Penalties — what's actually at stake

The AML/CTF regime is enforced through a tiered penalty structure under the AML/CTF Act 2006 (Cth). Most enforcement is civil rather than criminal, but the civil penalties are large enough to be existential for many agencies.

Civil penalties. Each contravention of a civil-penalty provision attracts a maximum of:

• Body corporate: AU$33 million per contravention (100,000 penalty units at the current rate of $330 per unit, effective 7 November 2024)
• Individual: AU$6.6 million per contravention (20,000 penalty units)

"Per contravention" matters. Failure to perform CDD on 100 customers can be 100 separate contraventions. AUSTRAC has historically pleaded systemic failures as separate contraventions for each affected customer or transaction — which is how the headline numbers in Tranche 1 enforcement got so large.

Criminal offences. Some provisions carry criminal liability, including tipping off, false or misleading information in reports, and providing designated services to a sanctioned person. These attract imprisonment (up to 10 years for tipping off in some circumstances) as well as fines.

Other consequences.

• Enforceable undertakings — binding commitments to remediate, often published on AUSTRAC's website (reputational consequence)
• Federal Court enforcement action — public proceedings, public judgments, public penalty orders
• Public statements — AUSTRAC routinely publicises significant enforcement outcomes
• Loss of licence — state real estate regulators take AML/CTF non-compliance into account in licensing decisions

Tranche 1 precedents.

• Commonwealth Bank (2018) — AU$700 million civil penalty for systemic failures including 53,506 late TTRs and inadequate transaction monitoring on its intelligent deposit machines.
• Westpac (2020) — AU$1.3 billion civil penalty for over 23 million late or missing reports and failures around child-exploitation-linked correspondent banking.
• Crown Resorts (2023) — AU$450 million civil penalty for systemic AML/CTF programme and CDD failures.

These precedents matter because they establish the enforcement methodology AUSTRAC will bring to Tranche 2: large numbers of individual contraventions aggregated into headline penalties, public proceedings, and enforceable undertakings with multi-year remediation obligations.

The realistic picture for real estate. AUSTRAC has signalled an education-first approach in the early years of Tranche 2, prioritising agencies that are visibly engaging with the obligations. Agencies that ignore the deadline, or treat the programme as a tick-box exercise, are the ones likely to feature in early enforcement.

A single missed CDD, repeated across hundreds of transactions over a seven-year retention window, produces a contravention count that compounds rather than caps.

What to do next: Brief your principal and board on the penalty structure so the resourcing decision for compliance is made with full visibility of the downside.