AML/CTF for law firms: which work is caught, and how privilege works

The short version

A law practice is not regulated for being a law practice. It is regulated when it provides a service listed in Table 6 of section 6 of the Act, such as conveyancing, company and trust work, or holding client money for a transaction.¹ If it does, it has had AML/CTF obligations since 1 July 2026.²

1. Map your work

   Test each type of matter against the Table 6 items and record the decision. s 6

2. Enrol

   Directly with AUSTRAC, within 28 days of your first designated service. s 51B

3. Build the program

   A risk assessment and policies, documented before the first service and approved by a senior manager. s 26B s 26P Rules 5-15

4. Check clients

   Before you act, or within the delayed window for a conveyancing buyer. s 28 Rules 6-32

5. Handle privilege

   Know when you may refuse to report, when the 5-day clock applies and where LPP forms go. s 41(2A) s 5

Which legal work is a designated service

The summary below is ours; the wording of the Act decides.¹

Three limits in the Act matter to lawyers:

• Barristers. Work done as a barrister on a solicitor's instructions, given in connection with a designated service, is not a designated service. s 6(6B)
• Geography. An item applies only if the service is provided at or through a permanent establishment in Australia, or under the resident and foreign-branch limbs. s 6(6)
• Court orders. Items 1 and 2 do not cover a sale or transfer made under, or resulting from, a court or tribunal order. s 6

AUSTRAC's guidance adds that a service is caught when your work directly advances the transaction, not when it merely influences it; that litigation generally falls outside Table 6; and that drafting a will and the testamentary trust it creates falls outside items 2 and 4 to 9.³ Read AUSTRAC's professional designated services page (opens in a new window) before deciding a borderline matter.

Your trust account: item 3

Item 3 catches receiving, holding and controlling a client's money as part of a transaction, or managing it. AUSTRAC's example is client funds in your trust account whose disbursement you control.³ It does not apply where:⁴

• the money is payment for your own goods or services;
• your practice provides no other designated service, and the money is for payments reasonably incidental to a service that is not a designated service;
• the money is paid under a court or tribunal order, or by one of the government, court, international or licensed-insurer payers listed in s 6(5D);
• the service is another designated service.

The second exclusion falls away once you also do conveyancing or company work. A litigation practice that starts conveyancing has to decide afresh whether its trust money is item 3. AUSTRAC says that when you hold money in escrow, your customer is your client, not the counterparty who paid it.³

What a regulated practice must have

A sole practitioner is the governing body,⁵ and can also be the senior manager and the compliance officer. The compliance officer's regular reports to the governing body are not needed where one individual is both. Rules 5-7 The independent evaluation must still be done by someone independent of you. s 26F Rules 5-10

Client due diligence

• Before you act, establish who the client is, anyone acting for them, beneficial owners, politically exposed person and sanctions status, and the purpose of the matter. Verify with reliable and independent data appropriate to the risk. s 28
• Ongoing, monitor for unusual transactions and behaviour, and refresh client information at a frequency that matches the risk. s 30
• Simplified measures are available only where the client's risk is low and no enhanced trigger applies; enhanced measures are mandatory in the cases section 32 lists, including high risk, a suspicion where you keep acting, and a foreign politically exposed person. s 31 s 32
• Existing clients at 1 July 2026 are pre-commencement customers: initial checks apply only once a suspicion arises, or a significant change in the nature and purpose of the relationship makes their risk medium or high. s 36
• Relying on another firm's checks needs a written arrangement or documented reasons. s 37A s 38 Rules 6-29 Rules 6-31

Conveyancing. For a buyer client, you may finish initial checks later: by the earlier of 28 days after exchange and 3 days before the initially agreed settlement day. You may also arrange for another participating reporting entity to collect and verify the client's information within 28 days of exchange, with the data available at least 3 days before settlement and responsibilities written down. Your policies must say how you verify before settlement if that information does not arrive.⁶ If your own client will not give you what you need, you cannot start the service (s 28(1)) outside that window, and you should consider whether a suspicious matter report is required. The special rule for a party who will not cooperate (Rules 6-33(2)–(3) and 9-4A) applies only to real estate agents brokering under Table 5, not to a practice acting under Table 6.

Reports, and how privilege changes them

• All of the grounds privileged. You may refuse to give the suspicious matter report. s 41(2A)
• Some of it privileged. The report must be accompanied by an LPP form for that information: a written notice in the approved form stating the basis of the privilege. s 41(3)(aa) s 5
• The same mechanism elsewhere. An LPP form also goes with a threshold transaction report, program documents AUSTRAC requests, further information after a report, and answers to s 167 and s 202 notices. Each is a civil penalty provision. s 26Q s 43 s 49 s 167 s 202
• What privilege includes. Since 1 July 2026, privilege under Division 1 of Part 3.10 of the Evidence Act 1995. Sch 4

Report content is set by Rules 9-1 to 9-4 (suspicious matters) and Rules 9-5 to 9-8 (threshold transactions).⁷ Our suspicious matter reports guide walks through the report itself.

Tipping off, and the lawyers' exception

Disclosing that a suspicious matter report has been given or is required, or what it contains, is an offence where the disclosure would or could reasonably be expected to prejudice an investigation. The maximum penalty is imprisonment for 2 years or 120 penalty units, or both. It does not matter whether an investigation has started.⁸

Your policies must include safeguards against tipping off.⁹ Ending a retainer is where most practices will need a script. AUSTRAC's tipping off page (opens in a new window) gives examples of controls.

Notices from AUSTRAC

• Section 167: an authorised officer may require information or documents. Failing to comply is an offence of up to 6 months' imprisonment or 30 penalty units, or both. On 28 August 2026 AUSTRAC said it had begun issuing these notices to businesses that appear to provide designated services but have not enrolled, and named lawyers among them. s 167 AUSTRAC news article
• Section 172A: the AUSTRAC CEO may require documents, or require you to appear before an examiner. Intentional or reckless non-compliance carries up to 2 years' imprisonment or 100 penalty units, or both. s 172A
• Section 202: a notice to work out whether you provide designated services in Australia, answered with an LPP form for anything privileged. s 202

Section 168 is not an enforcement power: it entitles you to reasonable compensation for copying documents under s 167.¹⁰

Records

Keep transaction records for 7 years from when they are made, documents a client gives you for 7 years, client due diligence records for 7 years after the relationship or occasional transaction ends, and program records for 7 years after they stop being relevant, in English or a form readily converted into English.¹¹

Dates

1. 1 July 2026

   Program, due diligence, reporting and record-keeping obligations began for Table 6 services. The legal professional privilege changes commenced the same day.

   Sch 3 item 11 Sch 4
2. 29 July 2026

   Enrolment was due for practices already providing a Table 6 service before 1 July 2026, and no other designated service. A practice that starts later has 28 days from its first designated service. The obligation continues until you enrol.

   Not enrolled yet? You enrol directly with AUSTRAC. Enrol with AUSTRAC (opens in a new window)

   Sch 3 item 12 s 51B
3. 30 September 2027window opens 1 July 2027

   Last day to lodge your first annual compliance report.

   s 47 Rules 9-9
4. 2029 to 2030set by your enrolment identifier

   First independent evaluation for the 29 July 2026 enrolment group (practices already providing a Table 6 service before 1 July 2026, and no other designated service): before 30 June 2029, 31 December 2029, 30 June 2030 or 31 December 2030, depending on the last two digits of your enrolment identifier. A practice that started later plans its first evaluation under its own policies, at least once every 3 years.

   Transitional Rules s 17

Where to go next

AUSTRAC publishes a free legal profession program starter kit (opens in a new window). AUSTRAC says it suits practices with 15 or fewer personnel where some or all of those providing designated services hold a practising certificate, among other criteria, and that outside its profile "you cannot rely on the starter kit to meet AUSTRAC's regulatory expectations". It also says the kits are not a substitute for legal advice.¹²

Our kit builds on AUSTRAC's kits. Its legal practice edition adds an LPP handling procedure and LPP form register, a tipping-off and retainer-termination procedure, a conveyancing forms set and risk assessment, and a barrister and mixed-practice scope note. Our set-up service tailors it to your practice. We are not a law practice and do not give legal advice; we do not act as your compliance officer or lodge reports for you.

• Your sector page: legal practices.
• Unsure you are regulated? Work through our questions.
• More guides: the guides page and every source on our sources page.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.