AML Compliance for Small Businesses — What You Need to Know

Anti-money laundering compliance is no longer just for banks. Regulatory reforms around the world — including Australia's Tranche 2 reforms effective 1 July 2026 — have extended AML obligations to tens of thousands of small and medium businesses including accountants, lawyers, real estate agents, conveyancers and precious metals dealers.

If you run a small business in one of these sectors, this guide explains what AML compliance means for you, what you are required to do, and how to meet your obligations without drowning in complexity.

What is AML Compliance?

AML stands for Anti-Money Laundering. AML compliance refers to the set of policies, procedures and controls that businesses put in place to detect and prevent their services from being used to launder money or finance terrorism.

Money laundering is the process of disguising the proceeds of criminal activity — such as drug trafficking, fraud or tax evasion — as legitimate income. Criminals often use professional service providers like accountants, lawyers and real estate agents to help them establish companies, move money or acquire assets, making it harder for law enforcement to trace the funds.

AML compliance programs create a documented record of who your clients are, where their money comes from, and whether their activities align with what you would expect for a legitimate client.

Does Your Small Business Need AML Compliance?

In Australia, your business needs to comply with the AML/CTF Act if you provide any of the designated services listed in the Act. Following Tranche 2, this includes:

• Accountants and tax agents when assisting with company registrations, trust formations, business sales or equity financing
• Lawyers and conveyancers when handling property transactions, client funds or company and trust formations
• Real estate agents when acting in the purchase or sale of real property on behalf of a client
• Precious metals and jewellery dealers for high-value transactions above applicable thresholds
• Financial planners and mortgage brokers for certain investment and lending arrangements
• Trust and company service providers who form companies, act as nominee directors or provide registered office addresses

Importantly, not all services provided by these businesses are regulated. A sole trader accountant who only does tax returns and BAS lodgements has no AML obligations from those services. The obligations only attach to specific designated services.

What Does AML Compliance Involve for a Small Business?

For a small business, AML compliance involves five core obligations:

1. Enrol with Your Regulator

In Australia, businesses must enrol with AUSTRAC before or shortly after they begin providing designated services. Enrolment is done online through AUSTRAC Online.

2. Appoint a Compliance Officer

Every regulated business must appoint an AML/CTF compliance officer responsible for overseeing the program. In a small business, this is usually the principal or owner. The compliance officer must be notified to AUSTRAC within 14 days of appointment.

3. Complete a Risk Assessment and Build a Program

You must document the money laundering and terrorism financing risks associated with your specific services, clients and delivery channels. Based on this risk assessment, you write your AML/CTF program — a set of policies and procedures covering how you will identify, verify and monitor clients. AUSTRAC provides sector-specific starter kits to help.

4. Verify Client Identities (CDD)

Before providing any designated service, you must complete customer due diligence (CDD) on the client. This means verifying who they are using reliable and independent sources. For individuals, this involves checking their name, date of birth and address against government databases and verifying their ID document. For companies and trusts, it also involves identifying the beneficial owners — the individuals who ultimately own or control the entity.

5. Report and Keep Records

You must report suspicious matters to your regulator, report cash transactions of $10,000 or more, and keep all CDD records for a minimum of 7 years. Annual compliance reports are also required.

How Much Does AML Compliance Cost a Small Business?

The cost of AML compliance for a small business depends on how you approach it. Businesses that try to manage compliance manually — using spreadsheets, photocopies and paper files — typically spend far more in staff time than those that use purpose-built platforms.

With a platform like VerifyID Online, the cost of client identity verification starts from $6 per check, with monthly plans from $49. For a small accounting firm doing 20 company registrations or trust formations per month, that's under $200 per month in total verification costs — a fraction of the risk of non-compliance.

The Most Common AML Compliance Mistakes Small Businesses Make

• Assuming they are not regulated — many business owners don't realise their specific services trigger AML obligations
• Delaying enrolment — the deadline has passed; any delay now increases enforcement risk
• Using photocopies as verification — a copy of a driver licence does not meet AUSTRAC's standard for independent and reliable verification
• Not capturing beneficial ownership — for company and trust clients, you must identify the people behind the entity, not just the entity itself
• Not keeping records for 7 years — a common oversight that can become a serious problem during an AUSTRAC audit

Getting Started

If you are a small business owner wondering where to start, the answer is straightforward: enrol with AUSTRAC, appoint yourself as compliance officer, download the relevant program starter kit from AUSTRAC's website, and start verifying clients before you provide any designated service.

For the identity verification piece, VerifyID Online handles the entire CDD process digitally — your client verifies in minutes, you get the result and certificate instantly, and records are stored for 7 years automatically.