If you form a suspicion about a client while providing a designated service, the law gives you one clean answer and two hard rules. You must report the suspicion to AUSTRAC, within 24 hours for terrorism financing and 3 business days for anything else. You will not breach your confidentiality duty under the tax agent Code of Professional Conduct by doing so, because reporting is a legal duty and Code item 6 carves out legal duties. And you must never tell the client, or anyone connected to them, that you did it. That last part is a criminal offence called tipping off, and it carries up to 2 years in prison.
Since 1 July 2026, this is not a lawyers’ problem. It is yours.
The collision accountants worry about
I have heard the same question from practitioners all year: if I report a client to AUSTRAC, am I not breaching their confidentiality? It feels like a trap. TASA section 30-10(6), Code item 6, says you must not disclose any information relating to a client’s affairs to a third party without permission. A suspicious matter report is exactly that: information about a client’s affairs, handed to a government agency, without asking them first.
The trap is imaginary. Code item 6 has always contained its own exit: the duty of confidence yields where you have a legal duty to disclose. The Tax Practitioners Board lists reporting to AUSTRAC under the AML/CTF Act as a textbook example of that legal duty, alongside TPB notices and court orders. The TPB has also confirmed the same logic applies to the confidentiality obligation in section 25 of the Code Determination 2024. Report because the law requires it, and Code item 6 is satisfied, not breached.
One more thing worth killing early: accountants sometimes reach for legal professional privilege as a shield. It is not yours to hold. LPP protects lawyer and client communications. The ATO’s accountants’ concession is an administrative practice, not a privilege at law, and neither blocks an SMR obligation. If you provide a designated service under Tranche 2, the reporting duty is real and personal.
What actually triggers the report
Section 41 of the AML/CTF Act sets a low bar on purpose. You do not need proof, and you do not need a completed transaction. Reasonable grounds to suspect that a customer, or the service they want, is linked to money laundering, terrorism financing or proceeds of crime is enough. Suspicion can crystallise at an enquiry that never becomes an engagement. It can crystallise during customer due diligence, or months into a file when the story stops matching the money.
The clock is short. 3 business days for most suspicions, 24 hours where the suspicion relates to terrorism financing. The report goes through AUSTRAC Online, and the quality bar AUSTRAC applies is whether a reasonable person with your training would reach the same suspicion on the same facts.
I wrote more about the mechanics in SMRs and tipping off under Tranche 2. This article is about the part that happens after you press submit: facing the client.
Tipping off is now about outcomes, not inference
The old section 123 banned any disclosure from which someone could infer an SMR existed. From 31 March 2025 the offence was rebuilt. The test now is whether your disclosure would, or could reasonably be expected to, prejudice an investigation. That reform was designed as relief: it lets you brief external AML consultants, share within a reporting group, and run remediation projects without committing a crime.
It did not soften the core prohibition. Telling the client you formed a suspicion about them, or that a report has gone in, sits squarely inside the offence, because the explanatory materials name exactly that scenario as the harm the section exists to prevent. A client who knows they have been reported can move funds, destroy records and vanish.
The offence follows the information, not the job title. It applies whether you created the report, were copied on it, or merely overheard it, and it keeps applying after you or the client leave the firm. Maximum penalty: 2 years’ imprisonment or 120 penalty units, or both. At the current $364 unit value, that fine alone is $43,680.
The conversation you can still have
Silence does not mean freezing. AUSTRAC’s own guidance draws the line generously on the working side of it.
You can ask reasonable questions about unusual activity. You can run enhanced due diligence and tell the client you need further information to complete your checks. You can say, in plain words, that AML/CTF law requires your firm to collect and verify certain information before providing the service. None of that references a suspicion, a report or an investigation, so none of it tips anyone off.
What you cannot do is answer the real question. When a client asks why the matter is delayed, why you asked for source of funds twice, or whether you have reported them, the honest answer is prohibited. You give the process answer, you keep it boring, and you keep the file moving or you exit the engagement on neutral, documented grounds. You never explain the true reason for either.
That discipline has to be trained, because tipping off in practice is rarely corruption. It is a partner being reassuring on the phone with a 15-year client. From 31 March 2026 your AML/CTF program must contain policies to prevent exactly that, which in a small firm means need-to-know access to SMR material and one script for client-facing staff.
From my desk: Two weeks after 1 July 2026 I had my first live test. A client of nearly a decade asked us to set up a company and trust to buy into a business, with the deposit arriving as 4 separate transfers from overseas accounts held by people who were not parties to the deal. His explanation of the source changed between our first and second conversations. We escalated to enhanced due diligence, the story did not improve, and I lodged an SMR within the 3 business day window. Then came the phone call I had been dreading: why is this taking so long, you have known me for years. I gave him the only answer the law allows, that we are required to complete verification checks under AML/CTF law before providing this type of service. It felt cold. It was also the exact line between compliance and a criminal offence, and having it scripted in advance is the only reason it came out steady.
Where this leaves your engagement letter
The cleanest protection is set before any suspicion exists. Our engagement terms now tell every client, up front, that the firm is an enrolled reporting entity and that AML/CTF law may require us to collect information, delay services or make reports we are not permitted to discuss. That sentence breaches nothing, because it describes the legal framework rather than any client’s file, and it makes the later process conversation feel routine instead of sinister. Our AML obligations guide for accountants covers the wider program this sits inside.
The operational side matters just as much: suspicion logs, restricted SMR folders, and CDD records that show your reasoning. We built HP-KYC so that the identification, screening and escalation trail exists as a matter of workflow rather than memory, which is precisely what you want to be holding if AUSTRAC, or the TPB, ever asks how you handled the file.
Technical summary
Current as at July 2026.
Confidentiality: Tax Agent Services Act 2009 (Cth) s 30-10(6) (Code of Professional Conduct, item 6): no disclosure of information relating to a client’s affairs to a third party without permission, unless under a legal duty. TPB guidance (TPB(I) 21/2014; TPB(GS) 26/2014) lists reporting obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) as a legal duty. The same position applies to s 25 of the Tax Agent Services (Code of Professional Conduct) Determination 2024 (confidentiality in dealings with government), per TPB guidance on the AML/CTF reforms.
Suspicious matter reports: AML/CTF Act s 41. Reporting deadline: 24 hours where the suspicion relates to terrorism financing; 3 business days otherwise. Threshold: reasonable grounds for suspicion; no completed transaction required. Tranche 2 entities (including accountants providing designated services under the expanded regime) are subject to SMR obligations for designated services provided from 1 July 2026, following enrolment with AUSTRAC.
Tipping off: AML/CTF Act s 123, as substituted by Schedule 5 of the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth), effective 31 March 2025. Offence: disclosing protected information (including the existence or required existence of an SMR, s 49 or s 49B notices, and related documents) where disclosure would or could reasonably be expected to prejudice an investigation. Maximum penalty: imprisonment for 2 years or 120 penalty units, or both (penalty unit $364 from 1 July 2026; 120 units = $43,680). The offence applies to current and former reporting entities, officers, employees and agents, whether the person created, shared or received the information. Section 123(6): protected information cannot be required to be disclosed to a court or tribunal except in proceedings to give effect to the AML/CTF Act. From 31 March 2026, AML/CTF programs must include policies to prevent tipping off.
Not tipping off (per AUSTRAC guidance): reasonable enquiries about unusual activity; enhanced customer due diligence questions; disclosures to Australian law enforcement, intelligence or regulatory agencies; statements that information is required to comply with general AML/CTF obligations, provided no reference is made to suspicions, SMRs or investigations; disclosures to third parties that would not and could not reasonably be expected to prejudice an investigation.
Legal professional privilege attaches to legal practitioners and does not extend to accountants; the ATO accountants’ concession is administrative only and does not affect AML/CTF reporting obligations.
Frequently asked questions
Can I tell my client I have filed a suspicious matter report?
No. Disclosing that a report has been made, or information from which it could be inferred, is the tipping off offence in section 123.
Does confidentiality override the obligation to report?
No. The reporting obligation is statutory and sits above your engagement terms.
What is the tipping off offence now that the test has changed?
The reformed offence turns on whether disclosure would or could reasonably be expected to prejudice an investigation, rather than on the bare fact of disclosure. The penalty is 2 years imprisonment or 120 penalty units.
Can I still ask my client questions after forming a suspicion?
Yes, within limits. Ordinary questions you would have asked anyway are fine. What you cannot do is signal that a report exists or that the client is under scrutiny.
