AML/CTF for Australian law firms: what a matter file has to record now that tranche 2 has started

Since 1 July 2026, Australian law firms that provide designated services, conveyancing and settlements among them, carry AML/CTF obligations: customer due diligence, a written AML/CTF program, an AML compliance officer, reporting to AUSTRAC, and records kept for seven years. MatterFirst, a legal practice management platform for Australian law firms, holds that evidence on the matter itself.

The obligations are not new to Australia. They are new to lawyers. A firm that has treated identity checks as a conveyancing formality now has to show a regulator a written program, a risk assessment, a named officer and a file that proves what was done and when. This guide sets out what the rules ask for, which files are captured, and how to structure a matter so the evidence accumulates as a by-product of the work.

This is general information about record keeping and systems, not legal or compliance advice. AUSTRAC and your law society publish the authoritative guidance, and both are linked throughout.

What changed, and the dates that matter

The Law Society of NSW states plainly that "you will become a reporting entity on 31 March 2026" and that solicitors "must enrol with AUSTRAC within 28 days of providing a designated service", which for most firms meant enrolment by 29 July 2026. See the Law Society of NSW AML/CTF reform FAQs. The Queensland Law Society records the same commencement: "On 1 July 2026, the amendments to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF) came into force." See the QLS AML/CTF resource centre.

If your firm has not enrolled and you are acting on transfers of real property, that is the first thing to fix, ahead of anything in this article about software.

Which files are captured, and which are not

The trigger is the designated service, not the practice area on your letterhead. The relevant services for lawyers sit in table 6 of the Act and include assisting a client to buy, sell or transfer real estate; assisting a client to buy, sell or transfer entities or legal arrangements; receiving, holding, controlling or managing property when assisting a client to plan or execute a transaction; assisting with equity or debt financing; selling or transferring a shelf company; and assisting a client to create or restructure an entity or legal arrangement.

The Law Society of NSW puts the distinction well: "assistance that merely influences a client's thinking, for example, strategic advice, background analysis, or advice on the legal consequences will generally not be enough." Its full analysis is worth reading before you decide which of your matter types are in scope: understanding designated services.

For a mixed practice, that means scope is decided per matter, not per client and not per department. A property team is almost entirely in scope. A litigation team is mostly out, until the day it settles a dispute by transferring a property. Matter opening has to make that call every time, and record which way it went.

The five obligations, and what each one asks of a file

Two of those carry hard clocks. A suspicious matter report is due within three business days, per AUSTRAC's guidance on suspicious matter reports. A threshold transaction report is required for transfers of $10,000 or more in physical currency, and is due within 10 business days after the day the transaction takes place, per AUSTRAC's threshold transaction report guidance.

Three business days is short enough that it cannot rely on someone remembering. It is a diarised obligation with a named owner, and it belongs in the same system that already calculates your limitation dates.

Seven years, and the clock starts in two places

AUSTRAC's record keeping guidance is specific: customer due diligence records must be kept for at least seven years from the date the business relationship ends, and transaction records for at least seven years from the date the transaction was completed. See AUSTRAC's record keeping overview.

Those are different clocks. A repeat developer client has transaction records ageing out settlement by settlement, and CDD records that do not start their seven years until the relationship ends. A system that files verification evidence against the matter alone loses the thread the moment the matter is archived. That evidence belongs on the contact record, with a dated pointer from each matter that relied on it, so you can show what was current at the time you acted.

Seven years after a relationship ends is also a long time for a firm that changes practice management systems every five. Ask any vendor what a full export of contacts, matters, documents and audit history looks like, in what format, and how long it takes: the evaluation checklist sets out the questions worth putting to any vendor.

Design the file so the evidence creates itself

The firms that find this manageable are the ones that treat compliance as structured fields on the matter rather than a folder. Five changes do most of the work.

Decide scope at matter opening. Add a required field on every matter type that could be captured: is this a designated service, and which table 6 item. A field that must be answered before the matter can progress is worth more than a policy document that says the same thing.

Rate risk, and record why. Country, delivery channel, customer type and the nature of the transaction all feed the rating. Record the inputs, not just the outcome. The rating on its own tells a regulator nothing about whether the assessment was performed.

Block the workflow on verification. Verification is a precondition, not an item on a checklist that a settlement can quietly outrun. If your system supports conditional automation, the condition is that a matter cannot reach the settlement stage while CDD status is incomplete.

Capture source of funds where it applies. A deposit arriving from a third party is the single most common thing that turns an ordinary conveyance into a file someone has to explain later. Record the account, the payer and the explanation given at the time.

Restrict who can see a report. Disclosure of a suspicious matter report is restricted under the Act. Before you decide who in the firm can see that record, and certainly before anything touches a client-facing portal, check the current position with your law society.

How MatterFirst handles this

MatterFirst is a legal practice management platform for Australian law firms, built by North Cape Technology in Melbourne. It does not write your AML/CTF program, and it does not lodge reports with AUSTRAC. What it does is hold the evidence in a structured form that survives an audit.

Matter types are defined by the firm, so a conveyancing matter type can carry the designated service classification, the risk rating and the CDD status as first-class fields rather than notes. Contacts are role-based, which is what lets verification evidence sit against the person or entity and be referenced by every matter that relied on it. Automations run on trigger, condition and action rules, so a matter can be held at a stage while a CDD field is incomplete, and a document can be generated as a workflow step. The obligations and limitation date engine calculates key dates and cites the governing statute, which is the same mechanism a three business day reporting deadline needs.

Document AI extracts key terms from uploaded documents and flags risks, and custom extraction rules let a firm define the fields that matter to its own documents, including what it needs off a contract of sale or a company extract. Bulk review projects run an extraction across many documents at once and export the resulting grid, which is how a firm answers a question about a back catalogue without opening files one at a time. The client portal gives clients a branded place to upload documents, which keeps identity material out of email.

Data and AI processing are hosted in the AWS region the firm chooses, Sydney by default for Australian firms, which matters when your retention obligation is measured in years. See security. Trust accounting is built for Australian jurisdictions, with a compliance review workflow covering NSW, VIC, QLD and WA. Those four, not all eight. Matters themselves can be recorded in all eight jurisdictions. Pricing is per workspace from $199 AUD per month with users included, not per user: see pricing.

How the products compare

Verified from each vendor's own public pages on 9 September 2026. Cells marked "Not verified this session" are ones where the vendor's page did not return content to us, and should not be read as a statement that the capability is absent.

One column is missing because no vendor publishes it: none of these systems lodges a report with AUSTRAC for you. Reporting is done through AUSTRAC Online. What a practice management system can do is diarise the deadline, attach the evidence to the right record, and still produce the file in seven years.

Who this suits, and who it does not

MatterFirst suits Australian firms of roughly two to twenty fee earners doing transactional work, particularly property, that want onshore hosting, state-based trust accounting and fields they can define themselves. A firm whose trust compliance review needs to cover SA, TAS, ACT or NT should ask about that specifically: the review workflow covers four jurisdictions today, even though matters can be recorded in all eight.

It is a poorer fit for a firm that wants a packaged AML/CTF product with a built-in risk assessment methodology, a verification of identity service and lodgement. Those are specialist tools, and a firm buying one should expect to connect it through the documented REST API and webhooks. The four integrations that connect self-serve today are Xero, Stripe, Microsoft 365 and Google Workspace. PEXA and InfoTrack are listed as coming soon, so if an out-of-the-box PEXA connection is a requirement today, that is a reason to look elsewhere or to plan for the API.

Frequently asked questions

Do Australian lawyers have AML obligations now? Yes. Solicitors providing designated services became reporting entities on 31 March 2026 and obligations commenced on 1 July 2026, according to the Law Society of NSW and the Queensland Law Society.

Is every matter a designated service? No. The service, not the practice area, decides it. Conveyancing, settlements and holding transaction funds are captured. General property advice, property litigation and property disposals as part of probate are given as examples that fall outside table 6.

How long do I have to keep the records? At least seven years, per AUSTRAC: from the end of the business relationship for customer due diligence records, and from completion for transaction records.

How quickly do I have to report? A suspicious matter report is due within three business days. A threshold transaction report, for transfers of $10,000 or more in physical currency, is due within 10 business days after the day of the transaction.

Does MatterFirst do AML/CTF compliance for me? No. It holds the evidence and drives the workflow. It stores CDD status and risk ratings as fields on the matter, blocks a stage while verification is incomplete, calculates and diaries deadlines, and keeps documents onshore. Writing the program, making the assessment and lodging the reports remain the firm's responsibility.

Does MatterFirst handle Victorian trust accounting? Yes. The trust compliance review workflow covers NSW, VIC, QLD and WA.

Where is the data stored? In the AWS region the firm chooses, Sydney by default for Australian firms.

The short version

The obligations commenced on 1 July 2026, they attach to the service rather than the department, the records have to last seven years from two different starting points, and the reporting clocks are three and 10 business days. None of that is solved by a folder called AML. It is solved by fields on a matter, a workflow that will not advance without them, a diary that calculates deadlines, and a system you can still export from in 2033.