Industry Guides9 min read

AML/CTF Compliance for Law Firms: What You Actually Need to Do

Published 28 June 2026

by Tranche Compliance Team, AML/CTF Compliance Specialists


Key takeaways

  • Law firms are captured across property transactions, client fund management, company and trust formation — but not tax advice, litigation, or most advisory work.
  • CDD must be completed before commencing the designated service — not midway through a matter and not at settlement.
  • For corporate and trust clients, verification must extend to beneficial owners and controlling persons, not just the named client.
  • The tipping-off prohibition overrides normal professional duties — once an SMR is filed or intended, a solicitor cannot inform the client even if professional candour would otherwise require it.
  • Law firm solicitors face dual accountability: AUSTRAC civil penalties and Law Society conduct proceedings if non-compliance is identified.

Which Law Firm Services Are Captured?

Law firms are among the entities captured by the Tranche 2 reforms, but not all legal services trigger AML/CTF obligations. The designated services for law firms are defined in the AML/CTF Act and cover four broad categories: services relating to real property transactions (including conveyancing, property sale advice, and settlement); services involving the management or transfer of client money or assets (trust account management, holding settlement funds); company and trust formation, administration, or management; and certain financing and investment advisory arrangements.

The obligation applies whether the firm is acting for the buyer, the seller, the company, or the trust. A law firm that advises on the preparation of contracts for the sale of real property, manages funds through its trust account in connection with that sale, and oversees the settlement is providing three distinct designated services simultaneously. Each triggers the AML/CTF obligations for that engagement.

Tax advice, litigation, and most dispute resolution services are not captured as designated services — though if a litigation matter involves the management of client funds through the trust account in connection with property, that component may be captured. Employment law, family law, criminal law, and regulatory advisory work are also not captured unless they involve trust account management for property-related settlements.

The threshold for obligation is the type of service, not the size or value of the matter. A small residential conveyance triggers the same obligations as a complex commercial property acquisition. The intensity of due diligence should be proportionate to the risk profile of the matter — but the obligation to conduct and document at least baseline due diligence is universal.

Customer Due Diligence in Legal Practice

Customer due diligence (CDD) for law firms must be completed before commencing the designated service — not midway through a matter, and not at settlement. In practice, this means completing identity verification and an initial risk assessment during client onboarding, before any substantive work begins on a property transaction, company formation, or trust administration.

For individual clients, the required information includes full legal name, date of birth, and current residential address. Verification requires a government-issued photo ID (passport or driver's licence) and, for higher-risk clients, a second document confirming address. For corporate clients, the firm must verify the company's registration (ACN or ABN), registered address, and the identity of its beneficial owners — individuals who ultimately own or control more than 25% of the company.

For trust clients, the verification requirements are more demanding. The firm must identify the trustee (individual or corporate), the settlor, the beneficiaries or classes of beneficiaries, and the source of the trust assets. Where a trust has a corporate trustee, the beneficial ownership of the corporate trustee must also be traced. Complex trust structures — particularly discretionary trusts with multiple layers or offshore trustees — are inherently high-risk and require enhanced due diligence.

The CDD obligation is ongoing. If a client's risk profile changes during a long-term engagement — a change in beneficial ownership, a new matter in a higher-risk jurisdiction, or a material change in transaction structure — the CDD must be updated. The Part B program should specify what triggers a re-verification review and how that review is conducted and recorded.

Source of Wealth for Property-Related Matters

Source of Wealth (SoW) assessment is an enhanced due diligence requirement that applies to law firms when property-related matters involve clients whose financial profile warrants deeper scrutiny. The SoW assessment asks whether the client's declared income, business activities, and financial history coherently explain the level of wealth they are deploying in the transaction.

For most residential property matters, the SoW assessment will be proportionate — basic bank statements and income confirmation may be sufficient for a client purchasing a modest property using the proceeds of a prior sale. For higher-risk clients — offshore buyers, clients using complex entity structures, clients with unusually high transaction values relative to their declared income, or clients from AUSTRAC-designated high-risk jurisdictions — a more detailed SoW assessment is required.

Law firms frequently receive bank statements in the course of property transactions. The SoW review of those statements should include: confirmation that the mathematics reconciles (opening balance plus deposits minus withdrawals equals closing balance); identification of any deposits of $10,000 or more and the source explanation for each; and an assessment of whether the transaction pattern is consistent with the client's declared occupation and circumstances.

The SoW record must be retained in the matter file. For straightforward matters, a brief file note referencing the evidence obtained and the conclusion reached is sufficient. For higher-risk matters, the record should be more detailed — capturing every piece of evidence reviewed, the key findings, and the authorisation decision for proceeding.

Generate your law firm AML/CTF program with Tranche

Generate your compliant AML/CTF program manual in under 30 minutes — no compliance lawyer required.

Get started with Tranche

AMLRO in a Law Firm Context

Every law firm must appoint an AMLRO and document that appointment formally in Part A of the AML/CTF program. In a law firm, the AMLRO should be a partner or senior solicitor with sufficient authority to access client files, make SMR filing decisions with AUSTRAC, direct junior staff on AML/CTF matters, and escalate concerns to the partnership without constraint.

For a sole-practitioner law firm, the practitioner will typically hold the AMLRO role. For a multi-partner firm, the AMLRO role should go to a partner who has both the interest and the time to discharge it meaningfully — not the most junior or least-burdened partner available. Firms that delegate the AMLRO role to a compliance manager without partnership authority should confirm that the manager has sufficient delegated authority to make filing decisions and to override resistance from fee earners in compliance-sensitive situations.

The Part A program must document the AMLRO's name, title, contact details, date of appointment, relevant training completed, and the succession arrangement — who covers the AMLRO function during absences or departures. For law firms with a significant property practice, the AMLRO's function will be more time-intensive than for a firm with minimal property work — scheduling time for it proactively is better than addressing it reactively when a client file raises concerns.

The Tipping-Off Prohibition and Legal Professional Privilege

The intersection of AML/CTF obligations with legal professional privilege (LPP) is one of the most practically significant issues for law firms. LPP protects confidential communications made for the dominant purpose of legal advice or litigation. The AML/CTF obligations — CDD, SoW assessment, SMR filing — relate to the firm's role as a reporting entity facilitating a transaction, not to the confidential legal advice itself, and do not override LPP in that context.

However, the tipping-off prohibition applies absolutely to law firms as reporting entities. Once an SMR has been filed, or the intention to file has formed, the solicitor cannot disclose that fact to the client — even if they believe professional candour otherwise requires it. This is one area where the AML/CTF Act expressly overrides normal professional duties, and all relevant staff must understand this before the situation arises.

For matters where a solicitor has reasonable grounds to suspect the client is engaged in money laundering, the tipping-off prohibition may affect the firm's ability to communicate with the client about why the matter is proceeding unusually or why additional documentation has been requested. Firms facing this situation should obtain independent internal or external legal advice on managing the matter — including potential withdrawal — without breaching the prohibition. Citing the SMR as the reason for withdrawal is itself a tipping-off violation.

Solicitor-client privilege does not provide a basis for refusing to provide an AML/CTF program or compliance records to AUSTRAC under a production notice. The production obligation attaches to the firm as a reporting entity, and the Act does not create a privilege exception for compliance documentation of this nature.

Staff Training in a Law Firm

Annual AML/CTF training is mandatory for all law firm staff in roles with compliance exposure — which encompasses partners, solicitors, paralegals, trust account managers, and any administrative staff who interact with clients in relation to property or trust matters. The training obligation is not limited to senior staff.

The training must cover the regulatory framework, the typologies of money laundering relevant to legal services (particularly property transactions and trust structures), the CDD procedures in Part B, the enhanced due diligence triggers, the internal suspicious matter reporting process, and the tipping-off prohibition. For junior staff who handle client-provided documents, practical training on identifying red flags — inconsistencies in identity documents, unusual trust structures, bank statement anomalies — is particularly valuable.

New staff must receive training before commencing AML/CTF-sensitive duties, not at the firm's next annual training cycle. For law firms with associate turnover, maintaining an onboarding training module that covers essential CDD and escalation procedures prevents compliance gaps that accumulate between annual training events. Each training event — initial onboarding and annual refreshers — must be separately recorded in the training register with date, topics covered, trainer, and attendees.

How Tranche Supports Law Firm Compliance

Tranche's compliance wizard generates Part A and Part B program documentation calibrated to law firm operations. The wizard's risk assessment captures the specific risk factors relevant to legal practice — the mix of residential versus commercial property work, the proportion of offshore and complex-structure clients, and the volume of trust account activity — and incorporates those factors into the program's risk methodology.

The generated program includes Part B procedures specific to legal practice: client identification requirements for individuals, companies, and trusts; enhanced due diligence triggers for high-risk client types; SoW documentation requirements calibrated to transaction value and client risk; and ongoing monitoring procedures for long-term client relationships. The procedures are specific enough to guide staff behaviour without requiring compliance expertise to interpret.

For firms with a significant property practice that regularly receives client bank statements, Tranche's SoW analysis tool automates mathematical reconciliation, lump-sum detection, and PDF metadata audit — producing a structured compliance artefact that can be attached to the matter file and produced to AUSTRAC on request. The compliance calendar tracks the annual review cycle, training currency for each staff member, and open SMR register items, so the AMLRO has a single dashboard view of the firm's compliance posture across all required elements.

Generate your law firm AML/CTF program with Tranche

Generate your compliant AML/CTF program manual in under 30 minutes — no compliance lawyer required.

Get started with Tranche