Tranche 2 client onboarding for accountants: a practical KYC workflow for small practices

Key takeaways

• AML/CTF obligations started for accountants on 1 July 2026, for designated services only.
• Customer due diligence must be done before the designated service starts, not after.
• Existing clients are mostly grandfathered unless their risk changes.
• A written, repeatable onboarding workflow is the easiest way to show AUSTRAC you take it seriously.

Which accounting services trigger AUSTRAC obligations from 1 July 2026?

AML/CTF accountants Australia wide now face is limited to designated services. AUSTRAC’s summary of obligations for tranche 2 entities says the reforms apply from 1 July 2026.

Designated services for accountants centre on activities such as setting up, running or restructuring companies and trusts, handling client money or assets, arranging finance and changing who owns or controls a structure. General tax returns, standard bookkeeping and routine advice are generally outside unless they form part of one of those services. That reading comes from industry guidance, so check AUSTRAC’s own accountant guidance and starter program against your service list before you decide.

AUSTRAC opened enrolment on 31 March 2026 and expects regulated entities to grow from about 19,000 to close to 100,000 (AUSTRAC). AUSTRAC enrolment accountants must complete within 28 days of first providing a regulated service.

What customer due diligence must happen before you start work?

Customer due diligence accountants must complete before providing a designated service covers:

• Verifying the customer’s identity.
• Identifying and verifying any beneficial owner and any person acting on the customer’s behalf.
• Screening for targeted financial sanctions.
• Identifying politically exposed persons.

On top of that initial check, the rules require ongoing due diligence, enhanced due diligence for higher-risk customers, and allow simplified due diligence for low-risk ones (AUSTRAC).

The practical point is timing. The check comes before the work, so onboarding can no longer be something the junior catches up on after the engagement is under way.

Do existing clients need to be re-verified?

Mostly no. Clients you took on before 1 July 2026 only need due diligence if you need to lodge a suspicious matter report, or if a significant change in the relationship raises their risk to medium or high (same AUSTRAC page).

That makes a risk trigger worth building in. If a long-standing client asks you to set up a new trust or restructure ownership, that request should prompt a fresh check.

How do TPB proof of identity rules and AUSTRAC due diligence fit together?

They overlap but are separate. The Tax Practitioners Board already requires proof of identity for new clients before you provide tax services, recorded on a checklist with the date and time, the documents, how they were sighted and who did the check, kept for five years after the engagement ends (TPB).

The TPB also advises practitioners not to request identity documents by email, and to keep a record of the check rather than copies of the documents. The ATO confirms that client-to-agent linking does not replace proof of identity (ATO).

A sensible KYC workflow small practice teams can run uses one intake for both: collect identity once, record it once, and add the AUSTRAC steps (beneficial owners, sanctions, politically exposed persons) when the engagement is a designated service.

What records do you need to keep, and for how long?

Record	Minimum period	Source
AML/CTF records, including due diligence	7 years	AUSTRAC
TPB client records (scope, outcome, advice)	5 years	TPB Code, section 30
Proof of identity checklist	5 years after the engagement ends	TPB

Keep the records where you can find them in an audit: on the client’s record, not in a staff member’s inbox.

What does AUSTRAC expect from a small firm in year one?

AUSTRAC expected newly regulated firms to have enrolled, adopted an AML/CTF program (its starter program or their own), appointed a compliance officer, trained staff and be ready to ask clients the right questions. It has said it “doesn’t expect perfection from day one”, but will focus on firms that wilfully ignore their obligations (AUSTRAC regulatory expectations).

Every program needs a senior manager’s approval, a risk assessment, a fit and proper compliance officer (a sole practitioner can fill the role), an independent evaluation at least every three years and an annual compliance report.

A tranche 2 client onboarding workflow for a small practice

1. Enquiry: the prospect enquires and lands in your CRM with the service they want.
2. Scope check: decide whether the service is a designated service. Flag it on the record.
3. Request: send a document and information request through your portal or onboarding tool, not email.
4. Verify: complete proof of identity and, for designated services, beneficial owner, sanctions and politically exposed person checks.
5. Record: log what was checked, when and by whom.
6. Engage: send the engagement letter with the TPB disclosures.
7. Monitor: flag any later request that changes the client’s risk.

Accounting practice software such as LYD Accrual OS helps around this workflow: it captures the enquiry, handles client onboarding automation for document requests and sends reminders. It supports the workflow. It does not replace your AML/CTF program, your risk assessment or professional judgement.

Who builds this for accounting practices?

Launch Your Dream, by Sharktech Global, builds LYD Accrual OS for accounting and bookkeeping practices, up and running within 7 working days of receiving your onboarding details. Open the live demo or book a free 30 minute discovery call.

General information only, not legal or compliance advice. Check AUSTRAC’s current guidance for accountants and the TPB before changing your process.