How to Enrol with AUSTRAC: A Step-by-Step Guide for Tranche 2 Firms

Enrolment is the bit most firms want to tick off first, because it feels like the thing that makes you official.

I get the instinct. It is also the step I most often watch people misread.

Enrolling does not make you compliant. It tells AUSTRAC you exist and puts your name on a list. That is the whole job. Everything that actually protects you, the risk assessment, the program, customer due diligence, the reporting, sits on the other side of it and has to be built separately. If you have read what Tranche 2 actually means for your firm, this is the same trap from a different angle: being on the Roll and being compliant are two different states, and the gap between them is where the risk lives.

So I would treat this article as one task on a longer list. An important one, with a hard deadline and a daily price tag attached. But one task.

The deadline is tighter than the date suggests

Three dates matter here, and only one of them is the deadline people quote.

Enrolment opened on 31 March 2026.

Obligations start on 1 July 2026.

The deadline to be enrolled is 29 July 2026.

That last date is 28 days after obligations commence, and the 28 days is the part worth understanding, because the clock is not really tied to the calendar. It is tied to when you first provide a designated service. Section 51B gives you 28 days from that point to be enrolled. For most Tranche 2 firms the earliest that can happen is 1 July 2026, which is how everyone lands on 29 July. If your situation is unusual, it is the 28-day rule that governs you, not the headline date.

One thing I would flag, because it catches people out. There is no transition period for Tranche 2. The staged 3-year arrangement you might have heard about applies to businesses already inside the regime, not to you. You walk straight into the full framework on day one. So 29 July is not a soft target with a grace period sitting behind it.

What it costs to leave it

Not enrolling on time is not a one-off fine you can budget for. It accrues.

For every day you provide a designated service without being enrolled, once the 28 days are up, the penalty keeps adding. Up to 60 penalty units a day if you are a company. Up to 12 a day for an individual. It runs until you enrol or stop providing the service, whichever comes first.

At the current unit value that is getting close to $20,000 a day for a company. I am not going to commit to a precise annual figure, and here is why: the penalty unit reindexes on 1 July 2026, the same day your obligations start. So every dollar figure you have seen quoted, including AUSTRAC’s own older examples built on the previous value, is already out of date. Whatever number you have in your head is the floor, not the ceiling.

The arithmetic is not really the point. The point is that the cost of forgetting compounds, and it compounds from the worst possible day.

Get your information together before you open the form

Honestly, the form itself is the easy part. The delay is almost always in the gathering.

I would suggest not starting until you have this in front of you:

• Your ABN, and your ACN if you are a company (ARBN or ARSN if one of those applies to you instead).
• Business and contact addresses.
• A clear list of which designated services you actually provide. This is the part to get right, and if you are not certain you are even captured, sort that out first. Working out whether you are capturedis a different question, and it is the one that sits upstream of everything here.
• Your AML/CTF compliance officer’s details. The compliance officer has to sit at management level, so decide who that is before you are staring at the field.
• The domain names of any websites through which you provide those services.
• Your annual turnover.
• A device set up with multi-factor authentication, because AUSTRAC Online requires it.

Most of these you already have. The two that slow people down are the designated-services list and the compliance officer, because each needs a decision rather than a lookup. I reckon if you settle those two before you sit down, the rest is an afternoon.

Two decisions to settle before you open the form: which designated services you actually provide, and who your management-level compliance officer is. Everything else on the form is a lookup. These two are judgment calls, and they are where firms stall.

The actual steps

How enrolment works: 6 steps through AUSTRAC Online, then you are on the Reporting Entities Roll. Being enrolled is not the same as being compliant.

The process runs through AUSTRAC Online and a form AUSTRAC calls the Business Profile Form. Broadly, it goes like this.

1. Create your AUSTRAC Online account and set up multi-factor authentication.
2. Open the Business Profile Form and select your entity type.
3. Enter your business details: identifiers, addresses, turnover, the websites you operate.
4. Specify your designated services. This is where the list you prepared earlier goes.
5. Add your key personnel, including your compliance officer.
6. Review everything and submit.

Once you submit and AUSTRAC processes it, you are added to the Reporting Entities Roll. That is the formal record of who is in the regime, and being on it is what enrolled means.

None of these steps is hard in itself. Where I see people stall is step 4, because they have not pinned down which services trigger the obligation, and step 5, because they have not decided who the compliance officer is. Both are decisions you can make before you ever log in. Make them first and the form is mostly typing.

Enrol, register, or both

Worth being clear on a distinction that confuses people. Enrolment and registration are not the same thing.

Most Tranche 2 firms, real estate agencies, law practices, accounting firms, only enrol. Registration is a separate, additional step, and it only applies if you provide remittance or virtual asset services. So unless that is you, you enrol, you go on the Roll, and that is the registration question answered. Enrolment is not a permit and it is not approval to trade. It is a record that you are in the regime.

You are on the Roll. Now the work starts.

Getting the confirmation feels like the finish. I would treat it as the starting gun.

Two things keep going once you are on the Roll. You have to keep your details current, and AUSTRAC gives you 14 days to notify any change. And you stay on the Roll, with live obligations like the annual compliance report, until you apply to come off it.

The bigger thing is everything enrolment does not cover. Your AML/CTF program, your customer due diligence, your suspicious matter reporting: those are the obligations that do the actual protecting, and each deserves its own attention. I have kept them out of this article on purpose, because enrolment is its own task, and folding it in with the rest is exactly how firms end up enrolled and exposed at the same time. For the next pieces, start with what an AML/CTF program is, and read how suspicious matter reporting and tipping off work before 1 July, because that one is genuinely counter-intuitive.

If you are starting today: confirm you are captured, decide your designated-services list and your compliance officer, gather the identifiers above, then book an afternoon for the form. Do not wait for July. The deadline is the one date in all of this with a daily price tag.

The regulatory detail

The enrolment obligation

Source: Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Part 3A (Reporting Entities Roll), section 51B. A person who provides a designated service must be enrolled on the Reporting Entities Roll, and must apply for enrolment within 28 days of first providing that service (s51B). Failing to enrol when required is a contravention of a civil penalty provision.

The Reporting Entities Roll

AUSTRAC keeps the Reporting Entities Roll (s51C). Enrolment and applications for enrolment are dealt with under s51D and s51E. On enrolment you are entered on the Roll and given access to AUSTRAC Online. You remain subject to obligations while on the Roll, including the annual AML/CTF compliance report. Removal from the Roll is by application, when you no longer need to be enrolled (s51G).

Keeping your details current

An enrolled person must advise AUSTRAC of any change to their enrolment details within 14 days, in the manner set out in the AML/CTF Rules (s51F).

Commencement and the deadline

31 March 2026: AUSTRAC enrolment opens for Tranche 2 reporting entities, through the Business Profile Form on AUSTRAC Online. 1 July 2026: Tranche 2 AML/CTF obligations commence. Newly regulated entities enter the reformed framework with no transitional period; the 31 March 2026 to 30 March 2029 staged arrangement applies to existing reporting entities, not to Tranche 2. 29 July 2026: deadline to be enrolled, being 28 days after commencement under the s51B 28-day rule.

Penalty for not enrolling

Failing to enrol is a contravention of s51B and accrues as a daily civil penalty, for each day a designated service is provided while the entity is not enrolled, after the 28-day window, until enrolment or until the service stops. Body corporate: up to 60 penalty units per day. Other persons, including an individual: up to 12 penalty units per day. Penalty unit value: $364 on and after 1 July 2026 and each third 1 July after that under s4AA(3). 

What enrolment requires

The Business Profile Form collects: entity identifiers (ABN; ACN, ARBN or ARSN as applicable); business and contact addresses; the designated services provided; AML/CTF compliance officer details (the compliance officer must be at management level); key personnel and beneficial ownership details; domain names of websites through which designated services are provided; and annual turnover. AUSTRAC Online access requires multi-factor authentication.

Geographical link

A service is a designated service for these purposes only where it has a geographical link to Australia (Act s100).

Enrolment compared with registration

Enrolment (Part 3A) applies to all reporting entities. Registration is an additional requirement only for remittance service providers (the Remittance Sector Register) and virtual asset service providers (the VASP Register), which must register as well as enrol by 29 July 2026. Most Tranche 2 professional firms only enrol.

FATF context

The Tranche 2 expansion brings designated non-financial businesses and professions into the regime, addressing gaps identified against the international standards set by the Financial Action Task Force (FATF Recommendations, including Recommendation 22 and Recommendation 28 on DNFBPs).

Frequently asked questions

Does enrolling with AUSTRAC mean I am compliant?

No. Enrolment puts you on the Reporting Entities Roll and tells AUSTRAC you provide designated services. Your AML/CTF program, customer due diligence, reporting and record-keeping obligations are separate, and they must be in place by 1 July 2026.

When is the Tranche 2 enrolment deadline?

29 July 2026. That is 28 days after obligations commence on 1 July 2026. The 28-day period runs from when you first provide a designated service (s51B), which for most Tranche 2 firms is 1 July 2026.

What happens if I do not enrol on time?

Failing to enrol is a contravention of s51B and accrues a daily civil penalty: up to 60 penalty units a day for a body corporate, and up to 12 a day for others, for each day you provide a designated service while not enrolled, until you enrol or stop. The penalty unit value reindexes on 1 July 2026, so the dollar figure rises.

What do I need to enrol?

Your entity identifiers (ABN, and ACN if a company), business addresses, the list of designated services you provide, your AML/CTF compliance officer’s details, your website domain names, annual turnover, and a device with multi-factor authentication for AUSTRAC Online.

Do I need to register as well as enrol?

Only if you provide remittance or virtual asset services. Most Tranche 2 professional firms only enrol. Enrolment is not a permit or an approval to operate; it is a record that you are in the regime.

How long does enrolment take?

The form is short once your information is ready. The time cost is in the preparation, mainly settling which designated services you provide and who your compliance officer is. Decide those before you start.

Homepedia builds HP-KYC to handle the customer due diligence and record-keeping that begins once you are enrolled. HP-KYC

Sources

• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Part 3A and s100
• AUSTRAC, Enrol with us overview (Reporting Entities Roll and ongoing obligations)
• AUSTRAC, Businesses providing designated services must enrol (daily penalty for not enrolling)
• AUSTRAC, Consequences of not complying
• AUSTRAC, AML/CTF Act
• Home Affairs, Overview of the AML/CTF Amendment Act
• Crimes Act 1914 (Cth), s4AA (penalty unit value and indexation)
• ASIC, Fines and penalties (penalty unit value, 1 July 2026 indexation)

This article is general information, not legal advice. Verify the obligations and dates against current AUSTRAC and legislation sources for your own circumstances.