Penalties — what's actually at stake

The AML/CTF regime runs on civil penalties, with criminal offences reserved for the most serious conduct. The civil maxima alone are large enough to be existential for many agencies.

Civil penalties. Each contravention of a civil-penalty provision attracts a maximum of:

• Body corporate: $33 million per contravention (100,000 penalty units at the current rate of $330 per unit, effective 7 November 2024).
• Individual: $6.6 million per contravention (20,000 penalty units).

"Per contravention" is the architecture that matters. Failure to perform CDD on 100 customers is 100 contraventions, not one. AUSTRAC has historically pleaded systemic failures as separate contraventions for each affected customer or transaction — which is how the headline numbers in Tranche 1 enforcement reached the billions.

Criminal offences. A small number of provisions carry criminal liability:

• Tipping off (s 123) — since 31 March 2025, an outcome-focused offence: it applies where disclosure would or could reasonably be expected to prejudice an investigation. Maximum penalty 2 years imprisonment, 120 penalty units, or both.
• False or misleading information in reports submitted to AUSTRAC.
• Providing a designated service to a sanctioned person in breach of Australian sanctions law.

Other consequences.

• Enforceable undertakings — binding remediation commitments, often published on AUSTRAC's website.
• Federal Court proceedings — public hearings, published judgments, public penalty orders.
• Public statements — AUSTRAC routinely publicises significant outcomes.
• State licensing flow-on — state real estate regulators take AML/CTF non-compliance into account in licensing decisions.

Tranche 1 precedents.

• Commonwealth Bank (2018) — $700 million civil penalty for systemic failures, including more than 53,000 late threshold transaction reports and inadequate monitoring of intelligent deposit machines.
• Westpac (2020) — $1.3 billion civil penalty for more than 23 million late or missing reports and failures around correspondent banking linked to child-exploitation payments.
• Crown Resorts (2023) — $450 million civil penalty ordered by the Federal Court on 11 July 2023, for programme, CDD, and governance failures across Crown Melbourne and Crown Perth.

These precedents matter because they show the enforcement methodology AUSTRAC will bring to Tranche 2: large numbers of individual contraventions aggregated into headline penalties, public proceedings, and multi-year remediation under enforceable undertakings.

The realistic picture for real estate. AUSTRAC has signalled an education-first stance in the early period of Tranche 2, prioritising agencies that are visibly engaging with their obligations. Agencies that ignore the deadline or treat the programme as a tick-box exercise are the ones likely to feature in early enforcement. A single missed CDD repeated across hundreds of transactions over a seven-year retention window produces a contravention count that compounds rather than caps.