What happens if I miss the 1 July 2026 AUSTRAC deadline?

The obligations apply from 1 July 2026. An agency that has not complied by that date is exposed to civil penalties from the moment the first designated service is provided without a compliant programme. There is no soft-landing period, though AUSTRAC's stated enforcement stance for Tranche 2 emphasises education over immediate prosecution for newly regulated entities making genuine efforts to comply.

The penalty structure. Penalties are assessed per contravention — each breach of each obligation counted separately. For bodies corporate: up to $33 million per contravention. For individuals: up to $6.6 million per contravention. These are statutory maximums; courts have discretion to impose lower amounts, and AUSTRAC's major enforcement actions have involved negotiated outcomes. But the per-contravention structure is what makes the numbers grow to the sizes seen in the bank cases.

How contraventions accumulate. CBA's $700 million penalty arose from more than 53,000 individual contraventions of a single provision. Westpac's $1.3 billion penalty arose from over 23 million contraventions. For a real estate agency — each sale completed without a CDD process is a contravention, each failure to screen a party against the sanctions list is a contravention, each failure to file a suspicious matter report within the required time is a contravention. An agency completing 50 transactions between July and December 2026 without a CDD process has accumulated at least 50 individual exposures.

Criminal sanctions. The AML/CTF Act 2006 (Cth) also contains criminal offences for the most serious breaches — tipping off (disclosing that an SMR has been filed, maximum 2 years imprisonment), deliberate structuring to avoid reporting thresholds (maximum 5 years imprisonment), and knowing non-compliance in the most egregious cases. Criminal sanctions are reserved for deliberate conduct. An agency that fails to comply through inattention faces civil proceedings, not criminal charges.

What AUSTRAC is likely to do in practice. AUSTRAC has published a regulatory approach statement indicating it will prioritise education and compliance uplift for Tranche 2 entities in the early period. An agency that has enrolled, has a programme in place, has a Compliance Officer, and is conducting CDD — even imperfectly — is in a fundamentally different position to one that has done nothing. AUSTRAC's history shows it pursues entities that resist or obstruct, not those that engage.

Personal exposure. Directors and officers of corporate reporting entities can be held personally liable where they were knowingly involved in the entity's breach. The Compliance Officer appointment carries personal accountability, and AUSTRAC will engage with that individual directly during any inspection.

What to do next: If your agency is not yet enrolled and does not have a programme in place, start today — the gap between where you are and where the law requires you to be grows with every transaction you close.