Quick answer: A section 167 notice needs prompt attention, but receiving one does not by itself mean AUSTRAC has found a breach. Check the deadline, identify exactly what is being requested, preserve the relevant records and nominate who will manage the response. For law firms, identify potentially privileged material immediately because section 167(5) contains a specific LPP procedure that must be addressed within the notice period.

AUSTRAC has moved beyond simply telling newly regulated businesses what they need to do. It is now using its statutory information-gathering powers to examine whether businesses are meeting their obligations.

On 28 August 2026, AUSTRAC announced that it had begun issuing section 167 notices to businesses that appeared to be providing designated services without being enrolled. It specifically referred to real estate agents, accountants, lawyers and jewellers.[1]

Then, on 30 September, AUSTRAC announced that it had begun issuing infringement notices following its earlier enquiries. The sectors identified as receiving infringement notices were real estate, accounting and jewellery. Lawyers were not among the sectors AUSTRAC identified.[2]

AUSTRAC has not publicly explained why lawyers were absent from the September announcement, and it has not announced that law firms will be the next sector to receive infringement notices. What it has said is that it is actively identifying businesses that remain unenrolled and that further infringement notices will be issued where necessary.

For background on how section 167 notices operate, see Flagship AML’s earlier guide: AUSTRAC Section 167 Notice: September Guide.

If you have just received a section 167 notice

The notice should be read carefully and dealt with promptly. A practical first response is to work through the following steps.

  1. Check the deadline. Identify the date and time by which AUSTRAC requires the information or documents. Do not assume that asking for clarification or additional time changes the existing deadline.
  2. Identify exactly what AUSTRAC is asking for. Read the notice closely and separate what is expressly required from material that falls outside its scope.
  3. Preserve the relevant records. Make sure relevant documents, correspondence, onboarding records, risk assessments and other compliance material are retained and can be located.
  4. Nominate who will manage the response. Someone should take ownership of the notice, coordinate the response and keep a clear record of what was provided and why.
  5. For law firms, identify potentially privileged material immediately. Confidentiality and legal professional privilege are not the same thing. Potential privilege issues should be assessed before responsive material is produced.
  6. Consider whether independent advice is needed. A notice can raise questions about scope, privilege, deadlines and the adequacy of the firm’s underlying AML/CTF records. Those questions may justify obtaining independent advice promptly.

The enrolment numbers are worth looking at

AUSTRAC’s published sector breakdown as at 17 September 2026 recorded 6,580 enrolments in its Lawyer category, 13,780 in accounting and professional services, 18,350 in real estate, 1,600 conveyancers and 320 jewellers and dealers in precious metals and goods.[3]

Earlier government impact modelling estimated that approximately 17,059 legal services businesses would be regulated by the reforms. Those figures cannot simply be subtracted from one another to produce a law firm non-compliance rate. They come from different datasets and classifications and, importantly, not every legal practice necessarily provides a designated service.

But the comparison still raises an obvious question: how many Australian legal practices that should be enrolled still are not?

That is ultimately a question only AUSTRAC can answer. For an individual firm, there is a more useful question:

Are we actually providing a designated service?

Start with what the business actually does

One of the traps with Tranche 2 is assuming that the regime applies, or does not apply, simply because somebody is a lawyer, accountant or real estate professional. It does not work that way. The starting point is the service being provided.

Flagship AML’s AUSTRAC enrolment guide explains the threshold question in plain English: the obligation depends on whether the business provides a regulated designated service with a geographical link to Australia, not merely its professional title.

For law firms, designated services can arise in areas including property transactions, establishing or restructuring companies and trusts, certain financing transactions and managing client money or assets. General legal advice and litigation are not automatically designated services.

But engagements have a habit of changing. A matter might begin as general commercial advice and later move into establishing a company, implementing a transaction, restructuring an ownership arrangement or dealing with client funds.

That means AML compliance cannot simply sit in a policy document. It needs to form part of matter opening and, where necessary, ongoing matter management.

What service are we providing? Is it a designated service? Who is the customer for AML purposes? What is the risk? What checks have been completed? Who decided that the firm could proceed?

If those answers cannot be established from the file, the business may have a practical compliance problem regardless of how impressive its written AML/CTF program looks.

Enrolment is only the beginning

The recent infringement notices understandably put the focus on enrolment. But enrolment is only one part of AML/CTF compliance.

Businesses providing designated services may also need to maintain an AML/CTF program, complete an ML/TF risk assessment, conduct customer due diligence or KYC, identify beneficial ownership and control, screen relevant persons, keep records, train staff and comply with applicable reporting obligations.

Could we show how our AML processes actually work?

Take an ordinary client file. Can the business identify who the customer is? If the customer is a company or trust, can it identify the individuals who ultimately own or control it? Can it explain why the customer or matter was assessed as low, medium or high risk?

If screening produced a possible PEP, sanctions or adverse media match, is there a record showing what was done with it? If the circumstances changed during the engagement, was the risk reconsidered? And if AUSTRAC asked for the compliance record six months later, could somebody actually find it?

Those questions become much more important once the regulator starts asking for information.

What about confidentiality and legal professional privilege?

For lawyers, section 167 raises an additional issue. Imagine a notice arrives seeking information or documents relating to clients and matters. A lawyer’s immediate reaction may be: what about my duty of confidentiality?

AUSTRAC’s legal professional privilege guidance recognises that legal professional privilege is narrower than a lawyer’s general duty of confidentiality. It also notes that confidentiality is subject to exceptions, including where disclosure is compelled by law.[4]

A duty of confidentiality does not, by itself, necessarily entitle a lawyer to refuse to comply with a statutory requirement to provide information.

Legal professional privilege is different. Section 242 of the AML/CTF Act preserves a person’s right to refuse to give information or produce a document where it is protected by legal professional privilege.[5]

But a document does not become privileged simply because it happens to be sitting on a solicitor’s file. The question of privilege needs to be considered properly. And where the privilege belongs to the client, the law firm should not simply assume that it has authority to waive it.

A firm receiving a section 167 notice should therefore not automatically hand over an entire client file. But nor should it assume that everything on the file can be withheld. The notice needs to be reviewed carefully, the material within scope identified and potentially privileged information considered separately.

Section 167(5) is particularly important

If a person receiving a section 167 notice reasonably believes that requested information or documents are protected by legal professional privilege, section 167(5) requires the person to give the AUSTRAC CEO an LPP form within the period specified in the notice.[5]

Importantly, section 167(6) makes subsection 167(5) a civil penalty provision.

In practical terms, claiming privilege is therefore not simply a matter of writing “privileged” across a document and putting the notice to one side. The firm needs to identify the potentially privileged material, consider the privilege claim properly and follow the statutory procedure within the relevant timeframe.

AUSTRAC’s guidance also confirms that providing a description of potentially privileged information does not, of itself, waive privilege. Where necessary, independent advice should be obtained quickly.

One thing a firm should certainly not do is leave the notice sitting in somebody’s inbox while everyone works out whose problem it is.

What does this mean for accountants and real estate businesses?

The legal professional privilege issue is particularly relevant to lawyers. But the broader lesson from AUSTRAC’s recent activity extends well beyond law firms.

Accountants and real estate businesses have already been identified among the sectors receiving infringement notices following AUSTRAC’s enrolment enquiries. For those businesses, the lesson should not simply be “make sure we have enrolled”.

Can we demonstrate what we actually did?

For a real estate business, that may mean being able to show how customers were identified, when beneficial ownership was established, what screening occurred and how higher-risk circumstances were dealt with.

For an accounting practice, it may mean being able to identify when an engagement involves a designated service and demonstrate how the resulting AML obligations were addressed.

For a law firm, the same practical issues arise, with the additional complication of confidentiality and legal professional privilege.

Different professions, but essentially the same regulatory question: can you show what you actually did?

Five questions Tranche 2 businesses should be asking now

  1. Are we actually providing designated services? Look at what the business does, not merely the profession it belongs to.
  2. Is AML built into our normal workflow? For lawyers, that may mean matter opening. For accountants it may be the engagement process. For real estate businesses it may be customer onboarding. If the process depends on somebody remembering to think about AML later, it is probably too fragile.
  3. Can we explain our risk decisions? A low, medium or high-risk selection is not particularly useful if nobody can explain why it was chosen.
  4. Could we produce the compliance record if AUSTRAC asked for it tomorrow? Customer identification, verification, beneficial ownership, risk assessments, screening, EDD decisions and ongoing monitoring should form a coherent record.
  5. Do we know who would manage an AUSTRAC notice? For law firms in particular, that should include knowing who will assess confidentiality and privilege issues and who will ensure that any section 167(5) LPP requirements are addressed within time.

The bigger lesson

Whether AUSTRAC later issues infringement notices to law firms remains unknown. But we already know enough to act.

Real estate and accounting businesses have appeared in AUSTRAC’s infringement activity. Lawyers were expressly included in its earlier section 167 enquiries. And AUSTRAC has said that it is continuing to identify businesses that have failed to enrol and will take further action where necessary.

Trying to predict which profession appears in AUSTRAC’s next media release is therefore probably the wrong exercise.

The better question is whether your business could demonstrate today that its AML/CTF processes actually work.

Because once a section 167 notice arrives, that stops being a theoretical question.

How Flagship AML can help

Flagship AML provides software tools designed to help Australian Tranche 2 businesses manage and document their AML/CTF processes.

The platform brings together customer onboarding, KYC, ML/TF risk assessments, beneficial ownership, PEP and sanctions screening, enhanced due diligence, ongoing monitoring and compliance records in a structured workflow.

Software does not replace professional judgment and it does not determine a business’s legal obligations. But a structured system can make it considerably easier to demonstrate what checks were completed, what decisions were made and why.

Businesses wanting to see how that workflow operates can explore Flagship AML or ask about a free trial.

See how a structured AML workflow can help your team document checks and decisions.

Explore Flagship AML with a free trial

View subscription options

About the author

Dan Ward is a commercial lawyer admitted in Australia and Papua New Guinea and co-founder of Flagship AML.

Sources and further reading

  1. AUSTRAC — AUSTRAC issues notices to non-enrolled businesses, 28 August 2026.
  2. AUSTRAC — AUSTRAC begins issuing infringement notices to non-enrolled businesses, 30 September 2026.
  3. AUSTRAC — Enrol with us overview.
  4. AUSTRAC — Legal professional privilege guidance.
  5. Federal Register of Legislation — Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (current text).

This article provides general information only and is not legal advice. AML/CTF obligations depend on the services a business provides and its particular circumstances. Businesses should obtain independent legal or compliance advice where appropriate.