How are accounting firms caught in the Anti-Money Laundering (AML) Rules

Accounting firms, providing SMSF services, are obliged to report suspicious or unusual transactions to AUSTRAC in relation to money laundering (ML) and terrorism financing (TF). This blog is to help you understand why we have to identify you when onboarding you as a client and so you are aware of the rules the government forces us to operate under.

Money laundering includes “proceeds of crime means any money or other property that is derived or realised, directly or indirectly, by any person from the commission of an offence that may be dealt with as an indictable offence (even if it may, in some circumstances, be dealt with as a summary offence)”.

Accounting firms are now caught under the expanded legislation under tranche two reforms to anti-money laundering and counter-terrorism financing regime (AML/CTF). Historically, the AML/CTF regime applied to financial planners and other professions, but the focus has now changed from certain professions to services undertaken on behalf of clients.

The amended legislation received royal assent on10 December 2024.

AUSTRAC  is the Australian government regulatory body overlooking business activities in the financial services, bullion, gambling and digital currency exchange sectors.

Certain business activities, “designated services”, have been identified as posing a risk for money laundering, terrorism financing and other serious criminal activities.

A link to AUSTRAC superannuation specific guidance.

Risk of money laundering and terrorism financing

Money laundering is increasing in complexity and includes the use of staging accounts and SMSFs to remove value from the superannuation system. The proceeds of crime can be disguised as contributions to superannuation funds and rolled over and eventually withdrawn from an SMSF bank account. Funds can be moved through the superannuation system following a predicate offence such as stolen personal identifiable information. Predicate offences such as identity fraud, scams and tax evasion are considered to be high risk. Refer to example at the end of the article.

AUSTRAC have determined the risk of terrorism financing is low based on various intelligence sources and decrease in reporting.

Reporting Entities

A reporting entity includes an accounting practice providing designated services to an SMSF as part of carrying on a business. A reporting entity does not include SMSF trustees, but they are still required to report suspicious activities.

Enrolment of Reporting Entities

A reporting entity can enrol with AUSPAC from 31 March 2026 with reporting obligations to commence on 1 July 2026.

What are those “designated services” in relation to an SMSF?

The following designated services are subject to AML/CTF rules:

1. The creating or restructuring a body corporate – includes organising the establishment of an SMSF including the corporate trustee, SMSF trust deed or a bare trust
2. The transfer of shares in a company to a person who will hold 25% or more of the company – transfer of shares in an SMSF corporate trustee
3. Arranging for the appointment of a person as an SMSF trustee, a trustee of a bare trust or a director or secretary of a corporate trustee
4. Providing a registered office for an SMSF corporate trustee
5. Controlling or managing the SMSF’s money except for fees in relation to administration services, tax payments, annual ASIC fee and council rates

What must an accounting firm do when providing “designated services” to SMSF clients?

The key obligations under the legislation include:

• customer due diligence (CDD)
• the establishment and maintenance of an AML/CTF program
• retention of records for seven years
• reporting suspicious behaviour and transactions

Customer due diligence (CDD)

The amendments focused on knowing your customer (KYC) by identifying and verifying the client’s identity and certain associates and understanding the risk associated with providing designated services to clients and how to mitigate those risks.

AUSTRAC has provided specific guidance for the superannuation industry, but it is not prescriptive or exhaustive as the emphasis is on the reporting entity to prepare its own risk profile and to assist in identifying, managing and mitigating the ML/TF risks.

AUSTRAC consider the risk in relation to the APRA regulated superannuation sector as medium. There is no current risk assessment by AUSTRAC for SMSFs.  As SMSFs are generally family groups the risk of identity fraud would likely be low but creating an SMSF with stolen identities to fraudulently roll over super to an SMSF so it can easily be withdrawn is a far greater concern.

Customer due diligence (CDD) includes:

• Initial customer due diligence (ICDD)
• Ongoing customer due diligence (OCDD)
• Simplified customer due diligence (SCDD)
• Enhanced customer due diligence (ECDD)
• Politically exposed persons (PEP)
• Pre-commencement customers

The identification process should be documented in part B of your AML/CTF program.

Initial customer due diligence (ICDD)

The client must be verified before providing a designated service by completing the ICDD form. Personal details are collected in the ICDD form, and the client’s identity is verified and the risk assessed of providing the designated service to the client.

In limited circumstances the ICDD can be collected as soon as practicable after the client is onboarded such as:

• to avoid disruption in the ordinary course of business
• the reporting entity has processes in place to mitigate the risk
• the risk is low

Ongoing customer due diligence (OCDD)

The accounting firm has ongoing obligations to monitor the client throughout the course of the business relationship.

The accounting firm is required to:

• identify suspicious and unusual transactions and behaviour in relation to ML/TF risks
• review and update the client’s identification and risk assessment
• re-verify KYC as appropriate
• review pre-commencement clients for significant changes which can change their status to medium or high risk

Simplified customer due diligence (SCDD)

A reporting entity with low-risk business relationships and occasional transactions may access simpler measures under ICDD and OCDD provided:

• the risk under ML/TF of the client is low
• ECDD does not apply

SCDD could reduce the evidence requirements for identity verification and seeking details about the nature and purpose of the business relationship where this is obvious based on the designated service being provided and ongoing monitoring can be less frequent.

Enhanced customer due diligence (ECDD)

ECDD applies to high-risk business relationships and occasional transactions, and it also applies at the ICDD and OCDD levels where:

• the ML/TF risk of providing the service is high
• there is a suspicion of ML/TF
• the client or associated persons receiving the designated service is a foreign PEP
• the client or associate is physically or legally formed in a high-risk jurisdiction

When identifying a high-risk client, the following measures may need to be taken:

• review and update and re-verify the client details using independent reliable sources
• use reasonable steps to identify the client’ s source of wealth
• identify the nature of ongoing business
• upgrade the monitoring of past and future transactions
• assess if services should be continued to the client

Politically exposed persons (PEP)

A PEP is a person who holds a prominent public or government position who is able to use their power and influence to corrupt or use bribery to seek personal gain. As SMSFs are generally family members or business associates the risk of PEP involvement is unlikely or at least a low risk.

Pre-commencement customers/clients

An exemption to the ICDD is available for pre-commencement clients who are in a business relationship with the accounting firm prior to 1 July 2026. However, these clients are subject to OCDD which means further information may be required if identified later on as being at risk. Suspicious activities may need to be reported.

Hint– business relationship involves the provision of a designated service for a duration of time i.e. an accountant providing a registered office for an SMSF corporate trustee.

 Establish and maintain an AML/CTF program

The program is a formal written document with two parts being Part A and Part B tailored to the firm’s specific circumstances which must be independently reviewed and updated regularly. The program assesses risk by considering customer profiles, practice size, services offered, delivery methods, employee training and any foreign involvement.

Part A concentrates on risk assessment of the firm and employees, employee training, systems and controls and OCDD and ECDD assessment.

Part B concentrates on customer identification and verification and whether your client is a PEP.

Retention of records for seven years

Reporting entities are required to retain records for seven years after the business relationship has ceased or the occasional transaction is completed.

Therefore, an accounting firm need to keep records to demonstrate the type and details of the data collected and how they assessed the risk i.e. a copy of a person’s passport is not required but the details recorded from the passport used to verify the client should be retained.

Reporting suspicious behaviour and transactions

Any detection of suspicious client activity or transactions must be reported to AUSTRAC in “suspicious matter reports” (SMRs). A suspicion is not a comprehensive investigation with a fully formed conclusion it is merely something like incomplete information, using false or stolen identities, money transferred to high-risk areas, large volumes of cash transfers or out of character transactions.

Customer Identification and verifications

Individuals with low to medium risk assessment

• Personal details – full name, occupation, residential address and date of birth
• Tax information – tax resident of Australia or another county and your tax file number
• Verification of the client’s name and either their residential address or date of birth from a primary government issued source document which must be an original or a certified copy and can include one, but not limited to, the following:
  • Australian state/territory driver’s license with photo ID
  • Australian passport (current or one that has expired within last 2 years but not cancelled)

Or, if no photo ID one primary non-photographic document plus a secondary identification document which can include, but not limited to, the following:

• Primary documents such as a Medicare card, Australian birth certificate, Australian citizenship certificate; and
• Secondary identification documents such as utility bills, bank statements and motor vehicle registration

The document can’t be expired except in relation to a passport. The documents can be from reliable and independent sources which can include electronic data. The above documents are considered to be a safe harbour, but other documents can be considered.

Hint – the following people can certify a copy of a document as true and correct:

• An accountant who is a full member of the Chartered Accountants Australia and New Zealand, CPA Australia, the Institute of Public Accountants or the Association of Taxation and Management Accountants
• An Australian legal practitioner who is a Commission for Taking Affidavits
• A Justice of the Peace or magistrate and an Australian Court Judge

The AML/CTF legislation applying to accounting firms and other professionals is in its infancy and further guidance will be ongoing as the industry comes to grips with the practicality of applying the rules whilst ensuring compliance with the legislation.