By Casey Marsh, Director and Lead AML Consultant, Seamless AML
Choose a recently completed matter and ask the people who handled it to retrace the firm's anti-money laundering and counter-terrorism financing (AML/CTF) decisions. Why was the work captured? What did the firm understand about the client, and what changed? Can the records explain how concerns were resolved?
Tranche 2 brought specified services provided by Australian law firms into the AML/CTF regime on 1 July 2026. For firms providing those services, this exercise offers a practical starting point. An independent evaluator looks beyond the written program to how it operates. Following one matter can expose unclear responsibilities or missing information.
Start with the work the firm actually performs. Designated services are the services covered by the regime. For law firms, the professional designated services include specified assistance with property and corporate transactions, financing and legal arrangements. Coverage depends on the service and applicable conditions, including exclusions and exemptions. A practice-area label alone cannot settle the question.
Record the reasoning when a potentially relevant service is assessed as outside scope, too. That distinguishes a considered decision from an unchecked box. Give staff a route for resolving uncertainty and revisiting the classification when instructions expand. An engagement that begins as general advice may develop into assistance with a transaction.
In our audit work with New Zealand law firms, we have seen problems where template programs were adopted without enough tailoring to the practice. For example, risk assessments rated services without documenting the rationale or adequately assessing other firm-specific risks. The document left important operational questions unanswered: who does the work, which risks matter, and what staff should do when they encounter them.
Australian firms using the legal-profession starter kit from AUSTRAC, Australia's AML/CTF regulator, should first check its suitability, then customise the risk assessment, policies and processes to their own practice. A useful test is whether the program tells a staff member how to handle a matter the firm actually undertakes.
Under section 26C of the AML/CTF Act, the risk assessment covers money laundering and terrorism financing (ML/TF), as well as proliferation financing, which includes funding the illicit development or spread of nuclear, chemical or biological weapons. AUSTRAC uses “ML/TF risks” as shorthand for all three. Consider the firm's services, clients, ownership structures, countries involved and how instructions arrive. AUSTRAC's legal-profession risk indicators provide a reference point.
Initial customer due diligence (CDD) involves checks to understand who the client is, why they need the service and the risks involved. It goes beyond collecting identification documents. Depending on the customer and circumstances, the checks extend to beneficial owners: the individuals who ultimately own or control the client. Initial CDD generally needs to be completed before providing the designated service. Any permitted delay must meet the applicable conditions and be documented.
The change calls for assessment. Staff compare it with the information already held, seek an explanation and follow the program's escalation process. Enhanced CDD involves additional checks and scrutiny when the relevant legal triggers apply. This may include examining how the client's funds or wealth were obtained. The changed proposal does not itself establish criminal conduct.
We have also seen a gap in New Zealand audits between written procedures and the evidence available on client files. Missing evidence does not prove a check was never done, but it makes the firm's decisions harder to verify. Record the information considered, the assessment and the reasons for the response while they are fresh.
Ongoing monitoring must work across the matter team. A paralegal or accounts officer may hear about a change before the supervising lawyer. Who brings that information together? Who can decide whether the firm proceeds, and where is that decision recorded?
Set out whom staff contact, what information they provide and who covers an absence. Urgency should not leave a concern waiting in an unavailable colleague's inbox.
An unusual feature does not automatically require a suspicious matter report (SMR), nor must a firm prove a crime before a reporting obligation arises. Where an SMR is required, the usual deadline is three business days after the day the relevant suspicion is formed, or 24 hours after formation for terrorism-financing grounds. Legal professional privilege can affect reporting requirements, with a limited timing exception for non-terrorism-financing matters under section 41. Obtain legal advice promptly on privilege, what must be reported, which deadline applies and access to material for an evaluation. Internal approvals must not delay reporting. AUSTRAC's privilege guidance is a reference point.
Under rule 5-10, an evaluation addresses the risk-assessment process, policy design, compliance with the policies and how effectively the firm identifies and manages its risks. Expect requests for:
Agree evidence and access arrangements in advance. Avoid routine disclosure of SMRs or information revealing their existence, and address tipping off, confidentiality and privilege when deciding what to provide.
Testing should reflect the firm's work and risks. Where a weakness emerges, check whether it affects other matters. Assign responsibility for fixing it, then test whether the correction works in practice.
General information only. This article does not provide legal advice. The acquisition example is wholly fictional.
Sources checked 13 October 2026.
Anti-Money Laundering and Counter-Terrorism Financing Act 2006, including ss 6, 26C, 26F, 28, 30, 41, 123, 242 and 242A. Compilation 63, C2026C00447, compilation date 1 October 2026, verified on the Federal Register of Legislation.
Anti-Money Laundering and Counter-Terrorism Financing Rules 2025, including rr 5-10, 5-12 and 5-13.
Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026, s 17. Compilation 1, F2026C00452, compilation date 14 May 2026.
AUSTRAC responding to unusual transactions and behaviour, with the CDD and reporting guidance linked in the article.
