Your AML obligations switched on the Privacy Act. Here's what that means.
If you became an AML/CTF reporting entity on 1 July 2026, you also became subject to the Privacy Act. Most Tranche 2 businesses haven't noticed.
The short version
- Small businesses with turnover of $3 million or less are usually exempt from the Privacy Act.
- That exemption doesn't apply to AML/CTF reporting entities (Privacy Act s 6E(1A)).
- So accountants, lawyers, conveyancers, real estate agents and other Tranche 2 businesses must follow the Australian Privacy Principles (APPs) for personal information they handle for AML purposes.
- You need an APP-compliant privacy policy.
- From 10 December 2026, that policy must also explain any automated decisions.
Why AML switches on the Privacy Act
AML compliance runs on personal information. You collect ID details, check beneficial owners, screen for politically exposed persons and sanctions, and ask about source of funds. You must keep records for seven years.
Parliament decided that information deserves Privacy Act protection, whatever the size of the business. Section 6E(1A) applies the Act to a small business's activities connected with AML/CTF compliance.
The OAIC has published guidance specifically for reporting entities. It says the Privacy Act applies to AML-related personal information regardless of whether you are a small business.
What you now have to do
1. Have a privacy policy. It must say what personal information you collect, how and why, who you share it with, whether it goes overseas, and how people can access it, correct it or complain (APP 1.4).
2. Give collection notices. When you collect ID and due diligence information, tell clients why, that the AML/CTF Act requires it, and who you may share it with. There's an exception where telling them would amount to tipping off.
3. Collect only what you need. The OAIC expects you to justify each piece of information you collect for AML purposes.
4. Stop keeping ID copies you don't need. The reformed AML/CTF Act no longer requires scanned or photocopied ID documents. Record the details and the verification outcome, then destroy copies you don't need.
5. Secure it, and plan for breaches. The Notifiable Data Breaches scheme now applies to your AML data. If a breach is likely to cause serious harm, you must notify affected people and the OAIC.
6. Handle access requests carefully. Clients can ask for their information. You can refuse where giving access would be unlawful, including where it would tip someone off.
What changes on 10 December
From 10 December 2026, new APPs 1.7 to 1.9 apply. If software uses personal information to make, or substantially help make, a decision that could significantly affect someone, your privacy policy must say so.
You must disclose:
- the kinds of personal information used
- the kinds of decisions made by software alone
- the kinds of decisions software substantially helps you make
For AML reporting entities, the obvious candidates are online ID verification, PEP and sanctions screening, and automated risk ratings. Each could affect whether you take someone on as a client.
This is a disclosure obligation only. You don't have to stop using these tools. You do have to say you use them.
A note on the wider exemption
You may have read that the small business exemption ends in December. It doesn't. The broader exemption is still in the Privacy Act. The government has agreed in principle to remove it, but that isn't law yet. The 10 December change is the automated decision disclosure only.
What to do this week
- Check whether you have a privacy policy. If you do, check it covers your AML activities.
- List the software you use for ID verification, screening and risk rating.
- Update or create your policy before 10 December.
This article is general information, not legal advice.
Sources: