AML tranche 2 and the Privacy Act: KYC data

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227, the AML/CTF Act 2006 compilation C2026C00274 and the OAIC guidance for reporting entities updated 28 August 2026

s 6E(1A) the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

What changed on 1 July 2026

AML/CTF obligations for programs, customer due diligence, reporting and record-keeping applied from 1 July 2026 to the designated services in AML/CTF Act s 6 Tables 5 and 6, which cover real estate and professional services, and to dealers in precious metals and stones.¹ Enrolment with AUSTRAC was due by 29 July 2026 for a firm already providing one of those services; a firm that starts later must apply within 28 days of its first designated service.² AML/CTF Act s 51B Whether you are captured depends on the service, not the job title: see Is my business a reporting entity?

In its Impact Analysis of September 2024, the Attorney-General's Department estimated the reforms would add about 90,000 entities to the AUSTRAC reporting population.³ AGD estimate

Why the Privacy Act applies to your KYC data

A business with annual turnover of $3,000,000 or less is generally a small business and outside the Privacy Act.⁴ s 6D(1) But if a small business operator is a reporting entity, or an authorised agent of one, because of something done in its small business, the Act applies to its activities for the purposes of, or in connection with, the AML/CTF Act, Regulations or Rules as if it were an organisation.⁵ s 6E(1A)

The OAIC's guidance gives examples of those activities:⁶ OAIC

• collecting, using and storing personal information for customer due diligence;
• collecting, using, storing and disclosing it for monitoring and reporting;
• holding it for AML/CTF record-keeping;
• personnel due diligence, where the employee records exemption does not apply.

The OAIC says the Act does not cover a small business's other activities unless it is covered for another reason. Where the same details are collected for an AML/CTF purpose and another purpose, the OAIC says the Act applies to them.⁶

Removing the small business exemption is not law. The exposure draft Bill the Attorney-General's Department released for consultation on 31 August 2026 does not repeal it, and as at 25 September 2026 no Bill removing it had been introduced to Parliament.⁷ AGD

What to put in place

Sources for the table: Privacy Act Schedule 1⁸ and the OAIC's guidance for reporting entities.⁶ OAIC

ID copies and the 7-year records

The AML/CTF Act sets retention periods for the records it requires:⁹

• transaction records: 7 years from the day the record is made; AML/CTF Act s 107
• documents a customer gives you about a transaction: 7 years; AML/CTF Act s 108
• customer due diligence records: 7 years from the end of the business relationship or the occasional transaction; AML/CTF Act s 111
• records showing compliance with your AML/CTF program obligations (Part 1A): 7 years after they are no longer relevant. AML/CTF Act s 116

APP 11.2 does not require you to destroy information an Australian law requires you to keep.⁸ APP 11.2 What the law requires is the record, not necessarily a copy of the document. The OAIC's guidance says the AML/CTF Act does not require scanned copies or photocopies of identity documents. Keep the details you need, for example the name, date of birth, address, document number and expiry, the type of document, what you did to identify the customer, and the outcome of verification and risk assessment. Take reasonable steps to destroy or de-identify copies once no longer needed.⁶ OAIC See AML/CTF record-keeping requirements.

Tipping off and privacy

It is an offence to disclose that a suspicious matter report has been, or must be, given, or related information, where the disclosure would or could reasonably be expected to prejudice an investigation. The penalty is imprisonment for 2 years or 120 penalty units, or both.¹⁰ AML/CTF Act s 123 A legal practitioner or qualified accountant may disclose in good faith to dissuade a customer from conduct that is or could be an offence.¹⁰ Your AML/CTF policies must include safeguards against tipping off.¹¹ Rules 5-13

Privacy duties give way where they would conflict. The OAIC's guidance says you need not give a collection notice where it would tip off, must not give access or explain a refusal where that would tip off, and should apply the data-breach notification rules only to the extent consistent with AML/CTF secrecy and tipping-off provisions.⁶ OAIC s 26WP

Start here

The OAIC's own template collection notice for reporting entities is free on its website. Each sector edition of our AML/CTF kit includes a drafted collection notice for customer due diligence that refers to the OAIC's guidance. For breaches, see the data breach response plan. More in the Privacy Act section. Every source we use: sources.

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, AUSTRAC, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.