Is anti-money laundering compliance harder for small businesses than for banks?
Visibl
Key Facts:- Since 1 July 2026, up to 100,000 additional Australian small businesses — including real estate agents, lawyers, accountants and conveyancers — have been brought under AUSTRAC's anti-money laundering and counter-terrorism (AML/CTF) regulations, yet many lack the compliance departments, enterprise systems, and preparation time available to banks.
- Small firms face particular challenges around complex client structures such as family trusts, where multiple parties require screening and verification, and must meet new customer due diligence requirements from day one, whilst established financial institutions have until 31 March 2029 to transition to the updated standard.
- Research from Australia's AML Readiness Report 2026 found businesses with fewer than 20 staff rated themselves significantly less prepared than larger firms, and 41% of all respondents identified time and/or cost as their single greatest compliance challenge.
- AUSTRAC has stated it is not seeking to prosecute small businesses for administrative errors, emphasising a risk-based approach where controls should be proportionate to the nature and size of the business, though it has begun issuing infringement notices to firms that failed to enrol.
- Small businesses are advised to thoroughly read their AML/CTF policy, translate procedures into practical examples, seek specialist help for complex client structures such as trusts and companies, and use technology to automate routine compliance tasks such as screening, verification, and record-keeping.
Op-Ed
27 October 2026
Is anti-money laundering compliance harder for small businesses than for banks?
Op-ed headline option: Small firms are being asked to think like corporate lawyers. Here's how to cope.
By Kaan Yuksel, Founder and Managing Director of Visibl, certified AML specialist and admitted lawyer
In some important ways, yes. Australia's new anti-money laundering and counter-terrorism (AML/CTF) laws ask a five-person real estate agency or a suburban accounting practice to do much of what a bank does, but without a compliance department, without enterprise systems, and with less time to adjust. That isn't a reason to panic. It is a reason to stop treating AML as a form you fill in once and file away.
Since 1 July 2026, real estate agents, lawyers, conveyancers, accountants and trust and company service providers that provide certain services have been regulated under Australia's AML/CTF laws (AUSTRAC). By one estimate report provided by SmartCompany, that brings up to 100,000 more businesses under AUSTRAC's oversight (SmartCompany). Most of them are small. Many of them are feeling it.
Why does AML/CTF compliance feel harder for small firms?
Small business groups are saying it out loud. Last week the chair of the Council of Small Business Organisations Australia (COSBOA) argued the rules place a disproportionate burden on smaller operators (as reported by SmartCompany).
I understand why. In my view, this legislation is in some respects harder for small businesses than it has been for the banks. Take a client that isn't an individual, such as a family trust. There could be eight or nine parties involved that require screening and verification. The law expects an agency principal or a practice manager to have something close to a corporate lawyer's grasp of entity structures, and a forensic accountant's attention to detail, to work out who needs to be verified and screened, and in what circumstances(AUSTRAC: beneficial owners).
The data backs up the feeling. In Australia's AML Readiness Report 2026, businesses with fewer than 20 staff rated themselves less prepared than larger firms (3.66 out of 5 compared with 4.22), and 41% of all respondents named time and/or cost as their single biggest compliance challenge (Australia's AML Readiness Report 2026, commissioned by Visibl; a self-selected sample of over 60 businesses).
Don't banks have to follow the same rules?
They do. What differs is the resources they bring and the timing they have to prepare for regulatory change.
Banks and other financial institutions have run AML programs for years, with large compliance teams and systems built for the job. A small agency or practice has neither. Yet every business in the regime must appoint an AML/CTF compliance officer (AUSTRAC: AML/CTF compliance officer). Across tens of thousands of newly regulated businesses, that's tens of thousands of compliance officers. There simply aren't enough experienced compliance specialists in the country to fill those roles, so many principals are taking the job on themselves.
Then there's timing. Under AUSTRAC's transitional rules, eligible existing reporting entities, such as banks, can keep using their current initial customer due diligence procedures until 31 March 2029 (AUSTRAC: AML/CTF transitional rules 2026). Newly regulated small businesses had to meet the new initial customer due diligence requirements from 1 July 2026. In practice, that means going well beyond an ID check. For every customer, a small agency or practice must now build a risk profile: confirming who the customer is, screening them against sanctions lists, checking whether they're a politically exposed person, and rating the risk they pose (AUSTRAC: customer due diligence). Banks must understand their customers' risk too, but they have until 2029 to move to the new standard, while many small businesses had to start on day one. The intent of aligning Australia with international standards is sound. But for small firms the change is happening now, and it isn't small.
What does AUSTRAC actually expect from a small business?
Here's the reassuring part. AUSTRAC has been clear that it wants to see best efforts, not perfection. Its CEO has said publicly that it has no intention of prosecuting small businesses for administrative glitches (Law Society of NSW).
AML/CTF is a risk-based framework. Your controls should match the nature, size and complexity of your business. AUSTRAC is alive to the fact that a small Tranche 2 business won't be as mature in its compliance as a major financial institution, and that's okay. The aim isn't to reduce risk to zero. It's to understand your risks and manage them to an acceptable level, and to keep improving as you learn.
What AUSTRAC won't accept is doing nothing. It has started issuing infringement notices to businesses that failed to enrol (AUSTRAC). AUSTRAC has also said around 90% of the businesses it first flagged have since enrolled or taken steps to (Real Estate Business). Most firms are doing the right thing. The question now is whether their programs work in practice.
What would make it easier?
My one ask of AUSTRAC is more worked examples, hypothetical or otherwise, showing how to carry out initial and ongoing due diligence for different types of customers, and how to handle red flags. Small firms learn best from real scenarios, not abstract principles.
There are encouraging signs. AUSTRAC has said new e-learning modules are coming, covering customer due diligence for individuals and non-individuals, politically exposed persons and beneficial ownership, along with real-world scenarios and resources for newly regulated sectors (AUSTRAC industry forum, September 2026). That's welcome, and small businesses should use them.
What can a small firm do right now?
If you're feeling overwhelmed, you're not alone, and you don't have to master it all at once. Four things make the biggest difference:
- Read your own AML/CTF policy. Most policies I review comply with the law. The gap is between what the policy says and what happens day to day.
- Turn procedures into practical examples. For instance, what exactly does your team do if a client turns out to be a foreign politically exposed person?
- Get help with complex structures. Trusts and companies are where small firms most often need a specialist's judgement.
- Let technology carry the routine load. Use software for policy creation, training, verification, screening, reminders, ongoing matters and record-keeping, so your time goes to the decisions that need a human.
Small businesses were never going to have bank-sized compliance departments, and they shouldn't need them. With the right tools and the right expert in your corner, AML/CTF compliance can become a manageable part of running your business, not a weight on it.
About us:
Visibl is an Australian AML compliance platform for the real estate, legal and accounting sectors, combining certified AML specialists with automation: AUSTRAC enrolment, a tailored risk-based AML/CTF program, screening, training, audit-ready reports and records. www.visibl.com.au
Contact details:
Lucy Allen
0435758509