AML/CTF compliance for law firms
Since 1 July 2026, Australian law firms have been reporting entities under the AML/CTF Act. Trust account work, conveyancing and company structuring all need a documented compliance record that does not break privilege. In duely, the AML/CTF compliance officer (AMLCO) completes a privilege assessment before every suspicious matter report (SMR), and that assessment decides which of the three statutory filing paths applies.
How an engagement runs in duely
The screens your team works in
These are real screens from duely, with sample data. The app calls each matter an engagement.
Verify and screen.Identity and screening results sit side by side for each person, with the date and the method used.
Rate the risk.The answers produce a rating and show what drove it. A High rating opens enhanced due diligence.
Approve.An approver signs off before the work goes ahead. The approval stays on the record.
Generate the pack.One PDF, whenever you need it. Each version has its own SHA-256 hash, so any later change to the file can be detected.
What makes Tranche 2 hard for law firms, and how duely handles it
-
Legal professional privilege
AML/CTF disclosure obligations and legal professional privilege can pull in different directions. Your workflow has to respect privilege and still meet the reporting rules. General-purpose compliance tools often don't handle this.
A privilege assessment in front of every SMR
Before any suspicious matter report (SMR) can be submitted, the AMLCO records whether the information is not, partly or wholly privileged. That decision sets the filing path and its deadline. How privilege works under Tranche 2
-
Trust account complexity
Solicitors' trust accounts hold significant funds across many engagements. You need to spot reportable transactions, meet threshold transaction report (TTR) obligations for cash receipts, and keep an evidence trail for every trust account movement. That load is specific to legal practice.
A report record for trust account cash
Flag a cash receipt at the $10,000 threshold and duely captures the threshold transaction report (TTR) details against the engagement. Your team lodges it with AUSTRAC and records the reference. See AUSTRAC reporting
-
Complex customer structures
Law firms often act for customers with layered corporate structures, trusts and overseas entities. Identifying the beneficial owners and controllers in these arrangements takes a consistent process and a full written record.
Entity structure mapping
Map layered companies and trusts, identify beneficial owners at the 25% threshold, and record controllers, trustees, directors and appointors, with your reasoning when ownership information cannot be obtained.
-
High-value transactions
Property settlements, commercial acquisitions and cross-border transactions often involve large sums. High-value engagements attract more regulatory scrutiny and often trigger enhanced due diligence.
Risk assessed on every engagement
Each engagement gets its own risk assessment. A High rating or another trigger opens enhanced due diligence (ECDD), and an approver signs off before work proceeds. See risk assessment
Your client verifies on their own phone
Send a link. They give consent, scan an ID document and take a selfie, and the result lands on their record. Nobody has to come into the office.
- Takes about a minute
- An ID check and a face check, both on their phone.
- Documents from 200+ countries
- Identity documents from more than 200 countries and territories.
- Done once
- Each client's due diligence is reused on every matter.
Also live now, and what's still coming
Customer-first compliance
Each engagement is its own compliance unit. Whether it is a property conveyance, a commercial acquisition or a trust administration, duely records due diligence once per customer, then gives each engagement its own risk assessment, approval and evidence trail.
Audit-ready evidence packs
Generate a tamper-evident evidence pack for any engagement at any time. Every compliance decision, verification result and risk assessment is held in a versioned snapshot. Two profiles control what each role sees: Standard, and the AMLCO-only Sensitive profile.
Pre-commencement CDD
Customers already receiving designated services when Tranche 2 commenced on 1 July 2026 get a recorded transitional status. Treatment is tiered by risk, deferral decisions are documented, and full CDD starts automatically when a defined trigger event occurs.
Dual risk assessment
On the roadmap: a dual risk assessment (firm level plus engagement level) with risk factors calibrated for legal practice and approval routing to a senior partner. The general engagement-level risk wizard and ECDD workflow are available now.
Getting started
Everything for law firms is live now, so you can start on your firm's own set-up today.
Assess your readiness
Take the 2-minute assessment to see whether Tranche 2 applies to your firm and where the gaps are.
Build your AML/CTF program
Generate your AML/CTF program from the legal template pack, with privilege-aware reporting procedures included, and get it approved.
Run your first engagement
Scope an engagement, complete CDD and see how the privilege assessment works before an SMR, with evidence packs ready for audit.
Start structuring your firm's Tranche 2 compliance
Book a walkthrough of the privilege-aware SMR workflow and everything else duely does for law firms, or start with the legal template pack.