AML/CTF Tranche 2 · plain-language explainer · current as at 6 November 2026
Tranche 2 has changed which firms carry AML/CTF obligations.
From 1 July 2026, Australia's AML/CTF obligations reach professional-service firms. Here's what that means in plain language — and where verifiable redaction helps you meet your record-handling obligations.
Where Omitly helps
Tranche 2 brings firms under AML/CTF record-keeping rules and, for small businesses, under the Privacy Act for that work, including APP 11.2's duty to take reasonable steps to destroy or de-identify personal information no longer needed (OAIC). Omitly helps when you share a redacted copy: it removes the content from that copy, checks the result and writes a tamper-evident, per-region audit report, on your machine. It does not destroy your originals, and AML/CTF records you must keep should stay complete.
Omitly produces a tamper-evident audit report of the checks it ran on the output document, and a seal showing the document has not been altered since it was sealed. This is a technical artifact about a single output file. It is not proof that the information has been destroyed across your other records, drafts, email, or backups, and it is not a determination that you have met any specific legal obligation — that remains your responsibility and, where relevant, your lawyer's.
Redaction stays on your machine
By default Omitly makes no network connection while it redacts — turn off Wi-Fi and it still works. Cloud redaction puts privileged and KYC documents in a third party’s possession; with Omitly there is nothing to upload. If you connect your own AI, text it asks for goes wherever that AI runs. Whether any handling of a document affects privilege is a question for your firm and its advisers.
A certificate you can hand over
A sealed redaction carries an audit report, signed on your machine, recording the checks Omitly ran and digests of the input and output files, and you can save a one-page certificate from it. Password-protected exports are not sealed. Unmarked professional certificates need a Pro licence; Personal and trial output is visibly marked.
Catch cosmetic redaction before you send
Omitly’s free leak-check reads a redacted PDF and flags content still recoverable underneath the black boxes — the failure that has exposed firms who only drew a box over the text. Redaction removes the underlying data, not just hides it.
Independently verifiable — offline, by anyone
Any recipient can check a sealed file offline with Verify in the Omitly desktop app, free and with no licence. Verify confirms the file is unchanged since it was sealed and shows what the sealed report records; it does not re-run the checks. A seal shows integrity, not identity: compare its key fingerprint with one the sender gave you separately. Anyone can also run the free leak checker on the file to look for recoverable content.
The facts, dated
Current as at 6 November 2026. Statements below are sourced to the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth), AUSTRAC or OAIC guidance — see Sources. AUSTRAC guidance is updated over time; check the sources for the current position.
Obligations commence 1 July 2026
New AML/CTF obligations for captured Tranche 2 entities commence on 1 July 2026. Source: Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) and AUSTRAC guidance.
Enrolment opened 31 March 2026
AUSTRAC enrolment for newly captured entities opened on 31 March 2026; you must apply to enrol within 28 days of first providing a designated service, which was 29 July 2026 for firms providing one from 1 July. Source: AUSTRAC.
Capture is by activity, not job title
You are captured if you provide a 'designated service' with a geographical link to Australia, in the course of carrying on a business — not because of what your role is called. Source: the Amendment Act 2024 (Cth).
Legal professional privilege is preserved in certain circumstances
AUSTRAC says the Act doesn't take away a person's right to refuse to give information protected by legal professional privilege. Information protected by privilege is generally narrower than information covered only by a lawyer's duty of confidentiality, and an LPP form may be required. Where your obligations and privilege interact, that boundary is a question for your firm and its advisers. Source: AUSTRAC.
Sources
- OAIC — Privacy guidance for reporting entities under the AML/CTF Act
- AUSTRAC — Summary of obligations (new regulated entities)
- AUSTRAC — AML/CTF transitional rules 2026 (enrolment window)
- AUSTRAC — Professional designated services
- Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) — Act No. 110 of 2024
Questions
What is AML/CTF Tranche 2?
Tranche 2 extends Australia's Anti-Money Laundering and Counter-Terrorism Financing regime to 'designated services' provided by professional-service businesses — including many law firms, accountants and real-estate professionals. Obligations for captured entities commenced on 1 July 2026 (current as at 6 November 2026). It is defined by the activity you perform, not your job title.
Will my firm be compliant just by using Omitly?
No — and be wary of any tool that says it does. Omitly is software, not a compliance program. It helps when you share a redacted copy of a document, by removing the sensitive content from that copy and producing a sealed report of what its checks recorded. It does not destroy your originals, and AML/CTF records you must keep should stay complete. In short: a tamper-evident record of the checks Omitly ran on this document — not a determination of legal compliance, and not a claim about your other copies or backups. Whether your firm meets its obligations is a determination for you and your advisers.
How does verifiable redaction help with record-handling obligations?
When you share a document, Omitly removes the underlying data from your copy (not just covers it), checks the result, and writes a signed, per-region audit report on your machine, with nothing uploaded. Whether that report meets a particular request is a question for your firm and its advisers.
Is this legal advice?
No. This page is general information, not legal advice, and does not determine whether any obligation applies to you. Cite the primary instrument and take your own advice.
This page is general information, not legal advice. It does not determine whether any obligation applies to you, and Omitly is a tool that helps you meet obligations, not a substitute for advice. Cite the primary instrument — the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 (Cth) — and AUSTRAC guidance, and take your own advice. Current as at 6 November 2026.