AUSTRAC Regulatory and industry guide to 18 designated service sectors

AUSTRAC performs both financial intelligence and AML/CTF regulatory functions. The assessment of whether an entity is a reporting entity starts with the designated services listed in section 6 of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, and then considers the nature of the business, statutory clients, monetary thresholds, exclusions and geographical connection. The business name “investment company”, “jewellery shop” or “accounting firm” does not itself determine whether the entity is regulated.Current text of the legislation in force

Enrolment means joining the reporting entities roll; registration is an additional market-entry process for remittance and certain virtual asset services. AAN is an AUSTRAC account number; submitting forms and receiving a receipt and AAN does not mean that a specific registration has been approved. AFSL, ACL, APRA authorisations and state-level occupational licences must still be obtained separately. AUSTRAC does not endorse product returns, asset security, bank account opening or the quality of operations.Registration procedure ASIC licensing boundaries

• First map customers, contracts, funds and asset flows, then assess each against section 6.
• The 18 industry groups may overlap; you cannot simply choose the cheapest or broadest registration name.
• Public-facing copy must not claim “AUSTRAC-certified platform”, “government-guaranteed returns” or “registration means holding all financial licences”.

New governance, ongoing due diligence and related requirements for existing regulated entities apply from 31 March 2026. The main obligations for newly added real estate, precious-item and professional services apply from 1 July 2026. Existing registered DCE automatically transition to VASP on 31 March; a repeat application is not required just because the name has changed. The transition dates differ for existing Item 50A businesses and new crypto-to-crypto exchange, transfer, custody and other services.Explanation of the 2026 transition rules

31 March 2029 is an important future date for international value transfer service reporting (IVTS) and reporting of value transfers involving unverified self-hosted wallets; do not state that these have been fully implemented in 2026. Eligible existing IFTI reporting entities may elect an alternative transfer date between 31 March 2029 and 30 September; separate restrictions apply to arrangements involving international value transfers of virtual assets. The legacy ACIP transition for initial CDD applies only to entities registered on 30 March 2026 and their documented client categories; it does not mean that all obligations are deferred for three years.Transition scope and exceptions

• The transition registration deadline of 29 July 2026 for new services has passed. Address the risk of late registration rather than treating it as a future preparation period.
• Entities already registered in 2026 do not need to re-enrol because of the reforms; their details and service scope must still be updated.
• Future ASIC fund management NTA changes take effect from 1 July 2027 and are not included in the current 2026 capital thresholds.

A territorial connection will generally exist if any one of three circumstances applies: designated services are provided through an Australian permanent establishment; an Australian resident provides services through its permanent establishment overseas; or a subsidiary of an Australian resident company provides services through its permanent establishment overseas. RNP operating an Australian remittance-dealer network is subject to special rules and is not limited to the ordinary territorial-connection test. A permanent establishment may include an agent or mobile business and should not be understood as requiring a fixed office.Official explanation of geographical connection

Having Australian customers, an Australian mailing address or an Australian bank account does not, by itself, establish or rule out jurisdiction. Online platforms should check where the business is actually carried on, whether services are provided through local accounts, whether agents participate in the relevant activities, and whether the servers are owned and operated by the business. An overseas business is not necessarily required to establish an Australian subsidiary first; the Corporations Act and AML/CTF liability should be checked separately when choosing a local company, a branch of a foreign company or an offshore structure.Examples of online services, addresses and accounts

• Provide details of the actual place of business, local agent, servers and the intended use of funds accounts.
• Assess the Australian company law director residency requirement separately from the definition of residency under the AML/CTF Act.
• Reporting, personnel and other obligations for overseas branches may be subject to specific rules; Australian domestic requirements should not simply be applied wholesale.

The financial sector mainly corresponds to Table1; bullion and valuables correspond to Table2; gambling corresponds to Table3; Table4 is the entry point for services prescribed by regulations; real estate agency services and commercial sales without an independent intermediary correspond to Table5; and the nine professional services correspond to Table6. The 18 groups are not the statutory number of items, nor can the financial services table in section 6 be simplified to “54 categories in Schedule One”.The six statutory tables in section 6

The same entity may provide services covered by multiple tables. For example, an accounting firm that both incorporates client companies, provides registered addresses and arranges financing may trigger Table 6 Items 4, 6 and 9. Conversely, general accounting and tax return preparation, acting solely in litigation, ordinary retail jewellery card transactions or letting residential property do not automatically trigger every obligation merely because of the industry. For each service, recording why it is covered or excluded is more important than registering an industry label.Scope of professional services

• Bank deposits; fiat currency exchange; lending and financing; securities investment; derivatives and foreign exchange; insurance; superannuation.
• Financial custody and safekeeping; stored-value payments; bullion trading; precious metal and gemstone products; gambling and betting.
• Real estate; legal conveyancing; accounting; trustee company services; corporate finance intermediation; cash remuneration and other specified financial services.

Accurately defining the business boundary can reduce the cost of missed enrolments, incorrect registrations and unnecessary build-out. Compliance materials can help explain the business model to banks, payment partners, investors and acquirers, providing evidence of client onboarding, fund tracing and the handling of anomalies. Controls proportionate to the scale of the business are more practical than buying untailored templates.

These are the commercial benefits of compliance management; they do not mean that registration guarantees account opening, contracts, financing, profitability or licences in other countries. Rengangyongsheng (Hong Kong) Limited can provide business assessments, bilingual document preparation, application coordination, systems requirements, training and ongoing support. The final decision rests with the regulator; legal practice, tax agent services and formal audits should be undertaken by appropriately qualified professionals.

• Service delivery can cover an agreed scope analysis, application documents, risk assessment, training and a maintenance calendar.
• Do not use the number of registrations, regulatory badges or unverifiable success rates as substitutes for evidence of capability.
• Before acquisition, turn compliance gaps into remediation budgets and completion conditions.

General enrolment mainly identifies the entity, the designated services it provides, where it operates, its expected business scale and its key personnel. First prepare details of the company or other legal entity, ACN／ABN or applicable foreign registration information, organisational structure, directors, shareholders and ultimate control, business and transaction processes, contact address, and compliance officer and management details. Not all general enrolments can be described as approval of a full financial licence application.Official registration overview

Additional RSP／VASP registration requires more detailed evidence of compliance preparedness, personnel experience, criminal and regulatory records, relevant partners, countries of operation, risk management, and the likelihood of actually providing a registrable service. The AML/CTF plan is a pre-commencement compliance document; AUSTRAC may request further material for review. This does not mean that all ordinary registrations require uploading the same set of attachments or waiting for the plan to be “certified”.Additional registration information and assessment factors

• Entity registration certificate, constitution or trust deed, partnership agreement and organisational chart.
• Shareholdings and control chain through to natural persons, personnel identities and career histories, and fit and proper assessment.
• Contracts, customer scope, product descriptions, country channels and funds/asset flow diagrams.
• ML/TF/PF risk assessment, AML/CTF policy, CDD procedures, monitoring rules and reporting responsibility matrix.
• Evidence of office and agent arrangements, technology and outsourcing contracts, training arrangements, budget and any other applicable licences.

AUSTRAC does not impose uniform requirements across all 18 sectors for local shareholder percentages, having two directors, or a compliance officer holding a CAMS certificate. Actual shareholders and controllers must be disclosed truthfully, and relevant persons are subject to due diligence proportionate to the business; RSP / VASP registration considers key personnel’s criminal, regulatory and legal compliance history. Directors and senior executives cannot transfer operational responsibility to nominal personnel and then take no part in governance.Registration assessment factors

Generally, appoint an AML/CTF compliance officer within 28 days after first providing a designated service and notify AUSTRAC within 14 days of the appointment; arrange a replacement and give notice if the officer leaves or no longer meets the requirements. A compliance officer for services provided by a permanent establishment in Australia must be an Australian resident, hold a management-level position and be a fit and proper person. The role may be outsourced and need not be held by a full-time employee, but the officer must have substantive authority, independence, resources and professional support, and report to the governing body at least every 12 months. Item 54 services or small gambling venues covered by applicable exemptions are subject to separate considerations.Compliance officer qualifications and duties

If an Australian Pty Ltd is chosen, it will generally need at least one director who ordinarily resides in Australia. A public company must have at least three directors, at least two of whom ordinarily reside in Australia, and at least one company secretary who ordinarily resides in Australia. These are requirements under company law, not AUSTRAC licensing standards. Directors should apply for their own ABRS Director ID before appointment; an agent cannot apply on their behalf.ASIC company officer rules ABRS director ID

• Keep the shareholder control chain, directors' consents and personnel screening results.
• Distinguish the authority of directors, senior managers, compliance officers and authorised reporting administrators.
• Prepare leave cover and succession arrangements for the compliance officer; a nominal appointment alone is not sufficient.
• Disclose conflicts of interest, and have the governing body approve the risk assessment and policies and retain records.

A company’s registered office, actual place of business, customer service locations and location of compliance records are separate matters. An Australian company’s registered office must meet ASIC requirements; a virtual address is not the same as an actual permanent business establishment and cannot replace state premises or professional licensing requirements. A provider of registered office services may itself become a reporting entity under Table6 Item9.Geographical connection Professional registered-address services

AUSTRAC is not a prudential capital regulator and does not set a uniform industry-wide minimum share capital / NTA figure. AFSL entities determine cash needs, net assets and possible NTA by reference to their services, client assets and products; APRA entities are subject to their own prudential rules. Registered share capital, client trust account balances, settlement prepayments, bank security deposits and regulatory capital must not be conflated. “A$1 registered capital” cannot be taken to mean that a financial services business has sufficient resources.ASIC RG166

• Show issued/paid-up share capital, net assets, applicable NTA, cash budget and segregated client assets separately in the funding table.
• Confirm lease arrangements, occupier consent, receipt of mail and access to records.
• Records stored through outsourcing or in the cloud should remain accessible to AUSTRAC, while privacy and data security are also safeguarded.

The current AML/CTF programme includes a written risk assessment and corresponding policies. The old Part A／Part B should no longer be described as the statutory structure for all new applications. Governance, customer, product and service, delivery channel, country and new technology risks must cover money laundering, terrorism financing and proliferation financing. The risk assessment and policies should be approved by the relevant senior management and notified to the governing body.Current programme review rules

A compliance programme is more than PDF. It should explain who collects and verifies customer information, how high-risk customers are escalated, who assesses suspicious matters, how reports are made, how systems are tested, how staff are trained, how outsourcing is overseen, and how regulatory requests and independent assessment findings are handled. Small, low-complexity entities may use and tailor a suitable official starter kit; larger or high-volume businesses generally need more comprehensive systems and personnel.Records and evidence of implementation

• Complete a current risk assessment and applicable policies before commencing operations; do not wait until after registration.
• Turn staff role due diligence, training, customer onboarding, monitoring and reporting into workable procedures.
• Keep records of versions, approvals, system testing and outsourcing oversight, not just templates.
• Review the risk assessment before a material business change that can be controlled.

Initial CDD is usually completed before providing a designated service. Reasonable steps must be taken to establish the customer’s identity, the identity and authority of any agent, on whose behalf the service is accepted, the beneficial owners of non-individual customers, the purpose of the transaction or relationship, and PEP/targeted sanctions status. Beneficial owners include natural persons who ultimately own, directly or indirectly, 25% or more of an interest or exercise control by other means; checks are not limited to persons owning “more than 25%”. Multi-layered ownership must be traced through and the basis for identifying control recorded.Official explanation of initial CDD

Simplified CDD may be used for low-risk customers where no enhanced CDD trigger applies and appropriate policies are in place; there is no need to apply for AUSTRAC approval for each customer. This does not exempt the business from due diligence. Overseas PEP, high-risk domestic or international organisation PEP, and SMR customers receiving ongoing services, among others, must be subject to enhanced measures under the statutory rules. Do not automatically state that all non-face-to-face customers, all NPO, all grey-list connections or all domestic PEP are subject to the same mandatory conclusion. Any permitted delayed or alternative identification, and transition arrangements for existing customers, must also be documented in accordance with the applicable conditions.Low risk and reasonable grounds Continue servicing SMR clients

• Individuals may be verified using reliable independent identity documents/data; for companies, use registry information, the constitution, control chain and authorisations.
• For a trust, check the trustee, settlor, beneficiaries and control arrangements; do not accept only a company registration certificate.
• Continually CDD by comparing actual transactions with expected behaviour; update risk assessments and information when material changes occur.
• Do not commence services where a reasonable basis for establishing identity cannot be formed under the applicable rules; also assess SMR. Do not simply reject every client without standard identity documents.

Monitoring rules must reflect industry risks. Remittances: focus on frequent small transactions and third-party payments. Securities: focus on asset / account transfers. Gambling: focus on low betting followed by high cash payouts. Real estate: focus on third-party funds and unusual consideration. Precious goods: focus on related-party splitting and mixed cash / virtual asset payments. Small businesses may use effective manual logs; large, high-volume businesses need appropriate automation. The law does not impose a uniform requirement to purchase a system from a particular brand.SMR Identification and Escalation Process

Digital identity, on-chain analysis, sanctions databases and AI alerts can help, but data reliability, missed and false alerts, human review, access permissions and audit trails should be tested. Outsourcing CDD, monitoring or a compliance officer does not transfer the reporting entity’s legal responsibility. Reliance on third-party identification and general service outsourcing are different mechanisms; contracts, due diligence, access rights, oversight and exit arrangements should be in place.CDD Independent reliable data Third-party records

• The alert log records the trigger time, facts, reviewer, time the suspicion was formed and final report reference number.
• Contingency plans are required for software failures, delays in updating lists, missed reporting and backlogs.
• Complete a risk review and staff training before business expansion, changes of country or deployment of new technology.

Reasonable suspicion is assessed against the standard of an objectively reasonable person; proof that a crime has occurred is not required. A client or prospective client requesting, attempting or planning to receive a designated service may also trigger SMR, even if the service is ultimately refused or the transaction does not proceed. A suspicion of terrorism financing must be reported within 24 hours of forming the suspicion; other suspicions must be reported within three business days after the day on which the suspicion is formed. Reporting cannot be delayed for further investigation, management approval or enhanced CDD.SMR Scope and statutory time limits

Where legal professional privilege (LPP) is involved, distinguish information that is genuinely protected by privilege from information that is not. Some information may be protected by LPP, but the remaining SMR and applicable LPP forms must still be submitted; in qualifying non-terrorism financing cases, the LPP reporting deadline may be five business days after the day the suspicion is formed. Do not treat client confidentiality obligations or lawyer status as an industry-wide exemption. Disclosing SMR information where it could reasonably be expected to prejudice an investigation may constitute the crime of tipping off.LPP, deadlines and tipping off

• 24 hours applies to terrorist financing, not three business days.
• There is no minimum amount; a new suspicion must be reported again and linked to the previous report.
• Do not enter TFN or fictitious placeholder information in SMR.
• If deciding to continue providing services, manage risk and fulfil enhanced CDD; if deciding to exit, avoid disclosing an investigation.

Where a designated service involves physically receiving or paying AUD 10,000 or more in banknotes or coins, or the equivalent in foreign currency, an TTR is generally required within ten business days after the transaction day. Bank transfers, cheques and card payments do not automatically trigger TTR merely because they reach AUD 10,000; virtual assets are not physical cash. If a customer deposits cash directly into a service provider’s bank account, the bank receiving the cash may be responsible for TTR, rather than the service provider that did not handle the banknotes.TTR official examples and time limits

TTR is generally assessed by reference to each separate payment; separate payments made on the same day should not mechanically be aggregated. However, deliberate splitting to evade TTR may trigger SMR. The designated service trigger for precious metal and gemstone products under Table 2 Item 2 is different: it requires the aggregation of physical cash and virtual asset amounts for purchases that are related or appear to be related. For example, related purchases of jewellery involving A$6,000 in cash and A$4,000 in virtual assets may trigger regulation, but do not automatically result in TTR where no individual cash payment is A$10,000.Statutory services involving valuables Independent transactions and splitting

• Cash under TTR includes both payments made and received; consider refunds, redemptions and agent settlements.
• Check the specific exemptions under ADI for ADI, ESA and Item54 arrangements, among others, under TTR.
• Service triggers, customer identification, cash reporting and internal risk limits must use different fields and criteria.

An institution making cross-border transfers should assess its IFTI reporting obligations according to its role as a financial institution, remitter or intermediary; not every business that pays overseas suppliers becomes a IFTI reporting entity. The current IFTI should continue to apply and should not be switched to IVTS prematurely. Reporting is generally due within ten business days after the day the relevant cross-border instruction is sent or received, with no uniform minimum threshold. A transfer solely of virtual assets, without transferring money/property, may not require IFTI, but using virtual assets to settle with another remitter is not automatically exempt.Current IFTI and future IVTS

The Travel Rule concerns the collection, verification and transmission of sender and recipient information in a transfer chain. It is a separate regime from TTR, SMR and the future IVTS. New obligations relating to virtual asset services are no longer subject to the deferral arrangements that applied before July 2026, and must be implemented according to the specific service role and applicable exemptions. No such deferral has been verified for special reporting on self-hosted wallets until the 2029 milestone; however, this does not suspend SMR, CDD or risk management in 2026.Transition for the virtual asset Travel Rule

• Specify the ordering, beneficiary and intermediary roles and reporting responsibilities.
• Retain records of network partners, handling of missing information and delivery.
• Continue using the applicable IFTI legacy regime and assess the technology and data budget for the 2029 migration.

Keep general transaction records for seven years from the date they are made; transaction documents provided by customers for seven years from the date they are received; CDD records generally for seven years from completion of an occasional transaction or the end of a business relationship; and programme records from their creation until seven years after they are no longer relevant to demonstrating compliance with Part 1A. Do not describe all documents as being retained for “seven years after the transaction” or “seven years after updating”. Records must be sufficient to reconstruct transactions and demonstrate that decisions and controls were implemented.Different categories, different starting points

Records may be kept on paper or electronically, on-site or off-site, provided they can be retrieved, remain intact and access to sensitive information is restricted. Reporting entities may be required to comply with the Privacy Act even if they are small businesses. The AML/CTF Act does not generally require a complete scan of an identity document to be retained; what is needed is the information actually verified, the method and result, and reliable data supporting the verification. Other laws or the specific business may impose additional requirements.Privacy and identity document records

• Retain current and historical relevant risk assessments, policies, CDD, transaction, training, reporting and independent assessment evidence.
• Restrict access to SMR files to prevent tipping off.
• Contracts should provide for cloud and third-party data export, backup, access and exit handover.

AUSTRAC annual reporting has changed to a financial-year basis. The next reporting period is 1 July 2026 to 30 June 2027, with submission required during the 1 July to 30 September 2027 window. Thereafter, reports will generally cover the preceding financial year and be submitted from July to September each year; the former January-to-March rule can no longer be presented as the current position. Specific reporting exemptions apply to cases such as providing only Item54 arrangement services, acting solely as a RNP agent with no other designated services, and small operators with no more than 15 gaming machine entitlements and no other services.Official annual reporting arrangements

No. Not all enrolled entities pay a fixed annual fee. Industry levies currently generally affect larger and medium-sized institutions with annual revenue of A$100 million or more, or relatively high reporting volumes or values. The amount should be confirmed against the applicable levy rules and official invoice. Account, software, company registration, professional licensing, consultancy and independent assessment costs are also distinct from the levy. Do not rely on the unverified table stating “regulatory fees of hundreds to thousands of dollars a year for small businesses”.Industry levy

• Set a reminder for the reporting deadline of 30 September 2027 and an approval process for extracting data in advance.
• Report to the governing body on compliance at least every 12 months; this is separate from the AUSTRAC annual form.
• Keep income and transaction reporting information accurate to avoid miscalculated levies.

Review the risk assessment and policies comprehensively at least once every three years. Significant business changes, regulatory risk notices and adverse findings from an independent assessment may require an earlier review. Independent assessments are also generally required at least once every three years, with frequency appropriate to the scale and risk of the business; the original draft's claim of a “mandatory audit every two years” must not continue to be presented as a general requirement. The assessor may be an internal or external person, but must be independent of the design and implementation of the programme and day-to-day compliance; the same consultant should not audit a programme they prepared.Review rules Independent assessment rules

For a first evaluation of newly covered entities or entities that previously fell only under Item54, staging is based on whether the last two digits of AAN are odd or even: odd-odd by 30 June 2029; odd-even by 31 December 2029; even-even by 30 June 2030; even-odd by 31 December 2030. An entity already registered and previously subject to an independent review will generally schedule its first new evaluation for the later of four years after its most recent review and 31 March 2027. This is a specific first-evaluation transition, not a permanent four- or five-year audit cycle.Calculating the initial assessment transition

• The policy specifies the assessment frequency, choice of independence, scope, written report and responsibility for remediation.
• Reports are submitted to the governing body and approving senior executives, with deficiencies and the effectiveness of remediation and controls tracked.
• Internal review cannot replace independent assessment; independent assessment cannot replace regulatory inspection.

First determine the business, designated services, customer and territorial connections, then identify other operating licences and the entity structure; prepare governance, personnel, premises, funding and compliance controls. Set up an AUSTRAC Online account and authorisations, and complete general enrolment; a separate registration application is required only if providing registrable remittance or virtual asset services. System receipts, AAN, Enrolment confirmations and Registration approvals are different documents and should be filed separately.Registration steps Registration steps

The 28-day period for general enrolment does not remove the requirement to have an AML/CTF programme and applicable CDD in place before commencing business. In principle, RSP／VASP must obtain registration approval before providing registrable services. New virtual asset services that met the 2026 transitional conditions could previously continue while awaiting a decision after applying in time, but the deadline has passed as at the date of this guide. This does not apply to platforms newly established now that have not been approved. Any commercial project schedule must allow for the time required for other licences, banking partnerships and systems to go live.Restrictions on operating before registration

• Step 1: Classification and licensing matrix.
• Step 2: Prepare the entity, shareholders, personnel, address and budget.
• Step 3: Approve the risk assessment and implement CDD, monitoring, reporting and record-keeping.
• Step 4: Create an account, enrol and submit any applicable additional registrations.
• Step 5: Respond to requests for further information, and check any attached conditions and final confirmation.
• Step 6: Launch within the approved scope and establish a calendar for reporting, training, updates and renewals.

AUSTRAC states that registration assessments for RSP／VASP may take up to 90 days. Where further information is requested, the 90-day period restarts from the date that information is received. This procedural explanation cannot be presented as “guaranteed approval within 90 days”. This guide has not verified a uniform completion target for general enrolment, so it cannot claim “guaranteed completion within a fixed number of working days”. 28 days is the application deadline, 14 days applies to certain change or notification deadlines, and three years is the applicable registration term; these periods have different meanings.Official registration assessment period

Commercial preparation can be budgeted according to the due diligence and systems workload: for projects involving only general designated services, an existing entity and clear information, preparation is usually measured in weeks; projects involving new cross-border services, multi-layered ownership, network membership, client funds or virtual asset technology systems should allow months for preparation. ‘Weeks/months’ here are examples for consultancy scheduling, not statistical average approval times, and exclude regulatory requests for further information, professional licensing or bank decisions that cannot be estimated.

• Quotes separately itemise information preparation, system implementation, government processes and third-party dependencies.
• Any “expedited” service refers only to the consultant’s internal work; it does not claim access to a regulatory fast track.
• If an application is refused or made subject to conditions, reassess the service scope and business model.

AUSTRAC Enrolment or registration cannot be transferred to another legal entity as a standalone asset. If a share acquisition leaves the original entity in place, check the validity and conditions of its enrolment and registration, its personnel, compliance history and actual business, and promptly update details of new controllers and key personnel. Where an asset / business sale transfers operations to a new ABN entity, the new entity will generally need to enrol independently and, where applicable, obtain registration; it cannot simply start operating by taking over AAN, passwords or the seller’s bank account.New legal entities and renewals Changes to registration

Due diligence should request a current list of business activities and licences, the ownership and control chain, registration confirmations and conditions, police checks, historical compliance and transaction reports, independent assessments and remediation, client CDD, SMR access controls, and contracts with partner banks and outsourced providers. The purchaser should include the retention or replacement of the compliance officer, transfer of systems and data, partner consent, approval of other licences and a remediation budget in the completion conditions, avoiding the purchase of an empty shell that has a number but cannot operate.

• AUSTRAC general information and registration-related changes are usually updated within 14 days; an RNP must update information within 7 days of receiving notification of agent changes.
• ASIC Changes to most company details must generally be notified within 28 days; this is a separate timeframe.
• New countries, services, beneficial owners, key personnel or enforcement matters must be assessed and disclosed.
• SMR and the transfer of sensitive files require legal assessment, restricted access and auditable procedures.
• Bank accounts, licences, partner contracts and customer data are not automatically transferable.

General enrolment is not subject to uniform renewal every three years; RSP／VASP registration is usually valid for three years, and renewal may be applied for within 90 days before expiry. Following a timely application, registration may continue under the statutory arrangements until a decision is made. If registration lapses because it was not renewed in time, registrable services must not continue; a fresh application is treated as a new application. Registration may be subject to conditions, suspended or cancelled, so check immediately whether a particular business activity may continue.Renewal and registration decisions

If you cease operations, sell, merge or provide none of the designated services for an entire reporting period, you must still complete the relevant required reports and apply to be removed from the roll/register; simply deregistering the company or not logging into the system is not enough. Some reporting obligations continue before removal, and removal does not automatically end record-keeping requirements for historical transactions and CDD. Prepare an exit plan covering customer assets, balances, complaints, termination of partner relationships and custody of records.Annual reporting after cessation Removal from the register

• Set a reminder 90 days before registration expiry and review personnel, countries and business information.
• Maintain general enrolments, company annual reviews, professional licence renewals and AUSTRAC registration renewals separately.
• After exit, specify the records custodian, access address and statutory retention end date.

AUSTRAC may conduct desk-based reviews, onsite inspections, data analysis and statutory examinations, and may take action such as issuing remedial directions or infringement notices, entering enforceable undertakings, taking registration action or seeking civil penalties from a court. The consequences of a breach must be assessed separately by reference to the current statutory provision, the person or entity, the penalty unit and the conduct. Do not apply the source text’s conflicting and outdated uniform fixed Australian-dollar penalty figures. Criminal offences also have different elements and should not all be described as carrying “five years’ imprisonment”.Current enforcement provisions

On receiving a regulatory notice, confirm the authority and deadline, preserve original data, involve governance personnel, the compliance officer and qualified legal counsel, and provide accurate information; do not fabricate records. If under-reporting, CDD or a system defect is identified, establish the affected scope, causes, remediation and preventative measures, consider voluntary disclosure and monitor its effectiveness. Voluntary disclosure may demonstrate a cooperative approach, but does not guarantee immunity from penalties or a reduction in penalties.Obligation to remedy adverse findings

• Establish a register of regulatory requests, responsible persons, deadlines, submitted versions and legal privilege reviews.
• The remediation plan should specify each deficiency, sample, owner, date, system change and retest result.
• Avoid claiming that being inspected amounts to certification or that all remediation has been approved by the regulator.

Drafted explanation: Drew Tang (Mr Tang / Drew) · Business Manager. Rengangyongsheng (Hong Kong) Limited, English name Rengangyongsheng (Hong Kong) Limited. This article is intended to explain Australian regulatory and corporate compliance pathways on afsl8.com. Its content is current as at 5 November 2026; direct links are retained for official facts so readers and information retrieval systems can verify them.

RGYS is a third-party application and compliance service provider, not ASIC, AUSTRAC or APRA, and does not make decisions on behalf of regulators. It can assist with business assessments, preparation of English-language materials, coordination of enrolment and applicable registration, acquisition due diligence, training and ongoing maintenance. Formal legal, tax and audit work, and regulated activities, should be undertaken by appropriately qualified persons. This material does not constitute legal, tax or investment advice for any particular case and does not guarantee approval, bank account opening or commercial outcomes. Independent judgement should be exercised by reference to the latest legislation and the actual contracts.

• Service discussions should clearly identify the actual applicant, scope of business, deliverables, outsourcing and fees.
• The original source contact details may be used for enquiries with the user’s authorisation. This research does not invent licences, client case studies, credentials or approval records.
• See the following 18 branches for specific industry documents, personnel and capital boundaries.

Complete guides to each subtype

The following are branches covering business activities, products or corporate structures; not every item corresponds to a separate statutory licence.

Frequently Asked Questions