Much of the conversation around Tranche 2 entities captured by Australia’s Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) regime has focused on what they must do to comply.
For law firms, compliance preparation has involved assessing which services are captured, developing AML/CTF programs, conducting risk assessments, training staff and putting customer due diligence (CDD) and other controls into practice.
These are all necessary steps. However, now that the regime has entered the enforcement phase, the greatest risk for many law firms and legal practices may not be the obligations themselves, but AUSTRAC’s power to investigate whether those obligations have actually been met.
That power is found in section 167 of the amended Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). While a section 167 notice may appear to be an information-gathering tool, its significance lies in what it can deliver: intelligence-led scrutiny capable of affecting a law firm’s future.
Why section 167 matters
With the 29 July 2026 enrolment deadline now passed for law firms and legal practices providing designated services on 1 July 2026, AUSTRAC’s immediate enforcement focus has included issuing section 167 notices to businesses that appear to be providing designated services but have not enrolled. The notices require those businesses to provide information so that AUSTRAC can determine whether they are providing designated services and meeting their obligations under the AML/CTF Act.
However, section 167 is not confined to apparent non-enrolment, and a notice need not be directed to the business whose compliance is under examination. A notice may be given to a person if an authorised officer reasonably believes that the person has knowledge of information, or possession or control of a document, relevant to compliance with, or enforcement of, an offence provision or civil penalty provision of the AML/CTF Act or regulations.
It may also concern information or a document relevant to compliance with, or enforcement of, an offence provision of the Crimes Act 1914 (Cth) or the Criminal Code, to the extent that the offence provision relates to the AML/CTF Act. Given the breadth of the power, material produced in response to a notice may also expose deficiencies in an entity’s broader AML/CTF compliance framework.
For those captured by the AML/CTF regime, a section 167 notice marks the point at which compliance stops being a governance exercise and becomes an evidentiary one. The question is no longer simply whether the practice has implemented and embedded its obligations, but whether it can prove it.
Information available to AUSTRAC through its financial intelligence and regulatory functions may inform the use of section 167. Once issued, a notice enables AUSTRAC to obtain information or documents relevant to compliance or enforcement.
Against that backdrop, section 167 notices are likely to be an important tool for testing compliance.
AUSTRAC’s intelligence role
AUSTRAC is Australia’s financial intelligence agency and a member of the National Intelligence Community. Through its reporting framework, AUSTRAC receives and analyses significant volumes of financial intelligence and transaction data.
Its intelligence, data analytics and transaction-monitoring capabilities enable it to take an intelligence-led approach to compliance and enforcement as a regulator.
By the time a section 167 notice is issued, AUSTRAC may already have formed a view of a law firm’s risk profile.
The notice enables AUSTRAC to test that assessment against the firm’s records and explanations. It is a test of whether the firm’s compliance position can be substantiated.
The question AUSTRAC will ask
Every law firm believes it has a reasonable understanding of its compliance position. A section 167 notice asks a different question: “Can you prove it?”.
Depending on its terms, a notice may require a law firm to provide information or produce documents demonstrating how it assessed its obligations, identified and managed risk, performed CDD and monitored compliance over time.
Before AUSTRAC comes knocking, law firms should consider the evidence they may need to produce, including:
- the assessment determining whether their services are captured by the regime;
- records showing approval and implementation of their AML/CTF program;
- evidence of staff training;
- customer identification and verification records;
- beneficial ownership checks; and
- records demonstrating customer risk assessment and ongoing monitoring.
Law firms should also test whether their AML/CTF framework operates in practice. Can the firm demonstrate who made key AML/CTF decisions, when those decisions were made and why? Can it demonstrate that staff understood their responsibilities and that customer risk assessments and CDD procedures were applied? Can it produce records of testing, remediation and approvals?
Legal professional privilege
For law firms, legal professional privilege (LPP) requires particular attention. If a section 167 notice relates to information, a document or a copy of a document that the recipient reasonably believes is privileged from being given or produced on the ground of legal professional privilege, the recipient must give the AUSTRAC CEO an LPP form relating to that material within the period specified in the notice. Failure to give the required LPP form within the specified period would breach the statutory requirement and may expose the recipient to civil penalty proceedings.
The consequences of a section 167 notice
Failure to comply with a section 167 notice may have both criminal and civil consequences. An offence is committed where a recipient omits to do an act and that omission contravenes a requirement in the notice. Failure to comply also contravenes a separate civil penalty provision.
However, the exposure is not confined to non-compliance with the notice itself.
Complying with the notice may expose deficiencies in a law firm’s broader AML/CTF compliance framework. Depending on their nature, those deficiencies may lead to remediation costs, ongoing regulatory scrutiny and reputational damage. If the deficiencies disclose contraventions, civil penalty exposure or enforceable undertakings may follow, with potentially serious commercial consequences.
Law firms and legal practices should ensure they can clearly evidence their decision-making, compliance activities and implementation of their AML/CTF frameworks.
Ultimately, a firm’s exposure may depend less on what it did and more on what it can prove it did.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Share this article