AML/CTF penalties in Australia fall into civil and criminal categories, with AUSTRAC able to pursue enforceable undertakings, infringement notices and civil penalty proceedings. Penalty exposure generally turns on whether a failure was systemic and whether the entity self-reported. Confirm current penalty amounts against AUSTRAC guidance.
Table of Contents
What Non-Compliance Actually Costs
AML/CTF penalties carries are the first thing most professional services firms ask about, ahead of what the regime actually requires of them. It is a reasonable question, and understanding the penalty framework turns out to be the most effective way to understand the obligations themselves. Confirm current penalty amounts and enforcement policy against AUSTRAC guidance.
Understanding the penalty framework is not just about risk management. It is the most effective way to communicate the compliance priority to firm leadership, explain to clients why KYC procedures are mandatory, and justify the cost of building a proper program.
Key Takeaways
AML/CTF Penalties: The Civil Framework
The Anti-Money Laundering and Counter-Terrorism Financing Act 2006 sets out civil penalties for contraventions of the Act’s core obligations. The penalty unit regime applies, with a penalty unit currently set at $330 under the Crimes Act 1914. For corporations, penalties for the most serious contraventions (including failing to adopt or maintain a compliant AML/CTF program, failing to conduct customer identification procedures, and failing to report suspicious matters) can reach 100,000 penalty units per contravention.
At $330 per unit, 100,000 penalty units amounts to $33 million per contravention. Where contraventions are systemic (that is, where the same failing occurs across multiple transactions or customers) AUSTRAC may characterise each instance as a separate contravention.
In 2020, AUSTRAC and Westpac reached a settlement of $1.3 billion, the largest corporate penalty in Australian history, for 23 million contraventions of the AML/CTF Act, including failing to report international funds transfers and systematic failures in customer due diligence.
Criminal Penalties
In addition to civil penalties, the AML/CTF Act creates criminal offences for the most serious breaches. Section 139 of the Act creates an offence of tipping off. Disclosing to a customer that a suspicious matter report has been lodged about them. The maximum penalty is two years’ imprisonment and a $22,200 fine per offence.
Structuring transactions to avoid reporting thresholds, known as smurfing, is also a criminal offence under Part 9 of the Financial Transaction Reports Act 1988, which continues to apply alongside the AML/CTF Act. Penalties for structuring can include imprisonment of up to five years.
AUSTRAC's Enforcement Pathways
AUSTRAC does not move immediately to civil penalty proceedings for every compliance failure. The agency operates a graduated enforcement approach with several pathways.
Infringement notices are the lowest-tier enforcement tool. AUSTRAC can issue infringement notices for strict liability offences. Contraventions that do not require proof of intent. Paying an infringement notice does not constitute an admission of liability and does not prevent AUSTRAC from taking further action.
Enforceable undertakings are negotiated arrangements in which a reporting entity commits to remediate identified compliance failures within agreed timeframes. Enforceable undertakings are publicly disclosed on AUSTRAC’s website and typically require independent audits, program remediation, and board-level reporting to AUSTRAC. They are often used where a firm has significant compliance failures but demonstrates a genuine commitment to rectification.
Civil penalty proceedings are brought in the Federal Court where AUSTRAC determines that negotiated resolution is not appropriate or where the contravening conduct is sufficiently serious. Proceedings are public. The Westpac, Commonwealth Bank, SkyCity, and Crown cases all resulted in civil penalty proceedings.
Deregistration and suspension of registration is available to AUSTRAC for reporting entities that fail to register or whose registration is revoked. An entity that is not registered with AUSTRAC cannot lawfully provide designated services, effectively a prohibition on operating.
What AUSTRAC Looks for in Professional Services Firms
AUSTRAC’s supervisory focus for Tranche 2 professional services firms will initially target the highest-risk designated services: property transactions, trust and company formation, and high-value legal settlements. The enforcement pattern from the financial services sector suggests AUSTRAC will initially prioritise firms that have not registered, firms that have adopted a program in form only without genuine implementation, and firms that have identifiable systemic failures in KYC or suspicious matter reporting.
The enforcement cases against major financial institutions arose not because those entities had no program, but because their programs did not function in practice. Customer due diligence files were incomplete. Transaction monitoring did not operate as documented. Staff training records did not exist. AUSTRAC’s expectation for professional services firms is the same: a program that functions in the firm’s actual operations, not one that lives in a drawer.
The Cost of Compliance vs the Cost of Non-Compliance
A professionally built AML/CTF compliance program for a mid-size professional services firm will typically cost between $8,000 and $25,000 depending on the complexity of services and the size of the client base. Annual maintenance (program updates, refresher training, and internal audit) adds a further recurring cost.
Against a potential civil penalty exposure of tens of millions of dollars per contravention, a reputational consequence that includes public AUSTRAC disclosure, and a risk of deregistration, the cost-benefit calculation is straightforward. The more relevant risk management question is not whether to comply, but how to build a program that is both compliant and operationally proportionate for a professional services firm.
AML/CTF penalties: what actually determines where a firm lands
Enforcement rarely opens with a penalty. It opens with a request, and how a firm answers shapes everything after it. Firms that can produce their program, their risk assessment and a sample of client files within days tend to stay in the education and infringement range. Firms that cannot are the ones who end up explaining themselves under an enforceable undertaking.
Civil penalties and criminal liability both sit in the regime, and AUSTRAC’s pathways escalate rather than jump. The comparison worth running is not penalty against zero, it is the cost of operating a program properly against the cost of remediating one under supervision, which is where the real expense sits.
How DBA Advisory supports
DBA Advisory offers fixed-fee AML/CTF compliance review, program build, and AUSTRAC registration support engagements with no hidden costs. Contact our team to discuss your requirements. General information only, not legal, tax, or compliance advice. Verify all obligations against current AUSTRAC, ATO, and legislative guidance.
Not sure where your firm stands under Tranche 2? The AML/CTF Compliance Readiness Assessment is a scored, plain-English self-assessment you can complete in fifteen minutes. Download it free or book a meeting today!
How DBA AML Supports You
This work is delivered by DBA AML Group Pty Ltd, the specialist AML/CTF compliance entity within DBA Advisory. It is a service rather than software: real AML/CTF practitioners do the work, so what leaves your desk is the function itself, not a portal to configure and operate. You remain the reporting entity; the operations move.
DBA AML Group Pty Ltd · ACN 697 643 404 · hello@dbaaml.com · dbaaml.com · We respond within one business day. Scope and fees are confirmed after a discovery call.
Frequently Asked Questions (FAQs)
The maximum civil penalty for corporations for the most serious AML/CTF contraventions is 100,000 penalty units per contravention. At the current rate of $330 per penalty unit, this equates to $33 million per contravention. Where non-compliance is systemic, each instance may constitute a separate contravention, meaning total penalties can be many multiples of the per-contravention maximum.
Prior to the Tranche 2 expansion, AUSTRAC's enforcement jurisdiction was limited to financial services, gaming, and bullion dealers. With accountants, lawyers, and other professional services firms becoming reporting entities from 1 July 2026, AUSTRAC's enforcement scope expands significantly. AUSTRAC has stated that supervisory activity in the Tranche 2 sectors will commence from commencement date.
An enforceable undertaking is a negotiated compliance agreement between AUSTRAC and a reporting entity. The entity commits to specific remediation actions (such as independent program audits, enhanced reporting, and board-level oversight) within agreed timeframes. Enforceable undertakings are publicly disclosed on AUSTRAC's website and are legally binding. Breach of an enforceable undertaking can result in civil penalty proceedings.
Yes. AUSTRAC can cancel or suspend a reporting entity's registration. An entity that is deregistered cannot lawfully provide designated services. For a law firm or accounting practice, this is effectively a prohibition on operating in the affected service areas. AUSTRAC can also apply to the Federal Court to restrain a firm from providing designated services without registration.
Tipping off occurs when a reporting entity or its staff disclose to a customer, or any other person, that a suspicious matter report has been lodged, or that AUSTRAC is investigating a matter. Tipping off is a criminal offence under section 123 of the AML/CTF Act, carrying a maximum penalty of two years' imprisonment. Staff must be trained to understand that suspicious matter reports are strictly confidential.
Disclaimer
© DBA Advisory 2026. This article is intended as general information only and does not constitute legal or compliance advice. Businesses should seek qualified advice specific to their circumstances before acting on any information contained in this article.
Related Insights
We build the resilient foundations
empowering you
to scale your business
Get in touch
Alquin Dagamina
Business Transformation and Technology Services, Manager
- Alquin.Dagamina@dbaadvisory.com
- 09158918379
