Enrolled isn’t the same as ready

On 30 September 2026, AUSTRAC announced it had started issuing infringement notices to real estate, accounting and jewellery businesses it believes failed to enrol within 28 days of providing a designated service. The notices were $21,840 for a company and $4,368 for an individual, and AUSTRAC said they can keep accruing.

If you enrolled on time, you can breathe out. Just don’t stop there. Enrolment tells AUSTRAC your business exists. It doesn’t tell them your business is doing anything.

AUSTRAC’s chief executive, Brendan Thomas, has called enrolment a legal obligation and an important first step. The word that matters in that sentence is first.

What AUSTRAC has already been asking

Before the infringement notices, AUSTRAC sent section 167 notices to businesses that appeared to be providing designated services without enrolling. AUSTRAC says they went to businesses including real estate agents, accountants, lawyers and jewellers.

Those notices asked for information so AUSTRAC could work out two things: whether the business provides regulated services, and whether it’s meeting its obligations. Notice the second part. The question was never only “are you enrolled?” It was also “are you doing what the law asks of you?”

Enrolled and ready aren’t the same thing

Enrolled means AUSTRAC knows you’re there. Ready means you can show, today, that your program is running. For a small business, that usually means you can put your hands on:

• •a risk assessment written for your business, not copied from someone else’s
• •an AML/CTF program that’s been approved and is actually in use
• •a named compliance officer who knows they’re the compliance officer
• •records of the checks you’ve done on each customer you’ve acted for
• •records showing your staff have been trained

None of that is new. What’s new is that AUSTRAC has moved from reminders to notices, and the businesses it’s already asked for information have been asked about more than enrolment.

Enrolment answers one question: does AUSTRAC know you exist? Every other question is about what you’ve done since.

A five-minute honesty check

Sit down with a cuppa and answer these without looking anything up:

• •If AUSTRAC asked tomorrow, could you show your risk assessment and say who approved it, and when?
• •Could you show what checks you did on the last customer you acted for, and the date you did them?
• •Do your staff know who to go to if something about a deal feels off?
• •If one of your customers turned up on the DFAT Consolidated List next month, how would you find out?

If any answer is “not sure”, that’s your starting point. It isn’t a failure. It’s a list.

What to do this week

• •If you provide a designated service and you haven’t enrolled, enrol now. Don’t wait until everything else is sorted.
• •Pick the gap from the check above that worries you most, and close that one first.
• •Write down what you did and the date you did it. A dated note is evidence. A good intention isn’t.
• •If you’re not sure whether a service you provide is captured, check AUSTRAC’s guidance or ask your own adviser before you assume either way.

The businesses that will find the next few years easiest aren’t the ones with the thickest policy folder. They’re the ones that can show their work.

Curlew Comply helps small businesses run their program, not just write it. Your risk assessment, customer records and DFAT sanctions screening sit in one place, and every active customer is re-screened automatically whenever DFAT updates the Consolidated List.

curlewcomply.au · Curlew Comply is a software tool and does not provide AML/CTF advice. Check thresholds and timeframes against AUSTRAC’s current guidance.