMR within the required time is a contravention. An agency completing 50 transactions between July and December 2026 without a CDD process has accumulated at least 50 individual exposures, before any other obligations are counted.
Criminal sanctions. The Act contains criminal offences for the most serious breaches. Tipping off (s 123), since 31 March 2025, is outcome-focused — disclosing information that would or could reasonably be expected to prejudice an investigation — and carries up to 2 years imprisonment, 120 penalty units, or both. Other criminal offences cover false or misleading information in reports and providing designated services to sanctioned persons. Criminal sanctions are reserved for deliberate conduct; an agency that fails to comply through inattention faces civil proceedings, not criminal charges.
Enrolment is a separate obligation. Even before the programme question, every reporting entity must enrol on AUSTRAC's Reporting Entities Roll within 28 days of becoming a reporting entity — by 29 July 2026 for agencies that start providing designated services on 1 July. Failure to enrol is itself a civil-penalty provision.
What AUSTRAC is likely to do in practice. AUSTRAC has published a regulatory approach statement indicating it will prioritise education and compliance uplift for Tranche 2 entities in the early period. An agency that has enrolled, has a programme, has a Compliance Officer, and is conducting CDD — even imperfectly — sits in a fundamentally different position to one that has done nothing. AUSTRAC's enforcement history shows it pursues entities that resist or obstruct, not those that engage.
Personal exposure. Directors and officers of corporate reporting entities can be held personally liable where they were knowingly involved in the entity's breach. The Compliance Officer appointment carries personal accountability and AUSTRAC will engage with that individual directly during any inspection.
If your agency is not yet enrolled and does not have a programme in place, the gap between where you are and where the law requires you to be grows with every transaction you close.
Frequently asked questions
- Is 1 July 2026 a hard deadline or a transition date?
- Hard. Obligations apply from 1 July 2026 onwards. Enrolment on the Reporting Entities Roll must be lodged by 29 July 2026. There is no statutory grace period.
- How can contravention counts grow so large?
- Penalties are per contravention. Each transaction without CDD, each unfiled SMR, each missed sanctions screen, can be a separate contravention. The bank cases reached the billions because the same failure repeated across millions of customers and transactions.
- Will AUSTRAC come after small agencies first?
- AUSTRAC's regulatory approach statement indicates education first for newly regulated sectors. Early enforcement is more likely against entities that have done nothing, obstructed inspection, or shown bad faith — not against agencies making genuine but imperfect attempts to comply.