RegClock AU is a weekly change tracker. Every week we check AUSTRAC, ASIC, Treasury, AFCA and Digital ID for new guidance, enforcement, consultations and date moves, then explain what each change means for your business: onboarding, scams and disputes, AML governance and reporting, people, the board and budget. The deadline timeline below stays the backbone.
One short email a week: what changed, what it means for your business, and the next deadlines coming up.
AML: your AML/CTF program, CDD policies and governance must now map to the outcomes-based reform framework, so the board and senior management need to own the updated program. Identity: transitional rules let you keep current ACIP identification procedures while you migrate (see 30 Mar 2029). People and process: policy owners, frontline staff and training plans need updating, not just systems.
Applies to: Banks, Existing reporting entities
Official source: AUSTRAC ↗Identity and AML: decide how you'll verify clients' identity, record it and who in the firm owns AML/CTF compliance. Most small firms will need a customer due diligence process for the first time. People and budget: plan staff time, training and any outside help before obligations start.
Applies to: Lawyers, Accountants, Real estate, Conveyancers, Dealers in precious metals/stones
Official source: AUSTRAC ↗Fraud and scams: if you're an ADI you're in scope. Map how your business prevents, detects, reports, disrupts and responds to scams, across fraud operations, customer contact, complaints and product design, not only detection tools. Board: scam risk becomes a regulatory obligation to govern and resource.
Applies to: Banks, Telcos, Digital platforms
Official source: Treasury ↗AML governance: a named, accountable compliance officer is the anchor of the program. Make sure their authority, reporting line to senior management and escalation responsibilities are clear and match what AUSTRAC has been told.
Applies to: Banks, Existing reporting entities
Official source: AUSTRAC ↗Fraud and disputes: scam complaints will be judged against SPF code obligations. Customer-facing, fraud and complaints teams need consistent records of every warning, hold and verification decision, and leadership should expect customer-loss and dispute exposure to be scrutinised.
Applies to: Banks, Telcos, Digital platforms
Official source: AFCA ↗Identity: client identity verification and beneficial-owner checks are required for regulated services. AML: you need a program, a compliance officer, trained staff, PEP/sanctions screening, suspicious matter reporting and record keeping. People and budget: this changes how client intake works across the firm, so partners or owners need to set aside time and resources.
Applies to: Lawyers, Accountants, Real estate, Conveyancers, Trust & company service providers, Dealers in precious metals/stones
Official source: AUSTRAC ↗AML: if you missed it, enrol now; enrolment comes before everything else. Governance: AUSTRAC says it will prioritise enforcement against those who wilfully don't enrol, so this is a leadership-level priority.
Applies to: Lawyers, Accountants, Real estate, Conveyancers, Dealers in precious metals/stones
Official source: AUSTRAC ↗AUSTRAC began issuing section 167 notices to Tranche 2 businesses that had not enrolled after obligations commenced.
Business impact: Business: owners and partners need to treat enrolment as a governance priority, not admin. Identity/AML: enrolment is the gateway to your AML/CTF program, client verification, screening and reporting. People: assign a compliance owner now and document the decision trail.
Applies to: Lawyers, Accountants, Real estate, Conveyancers, Dealers in precious metals/stones
Official source: AUSTRAC ↗Fraud and disputes: dispute handling is live. Your internal dispute process, complaints staff and fraud teams should be able to produce scam case evidence on request. Budget: AFCA membership and dispute handling are now ongoing operating costs.
Applies to: Banks, Telcos, Digital platforms
Official source: ASIC ↗AUSTRAC announced a formal investigation into Western Union Financial Services (Australia) over AML/CTF compliance concerns.
Business impact: Business: a reminder that AUSTRAC will test controls, not just policies. Fraud/AML: review transaction monitoring, reporting quality and remediation evidence. Board: expect questions on assurance, audit findings and whether known issues were escalated and closed on time.
Applies to: Remitters, Existing reporting entities
Official source: AUSTRAC ↗AUSTRAC guidance says assess higher-risk customers individually, apply proportionate enhanced due diligence and monitoring, and avoid blanket sector-wide debanking.
Business impact: Identity: risk ratings and KYC refresh need to be evidence-based per customer, not per sector. Fraud/AML: use proportionate EDD and monitoring and document decline/exit reasons. Customer and board: blanket exits can push activity out of view and create conduct and reputation risk.
Applies to: Banks, Existing reporting entities
Official source: AUSTRAC ↗AUSTRAC moved from notices to infringement notices (fines) for Tranche 2 businesses that still had not enrolled, alongside new customer-check guidance.
Business impact: Business: non-enrolment now carries direct financial penalty, so this is an owner/board item. AML: enrol first, then build program, CDD, PEP/sanctions screening and record-keeping. Budget/people: plan staff time and possible adviser costs before AUSTRAC contacts you.
Applies to: Lawyers, Accountants, Real estate, Conveyancers, Dealers in precious metals/stones
Official source: AUSTRAC ↗AUSTRAC clarified TTRs apply to transfers of A$10,000+ in physical currency (cash) only, added mixed-transaction examples, and restated the 10-business-day reporting window and which form to use.
Business impact: AML operations: frontline and back-office teams need a clear cash vs electronic distinction so card and transfer payments are not misreported. Identity/reporting: train staff on mixed transactions and the correct TTR form for your enrolment date. Governance: update procedures and QA checks, not just reporting systems.
Applies to: Banks, Existing reporting entities
Official source: AUSTRAC ↗AFCA said 121 organisations had joined under the Scams Prevention Framework (including 102 telcos and 16 digital platforms), ahead of AFCA operating the Australian Scams Ombudsman from 31 Mar 2027.
Business impact: Fraud and disputes: scam complaints will be judged across banks, telcos and platforms together, so records of warnings, holds and verification decisions matter. Customer teams: make internal dispute resolution accessible and consistent. Board/budget: AFCA membership, dispute handling and multi-party case evidence are now ongoing operating costs.
Applies to: Banks, Telcos, Digital platforms
Official source: AFCA ↗Identity: myID could become an onboarding option for opening accounts, alongside document and biometric checks. Business: decide whether it fits your customer experience, risk appetite and product roadmap, and who owns the decision to apply.
Applies to: Banks, Relying parties, Digital ID providers
Official source: ACCC (Digital ID Regulator) ↗Identity and budget: businesses using myID will contribute to its costs, so plan a per-verification cost when comparing it with other verification methods. Pricing isn't published yet, so treat any budget as provisional.
Applies to: Relying parties, Banks
Official source: Finance / Digital ID ↗Fraud and scams: the big one for banks. You'll need documented scam prevention, detection, disruption, reporting and response controls, with possible liability and tiered civil penalties where they fall short. Board and budget: expect board oversight, clear accountability, staff training and funding decisions, not just system changes.
Applies to: Banks, Telcos, Digital platforms
Official source: ASIC ↗Fraud and scams: plan for scam-intelligence sharing with the ACCC and across sectors. Process: decide who owns sharing and reporting, and make sure your fraud data can be shared in a structured form. The exact date and content aren't set yet.
Applies to: Banks, Telcos, Digital platforms
Official source: Treasury ↗Identity and AML: onboarding must fully meet the new initial CDD rules by this date. Plan the migration across policies, staff training, customer journeys and suppliers well before, and give senior management a timeline and budget to approve.
Applies to: Banks, Existing reporting entities
Official source: AUSTRAC ↗AML reporting: international transfer reporting moves to a new report type. Operations, compliance and data owners need updated processes and controls, and the reporting pipelines must be rebuilt, so budget and plan the project early.
Applies to: Banks, Remitters, Virtual asset service providers
Official source: AUSTRAC ↗AML and identity: crypto businesses need processes to verify wallet ownership and report unverified self-hosted wallet transfers. Compliance, operations and product teams all have a role.
Applies to: Virtual asset service providers, Banks
Official source: AUSTRAC ↗AML governance: the hard stop for any deferred reporting migration. If you plan to nominate a substitute date, leadership should treat this as the final deadline in the project plan.
Applies to: Banks, Remitters
Official source: AUSTRAC ↗Tracked changes from official sources, newest first. These also appear in the timeline in date order; this feed is the reason to check back weekly.
AFCA said 121 organisations had joined under the Scams Prevention Framework (including 102 telcos and 16 digital platforms), ahead of AFCA operating the Australian Scams Ombudsman from 31 Mar 2027.
Business impact: Fraud and disputes: scam complaints will be judged across banks, telcos and platforms together, so records of warnings, holds and verification decisions matter. Customer teams: make internal dispute resolution accessible and consistent. Board/budget: AFCA membership, dispute handling and multi-party case evidence are now ongoing operating costs.
Official source: AFCA ↗AUSTRAC clarified TTRs apply to transfers of A$10,000+ in physical currency (cash) only, added mixed-transaction examples, and restated the 10-business-day reporting window and which form to use.
Business impact: AML operations: frontline and back-office teams need a clear cash vs electronic distinction so card and transfer payments are not misreported. Identity/reporting: train staff on mixed transactions and the correct TTR form for your enrolment date. Governance: update procedures and QA checks, not just reporting systems.
Official source: AUSTRAC ↗AUSTRAC moved from notices to infringement notices (fines) for Tranche 2 businesses that still had not enrolled, alongside new customer-check guidance.
Business impact: Business: non-enrolment now carries direct financial penalty, so this is an owner/board item. AML: enrol first, then build program, CDD, PEP/sanctions screening and record-keeping. Budget/people: plan staff time and possible adviser costs before AUSTRAC contacts you.
Official source: AUSTRAC ↗AUSTRAC guidance says assess higher-risk customers individually, apply proportionate enhanced due diligence and monitoring, and avoid blanket sector-wide debanking.
Business impact: Identity: risk ratings and KYC refresh need to be evidence-based per customer, not per sector. Fraud/AML: use proportionate EDD and monitoring and document decline/exit reasons. Customer and board: blanket exits can push activity out of view and create conduct and reputation risk.
Official source: AUSTRAC ↗AUSTRAC announced a formal investigation into Western Union Financial Services (Australia) over AML/CTF compliance concerns.
Business impact: Business: a reminder that AUSTRAC will test controls, not just policies. Fraud/AML: review transaction monitoring, reporting quality and remediation evidence. Board: expect questions on assurance, audit findings and whether known issues were escalated and closed on time.
Official source: AUSTRAC ↗AUSTRAC began issuing section 167 notices to Tranche 2 businesses that had not enrolled after obligations commenced.
Business impact: Business: owners and partners need to treat enrolment as a governance priority, not admin. Identity/AML: enrolment is the gateway to your AML/CTF program, client verification, screening and reporting. People: assign a compliance owner now and document the decision trail.
Official source: AUSTRAC ↗One short email a week when something changes at AUSTRAC, ASIC, Treasury, AFCA or Digital ID.
Reach compliance, fraud and identity teams at banks and newly regulated firms. Sponsors never influence content.
Sponsorship enquiries coming soon
