AML/CTF tranche 2 IT security: protecting client ID and spotting fake AUSTRAC officials
AML/CTF tranche 2 IT security for accountants, agents and lawyers: where KYC ID copies hide, the Privacy Act's new reach, and how to spot fake AUSTRAC calls.
Since 1 July 2026, accountants, real estate agents, lawyers, conveyancers and other tranche 2 businesses that provide designated services have been AML/CTF reporting entities. For AML/CTF tranche 2 IT security, that means three jobs: protect the identity data you collect, because the Privacy Act now covers it even under $3 million turnover; stop ID copies piling up in inboxes and folders; and prepare staff for fake AUSTRAC officials.
This covers the systems side, not legal advice; the primary privacy source is the OAIC's guidance for AML/CTF reporting entities (updated August 2026).
What changed on 1 July 2026?
Tranche 2 brought real estate professionals, dealers in precious stones and metals, lawyers, conveyancers, accountants and trust and company service providers under the anti-money laundering regime. AUSTRAC opened enrolment for the new sectors on 31 March 2026, and obligations started on 1 July.
The trigger is the service, not the job title. Setting up companies and trusts, managing client money or helping a client buy or sell property or a business can bring a firm into scope; PKF's summary for accounting firms lists them (see also our IT support for accounting practices). Once in scope, you enrol with AUSTRAC, appoint a compliance officer, assess your money laundering risk, adopt an AML/CTF program, run customer due diligence, report suspicious matters and keep records that prove it all.
Enforcement has begun. On 13 October 2026, Real Estate Business reported that AUSTRAC had started sending penalty notices to real estate, accounting and jewellery businesses, of up to $21,840 for companies and $4,368 for individuals. Lawyers and conveyancers: see our IT for law firms and conveyancer IT and cyber security pages.
Does the Privacy Act now apply to my small business?
Yes, for your AML/CTF work. Businesses turning over $3 million or less are normally exempt, but the OAIC says the Act covers reporting entities handling personal information for AML/CTF purposes, including "small businesses with an annual turnover of less than $3 million". In its worked example, a real estate agency turning over $1.1 million must comply for customer and personnel due diligence, but not for its other activities. You need a privacy policy covering that AML/CTF handling (not the whole business), reasonable security, and a plan to destroy what you no longer need.
AML/CTF is one of several routes into the Act regardless of size. A quick decision box, from the OAIC's small business page:
| If your business… | Covered by the Privacy Act? |
|---|---|
| Turns over more than $3 million | Yes, under the general rule |
| Is an AML/CTF reporting entity at $3 million or less | Yes, for AML/CTF personal information |
| Provides a health service, or operates a residential tenancy database | Yes, regardless of turnover |
| Trades in personal information, or works under a Commonwealth contract | Yes, regardless of turnover |
| Is related to a covered business, or has opted in | Yes, regardless of turnover |
| None of the above, at $3 million or less | Generally exempt, but see the privacy tort |
The full list adds narrower categories, such as credit reporting bodies, and the statutory privacy tort reaches beyond the Act (see our privacy tort explainer).
Where do ID scans pile up?
KYC ID document storage is rarely one place: every handover leaves a copy behind. Check these:
Email.
The recipient's inbox, shared mailboxes, every forward, Sent Items and old PST archives on laptops.
Practice and property-management uploads.
Images attached to contact, matter or property records "just in case" (our real estate IT page covers the agency stack).
Downloads folders and desktops.
Saved to upload elsewhere, then forgotten, sometimes synced to OneDrive.
Scanners.
Scan-to-folder fills a network share nobody clears, and some devices keep jobs on internal storage, one reason forgotten office devices belong in a security review.
Phones and chat.
Licence photos sent by text, WhatsApp or Teams, often to personal phones.
Recycle bins, versions and backups.
Deleted files linger, and backups hold everything until their own retention ends.
Your verification provider.
An outside ID-checking service may keep copies too; the OAIC suggests reviewing the agreement and asking for the provider's privacy and information security policies.
Keep the information, not the copies
The OAIC states that once your obligations start (1 July 2026 for tranche 2 businesses), the AML/CTF Act does not require you to keep scanned copies or photocopies of identity documents, and that you should take reasonable steps to destroy or de-identify copies of full ID documents you collect. Keep only what you need instead: the document type and number, its expiry date, the client's name, date of birth and residential address, what you did to identify the client, and the outcome of the verification.
Copies made before 31 March 2026 are a separate case: the OAIC says reporting entities may keep those for 7 years after the business relationship ends. If you hold older copies, ask your adviser how to treat them.
A simple routine: verify the document, record the details in structured fields in your practice system, then delete the image everywhere it landed. For the backlog, Microsoft 365 data loss prevention has a built-in detector for Australian driver's licence numbers in email and documents, depending on your plan. Photos are harder: Microsoft Purview's optical character recognition reads text in images, but it is a pay-as-you-go option that, per Microsoft's documentation, only scans images uploaded after it is switched on. Old scans still need a targeted search.
Fake AUSTRAC officials: how do you verify a call?
AUSTRAC impersonation scams have followed the reforms. In August 2026, CEO Brendan Thomas warned that "AUSTRAC does not contact members of the public unexpectedly demanding payment", and that it will never ask anyone to pay in crypto or through social media apps such as WhatsApp or Telegram (reported by Broker Daily). Real Estate Business describes scammers claiming access to an "AUSTRAC investigator" with a real staff member's name and a fake LinkedIn-style profile, then moving to WhatsApp, and others posing as senior officials, including the CEO.
The catch: some AUSTRAC payment requests are real, because reporting businesses receive invoices for levies and infringement notices. The tells:
| Consistent with genuine contact | Red flag |
|---|---|
| An invoice for a levy or infringement notice | An unexpected, urgent demand to pay now |
| A request in writing, with time to ask AUSTRAC questions | Moving the conversation to WhatsApp, Telegram or social media |
| Contact details you find yourself on AUSTRAC's website | Payment in crypto or other virtual assets |
| No charge to handle a complaint | An offer to recover lost funds, or a fee to resolve a matter |
Stop.
Don't click, open attachments or pay while the caller is on the line.
Find contact details yourself on austrac.gov.au, never from the message or caller.
Route all regulator contact to your compliance officer, who knows what is genuinely outstanding.
Never send client KYC data in reply to an inbound request.
Handing over a client's ID is itself a privacy incident.
If money has gone, call your bank first, then report it to Scamwatch and cyber.gov.au.
It is invoice fraud wearing a regulator's badge, so the same call-back habits stop it; see how a payment redirection scam unfolds step by step.
Which IT controls make AML records defensible?
The OAIC's suggested security steps include knowing what personal information you hold and where it is stored, multi-factor authentication, patching, audit logs and access monitoring for all systems including email, contracts that bind service providers, and a data breach response plan. In Microsoft 365:
| Control area | In practice |
|---|---|
| Know what you hold | A KYC data map and one restricted library for AML records |
| Strong sign-in | MFA enforced with Conditional Access, legacy sign-in blocked, managed devices only |
| Logging and monitoring | Audit logging on and retained, with alerts on risky sign-ins and new forwarding rules, watched by 24/7 SOC monitoring |
| Retention and destruction | Retention labels whose clock starts when the relationship ends, with disposition review |
| Ransomware resilience | Immutable backups, with retention matched to your records policy |
Microsoft's event-based retention starts a label's retention period when an event occurs, such as a contract expiring, rather than at creation, which suits records kept for a set period after a client relationship ends. Some features depend on your licence. Our Microsoft 365 services cover the setup; see also finance and accounting IT and cybersecurity for financial services.
What happens if KYC data is breached?
The OAIC names Medicare card, driver licence and passport details among documents commonly used for identity fraud, so a KYC breach needs careful assessment. The Notifiable Data Breaches scheme sets the clock: take all reasonable steps to finish assessing a suspected breach within 30 calendar days and, where serious harm is likely, notify the OAIC and the people affected; the OAIC's NDB guide sets out the steps.
One AML/CTF wrinkle: the OAIC says notification doesn't apply where it would be inconsistent with a secrecy provision, such as those in the AML/CTF Act; if only telling the individual would be, you notify just the OAIC. That is a legal call; the IT job is keeping logs that show what was accessed, and a rehearsed incident response plan. A 31 August 2026 exposure draft proposes notifying the Information Commissioner of eligible breaches within 72 hours (see our 2026 draft Privacy Act bill explainer).
Frequently asked questions
Does tranche 2 apply to every accountant and real estate agent?
No. It applies when you provide a designated service, such as helping a client buy or sell real estate or a business, setting up companies and trusts, or managing client money. The obligations attach to those activities, not the whole firm, so map each service against the list and get advice if unsure.
Can we keep a photocopy of a client's driver licence?
You don't need to. Once your obligations start (1 July 2026 for tranche 2), the OAIC says the AML/CTF Act does not require copies of identity documents, and you should take reasonable steps to destroy or de-identify them. Record the details you need instead.
How can we tell if a call from AUSTRAC is genuine?
Hang up and use contact details from AUSTRAC's official website. AUSTRAC says it does not contact people unexpectedly demanding payment, and never asks for crypto or payment through WhatsApp or Telegram. Genuine levy and infringement invoices exist, so have your compliance officer check any request first.
If we delete the email, is the ID scan gone?
Rarely. Copies survive in Deleted Items, Sent Items, colleagues' mailboxes, Downloads folders, SharePoint versions, phones and backups. Destruction needs a routine that covers every location, plus retention and backup settings that match your records policy, so a deleted copy doesn't quietly come back from a restore.
Can Key IT help with AML/CTF compliance?
We handle the IT and data-security side, not legal advice: mapping where KYC data sits, clearing old ID copies, and locking down Microsoft 365 with MFA, logging, retention and immutable backups. Support is available Monday to Friday, 8am to 5pm, with an on-call roster for managed clients' urgent problems out of hours.
More insights
Privacy Act reforms 2026
Privacy Act reforms 2026 explained: the draft Bill's 72-hour breach reporting, processor rules and…
Read article →PrivacyAutomated decisions & your privacy policy
New Privacy Act rules from 10 December 2026 make businesses disclose automated decision-making…
Read article →ScamsSPF, DKIM and DMARC explained
SPF, DKIM and DMARC explained in plain English: stop scammers sending email as your business, keep…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.