AML/CTF and Tranche 2 FAQ

Tranche 2 extends AML/CTF obligations to newly regulated sectors, including accounting, real estate, legal and other professional services. Obligations started on 1 July 2026. Firms that were already providing designated services on that date must enrol with AUSTRAC by 29 July 2026; firms that start later must enrol within 28 days.

Firms that provide designated services under the AML/CTF Act, including many accounting and real estate businesses. If you are not sure whether your firm does, start with the readiness assessment.

Most firms need an AML/CTF program, an AML/CTF compliance officer (AMLCO), staff training, a customer due diligence (CDD) process, record-keeping controls, and a way to report suspicious matters where required.

No. duely is not approved, endorsed or certified by AUSTRAC. It is workflow software that helps firms organise their compliance work and keep audit-ready records.

No. duely helps you show the procedures you followed and the decisions you made. Your firm remains responsible for its own compliance judgements and approvals.

All five Tranche 2 verticals are live: accounting firms, real estate agencies, conveyancers, law firms, and jewellers and bullion dealers. Each has its own versioned program template and designated-service catalog, and the legal vertical includes the privilege-aware suspicious matter workflow.

You probably won't replace it. Most firms keep their existing search and document tools and add duely to hold the compliance record. AUSTRAC won't ask your search tool for the engagement file. They'll ask you.

A free tier can be a fair place to start. With duely you pay for the full record in one plan: automated identity verification, screening, suspicious matter XML export, versioned and hashed evidence packs, and management of your reliance partners. Compare that with what you would still have to build or buy around a free tier.

Import your existing customers from a CSV file, then upload documents as evidence. Most firms run duely alongside their existing tools for a quarter, then consolidate.

We track every Rule amendment and Starter Kit update, and the program templates for each industry are versioned. When the Rules change, you get a "what changed, what to do" comparison against your program.

Customer first. Due diligence (identity verification and screening) is done once per customer and attached to each engagement. Risk is assessed per engagement that includes a designated service, and every engagement goes through approval and keeps its own records and evidence.

Not in the Tranche 1 sense, and that is deliberate. Banks and remitters hold accounts, so they watch a continuous feed of transactions and alert on patterns in it. An accounting firm or a real estate agency holds no such feed, and the Act does not ask them to build one. For Tranche 2, obligations attach to the designated service you provide. Each engagement that includes a designated service carries its own risk assessment, and every engagement has its own approval and records, with the customer's CDD attached automatically. duely assesses risk at that level rather than surveilling a transaction stream. Ongoing due diligence still applies: a daily monitoring job queues customers whose screening is stale (refreshed every 6, 12 or 24 months by risk rating) or whose scheduled review is due, and trigger events flag a customer for re-review when something changes. That is review of the customer and the engagement, not transaction surveillance, and duely does not claim to detect suspicion automatically. The s41 judgment is the AMLCO's.

duely guides staff through electronic, documentary or manual verification. It records which method was used, the sources relied on and the evidence collected.

Yes. Automated identity verification is live and included, white-labelled as duely Verify. It is a hosted check covering liveness, document capture and face match, and the result and evidence are written straight into the engagement. Guided manual verification is available for cases where a hosted check isn't appropriate. Customers are screened against sanctions, PEP and adverse media, and screening can be re-run on demand at any time.

Screening runs against 130+ sanctions lists, with PEP data covering 230+ territories. Both Australian sources are included: the DFAT Consolidated List and the Listed Terrorist Organisations list, alongside OFAC, the EU, the UN and the UK's OFSI. Australian PEP coverage extends to relatives and close associates.

See every list we screen against

Yes. Identity documents from more than 200 countries and territories are supported, across passports, national ID cards, driver licences, residence permits and health insurance cards. The customer gets a link by email, signs the consent form, then verifies with their document and a selfie from their own phone, wherever they are. They do not need an Australian visa or a trip to Australia. Every document collected is checked for forgery and tampering, including signs that the image is a screenshot, a photo of another screen, or a digitally altered document. duely does not check a foreign document against the issuing country's database. The optional DVS check is available for Australian documents only. For every other country, duely captures and checks the document, and the decision to accept it remains yours. There is no additional fee for verifying a foreign document or for screening someone overseas; both are included in the subscription.

See the countries and documents supported

Both. Where you broker the sale, the Act names the seller and the buyer as customers of that designated service, so each goes through their own CDD with their own verification and evidence. A sale with two sellers and two buyers is four customer records on one transaction. Our guide to who is your customer in a property sale covers when each party becomes a customer, what happens at auction, and why an attorney signing for someone is recorded as a party rather than a customer.

Yes. Sanctions, PEP and adverse-media screening is independent of the verification path, so a documentary or manual verification is screened the same way an electronic one is. You can record the certified copy, your file note of the call, and any other evidence against the customer or the engagement. Each CDD review is versioned, so a later re-screen adds a record rather than overwriting the one you relied on at the time.

duely doesn't translate documents. Upload the accredited translation alongside the original and both sit on the same customer record, available in the evidence pack with the rest of the verification.

Not yet. duely currently sends secure document requests and upload links. A full self-service portal with login and dashboard is on the roadmap.

duely records customers and their beneficial owners, maps who controls the entity, and builds a structure profile for companies, trusts and partnerships, with your rationale and evidence attached to the engagement.

Yes. You build the structure and duely works out who the beneficial owners and controllers are, then requires CDD on each of them. Corporate trustees, directors, trustees, members and controllers are all handled. Company details come from an ABR lookup; ownership structure comes from an ASIC extract or manual entry. Overseas companies and foreign trusts can be recorded and mapped the same way, though the beneficial-owner validation rules are written to Australian requirements, so expect more of the ownership work by hand.

Yes, at two levels. Customer-level risk applies when you profile a customer. Engagement-level risk applies when you engage them on a designated service, using a question set drawn from the AUSTRAC starter kits. duely proposes a rating; the final rating is always your staff member's or AMLCO's decision, recorded as theirs. Where the rating comes out High, an ECDD case opens with Source of Funds, Source of Wealth and supporting documents, and an approver (the AMLCO, or a user with the Approver role) signs it off. A PEP answer, a confirmed sanctions hit or a failed identity verification also opens ECDD.

Yes. The risk assessment scores unfinanced purchases explicitly: a purchase without a mortgage is a medium risk factor, and physical currency of $50,000 or more is a high one. Where the assessment comes out High, duely opens an ECDD case automatically with Source of Funds, Source of Wealth and approver sign-off on the actions required. It is a guided step inside the engagement rather than something you have to remember.

Yes. duely has one plan and no Tranche 2 obligation is gated behind anything. It includes the AML/CTF program generated for your industry and versioned with an approval workflow, the compliance registers, an immutable audit trail per engagement with versioned evidence packs you can export, and retention management against the statutory seven-year period. Staff training modules with assignment and completion tracking are included too.

An evidence pack is a versioned export of the compliance record for an engagement: decisions, rationale, timestamps, approvals and supporting context. Each pack is hashed so any later change can be detected.

Suspicious matters are handled in a shadow case that only the AMLCO can see. It is kept out of shared engagement views to reduce the risk of tipping off.

duely prepares submission-ready records and an XML export for suspicious matter reports. It does not lodge reports with AUSTRAC: you submit through AUSTRAC Online and record the submission reference in duely.

duely is one plan: $59 a month for 30 customers a year and 3 users, with all the compliance functionality included. If you grow past 30 customers, duely adds flex customer slots at $3 a month each. Extra users are $9 a month each. There is no plan upgrade to buy. Two optional services are charged only when you choose to run them: a DVS document check at $8, and document intelligence at $3. All prices are in AUD and exclude GST.

There's no free trial, but you get full access from day one. You can cancel anytime from your billing settings and keep access to the end of your current billing period. The launch offer of a free first month ended in August 2026. Cancellation and refund terms are set out in our Refund and Cancellation Policy.

Yes. A card is required at signup and billing starts with your first subscription period. You can change the payment method or cancel anytime from your billing settings.

Yes. Cancel from your billing settings and you keep access to the end of the current billing period. There is no long-term contract. Outside the 14-day cooling-off period, the rest of a paid month is not refunded.

No. duely is billed monthly only, with no lock-in. Cancel from your billing settings and you keep access to the end of the current billing period.

You carry on working. When you activate a 31st customer, duely adds a flex slot at $3 a month and lets you know. The slot is added immediately and charged in full to your stored payment method, $3 for that month with no proration, then renews on your billing date. Five extra customers is $74 a month, ten is $89, twenty is $119. There is no higher plan to move to.

30 a year, counted from your subscription date. A customer takes one of your 30 included slots when you start their due diligence, and keeps it until your anniversary even if their engagement concludes earlier. Included slots are one-time use, so concluding an engagement does not free one, and a customer who comes back for another engagement in the same year goes back to their own included slot. On the anniversary duely re-counts: customers with an open engagement fill the 30 included slots first, and any flex slots you no longer need are cancelled automatically. Past customers do not keep adding to your bill.

You don't need to do anything. When their last engagement concludes they become inactive automatically: scheduled re-reviews stop (monitoring becomes trigger-only) and their records stay in duely for the seven-year retention period. If they were in one of your 30 included slots, that slot is counted until your anniversary. If they were in a flex slot, the slot is free straight away for your next customer, or you can cancel it and it stops billing from your next cycle. Flex slots are not reserved, so a returning customer takes whichever flex slot is free, or a new one is added.

No. A company, trust, partnership or SMSF with up to 6 relevant individuals uses one customer slot. Each further group of up to 6 relevant individuals uses one more, so a partnership with 9 partners uses two. A relevant individual is a person you must keep in duely for CDD, verification or screening, such as a director, trustee, beneficial owner or controller, not a contact person. The same rule applies to included slots and flex slots.

Count the customers you take through CDD in a year. For an accounting firm that is your active client list, so a firm with 45 clients would hold about 15 flex slots and pay $104 a month. For a real estate agency count every party: a sale with two sellers and two buyers is four customers, and a party only needs a slot while their sale is open, so an agency doing 60 sales a year would hold around 35 flex slots at a time and pay about $164 a month. A company, trust or SMSF counts once, or one more for each 6 people beyond the first 6 you must verify. The pricing page has an estimator. You can always start at $59, and duely adds flex customer slots only when you need them.

There is no monthly allowance and no per-check fee. Biometric ID verification through duely Verify (document capture, liveness and face match), company lookups and sanctions, PEP and adverse-media screening are all included, under our fair-usage policy. What the subscription counts is customer slots, not how often you verify. The one verification step with a per-check price is a DVS check at $8, because it queries the government record of the document.

A Document Verification Service (DVS) check confirms an Australian document with the agency that issued it. It is optional. It costs $8 plus GST per document, not per person, and is billed as used. duely shows the charge before the check runs and adds it to your monthly invoice.

No. There is no setup fee and no minimum volume, and the subscription runs month to month, so you can leave at the end of any billing period.

Two optional services, and neither is needed to meet your obligations. Document Verification Service (DVS) checks are $8 plus GST per document, billed as used (see the question above). Document intelligence, which reads a trust deed or ASIC extract and drafts the beneficial owners for your review, is $3 per use and in final testing. Both show their price before they run. You are charged when a document intelligence run completes, even if you then edit the result, and not charged if it fails. Everything else is included in the subscription.

No. duely bills your firm, and your firm decides whether to absorb the cost, add it to your own invoice or include it in your fee. When you run a DVS check or document intelligence you can mark it as a client-recoverable cost, and duely keeps a record of those for your firm's own books. duely does not decide whether it is a disbursement for you.

You keep full access to the end of your paid period, then 90 days of read-only access to download your records. Every evidence pack (PDF, versioned and integrity-hashed), each customer's history report (PDF), every AML program version (PDF), your uploaded documents and your training records (CSV) can be downloaded at any time, including during those 90 days. The audit log can be viewed per engagement and firm-wide, and we will supply it as CSV on request. After the 90 days your records are deleted, so export within that window. duely is not a seven-year archive after you leave.

Engagement records, documents and evidence packs are stored in Australian data centres (BinaryLane, Sydney, and Microsoft Azure Australia East). Identity document and biometric verification is performed by our verification provider, white-labelled as duely Verify, outside Australia in the European Union on a process-and-purge basis: the live selfie captured for face-match is destroyed within 7 days of capture (or immediately if a staff member records an override), and only the face-match verdict, document hash, and document row survive as the statutory record. Sanctions, PEP, and adverse-media screening runs through a separate screening provider, dilisense, in Switzerland, with only the person's name and date of birth transmitted. The resulting evidence for both is stored back in Australia. The verification provider is GDPR-compliant and ISO 27001 / SOC 2 (Type I) certified.

Only AMLCO-authorised users can access suspicious matter workflows and related records. No suspicious matter indicators appear on shared dashboards, engagement lists, exports or notifications.

No. duely provides workflow, record-keeping and evidence tools. Firms remain responsible for legal and compliance judgement.