Anti-Money Laundering and Counter-Terrorism Financing Transitional Rules 2026

The instrument relies on a handful of principal legal mechanisms and concepts to implement transitional relief and continuity.

• Deeming and continuity. The rules “take” certain prior statuses or acts to continue under the new regime. Section 5 explicitly states the Amending Act is taken not to have affected a person’s status as a registered remittance network provider, registered independent remittance dealer or registered remittance affiliate. Section 6 takes persons who were registered digital currency exchange providers immediately before 31 March 2026 to have been registered under s 76E of the Principal Act as virtual asset service providers from that date. These provisions implement continuity of registration labels and avoid immediate re‑registration processes for those cohorts.

• Deferred application of substantive obligations. Several Principal Act Parts or provisions are deferred for specified cohorts and services. For example, Part 5 establishes obligations relating to transfers of value, Part 2 deals with customer due diligence and Part 1A with AML/CTF programs; s 12 suspends application of Parts 1A, 2, 3, 5 and certain record keeping divisions to reporting entities providing registrable virtual asset services (not covered by item 50A of table 1 s 6 of the Principal Act) until 1 July 2026. This gives a temporal carve‑out for newly within‑scope virtual asset services to prepare for compliance.

• Preservation of “applicable customer identification procedures” for initial customer due diligence. Sections 7 and 8 allow reporting entities to continue to apply the customer identification procedures that were the “applicable” procedures under the AML/CTF Rules as in force on 30 March 2026, provided the entity’s AML/CTF policies meet content and proportionality tests and identify classes of customers and cessation dates for those procedures (s 7). Section 8 deems that carrying out those procedures establishes reasonable grounds under subsection 28(2) of the Principal Act, and allows commencement of a designated service before carrying out the procedure in defined circumstances consistent with the position as at 30 March 2026 (s 8(2)).

• Reporting transition architecture for cross‑border transfers. The instrument stages the introduction of the new IVTS reporting regime under s 46 of the Principal Act by setting a default transition date of 31 March 2029 for reporting entities, with a window to replace that date with a later substitute between 31 March 2029 and 30 September 2029 where the reporting entity has been required to report IFTIs under section 45 as in force on 30 March 2026 (s 9). The instrument preserves the IFTI reporting regime (and its enforcement architecture) for particular persons until their IVTS reporting transition date or 31 March 2029 (s 10).

• Registrable virtual asset service enrolment and registration windows. Sections 13 and 14 provide specific timing modifications for enrolment and registration where a person provides a registrable virtual asset service before 1 July 2026. Subsection 14(1) suspends the operation of s 76A (which would otherwise prohibit provision without registration) where the person submits an application under s 76D by no later than 29 July 2026 and the service is provided on or before 30 June 2026. Subsection 14(2) further protects persons who applied for registration before providing services, where a registration decision had not yet been given by AUSTRAC at the time of provision.

• Phasing of compliance obligations like independent evaluations and AML/CTF compliance officer notifications. Section 16 treats certain previously regulated reporting entities’ first independent evaluation as compliant if it occurs within defined timing tied to historical independent reviews under the 2007 Rules Instrument. Section 17 sets a staggered schedule for the first independent evaluation for cohorts that did not previously require independent reviews, by reference to the last two digits of the enrolment identifier. Sections 18 and 19 provide compliance windows for notifying the AML/CTF compliance officer to AUSTRAC, with different deadlines depending on whether the reporting entity was enrolled on 30 March 2026 or enters the Reporting Entities Roll later.

• Limited saving for foreign law defence notice timing. Section 20 takes a reporting entity to have complied with paragraph 236A(1)(c) of the Principal Act in relation to conduct that occurs on or before 30 June 2026 where the required written notice is given on or before that date. This is an explicit saving provision to accommodate the timing of foreign law defence notices in relation to early conduct.

The concept of “taken to” permeates the instrument. This is a legislative device that deems subjective compliance by operation of law, subject to the conditions expressly listed. The deemed compliance is bounded in time and scope, and often conditional on the entity maintaining specific policies or lodgements, rather than a blanket amnesty.

Primary actors affected are reporting entities as defined in the Principal Act, with specific cohorts highlighted.

• Existing remittance actors. Persons who were registered remittance network providers, registered independent remittance dealers or registered remittance affiliates immediately before the Amending Act come within an express continuity provision (s 5). These persons do not have their prior status disrupted by the Amending Act, which affects administrative continuity and avoids immediate reclassification administrative friction.

• Formerly registered digital currency exchange providers. Anyone who, immediately before 31 March 2026, was a registered digital currency exchange provider is taken to have been registered as a virtual asset service provider under s 76E of the Principal Act from 31 March 2026 (s 6). This cohort is affected by the new virtual asset service provider registration framework, but receives a continuity conversion rather than an immediate new registration process.

• Reporting entities providing registrable virtual asset services. A distinct group are persons providing registrable virtual asset services that are not covered by item 50A of table 1 in the Principal Act. These reporting entities receive deferrals: certain Parts (1A, 2, 3, 5 and record keeping Divisions 2-6 of Part 10) do not apply to them until 1 July 2026 (s 12). However, where such persons provide services before 1 July 2026 and meet the application and timing rules in ss 13-14, they must enrol and lodge registration applications by prescribed dates to retain eligibility.

• Entities offering international value transfer services and international funds transfer instructions. All reporting entities that send or receive international funds transfer instructions remain subject to the IFTI reporting obligations as they stood on 30 March 2026 until either their IVTS reporting transition date or 31 March 2029 (s 10(2)). Entities that transition to the IVTS regime earlier, or which notify later IVTS transition dates under s 9(2), face phased reporting changes. Entities providing transfers of value involving virtual assets (items 29 or 30 in table 1 s 6) before 31 March 2029 are ineligible to substitute the default IVTS transition date (s 9(4)), which affects timing for those moving into the IVTS regime.

• Financial advisers whose services match specified table items. Section 15 modifies application of s 26T of the Principal Act for reporting entities whose designated services are covered by item 54 of table 1 and any item of table 6. For the purposes of s 26T, those reporting entities are taken to have all designated services covered by item 54 before 1 July 2026. Practically, this affects how customer due diligence thresholds or simplified due diligence rules in s 26T operate for these financial advisers in the transitional window.

• Entities that did not previously require independent reviews. Cohorts identified in s 17 include persons to whom item 12 of Schedule 3 to the Amending Act applies, persons to whom s 13 of this instrument applies, and entities enrolled before 31 March 2026 whose services were covered solely by item 54 before that date. These reporting entities have bespoke timing for the first independent evaluation set according to the last two digits of their enrolment identifier.

• All reporting entities with AML/CTF compliance officer obligations. Entities enrolled as reporting entities on 30 March 2026 must notify AUSTRAC of the AML/CTF compliance officer on or before 30 May 2026 to be taken to comply with subsection 26M(1) (s 18). Entities with delayed enrolment must notify either within 14 days after their name is entered on the Reporting Entities Roll or by 29 July 2026, whichever is later (s 19).

Secondary effects will be felt by compliance advisers, auditors and legal advisers who must apply the transitional rules when advising clients on the timing and content of AML/CTF programs, policies, registration and reporting. AUSTRAC as the regulator receives discrete operational powers under the instrument: it remains the recipient of notices and registration applications and the decision‑maker for registration, with time windows and decision points set by the Principal Act and this instrument (for example s 14(2)).

Who pays: primarily reporting entities bear the costs , preparatory compliance costs (policy drafting, registering/enrolling, independent evaluations), reporting system changes, and potential administrative penalties if the entity fails to meet timelines required by the transitional rules. AUSTRAC administers notices and registration decisions, incurring operational costs in managing staggered enrolments and conversion of registration labels.

Who decides: reporting entities decide whether to take advantage of transitional windows, to notify substitute IVTS transition dates, to maintain specified AML/CTF policies, and to submit registration applications. AUSTRAC decides registration outcomes and receives notices; the AUSTRAC CEO is the addressee for a substitute IVTS reporting transition date notice (s 9(2)).

The instrument modifies duties and preserves rights principally by deferral and deeming, rather than by creating standalone obligations. Key duties and rights follow.

Duties placed on reporting entities

• Maintain AML/CTF policies that permit continued use of applicable customer identification procedures. To be taken to comply with paragraph 26F(3)(b) of the Principal Act with respect to policies relevant to subsection 28(1), a reporting entity must maintain AML/CTF policies that: (i) provide for carrying out customer due diligence using the applicable customer identification procedures as defined by the AML/CTF Rules in force on 30 March 2026; (ii) identify classes of customer to which such procedures will apply in relation to commencing to provide a designated service at or through a permanent establishment in Australia; and (iii) identify, for each class, the date from which a customer identification procedure will no longer be applied (s 7(1)(a)(i)-(iii)). The policies must be appropriate for managing the risks of money laundering, financing of terrorism and proliferation financing and appropriate to the nature, size and complexity of the business (s 7(1)(b)(i)-(ii)). These policy obligations take effect such that the requirements to identify classes and cessation dates apply on and after 1 July 2026 (s 7(2)). Section 7 ceases to have effect on 31 March 2029 (s 7(5)).

• Carry out customer identification procedures that were the applicable procedures as at 30 March 2026, in order to be taken to have established reasonable grounds under subsection 28(2) of the Principal Act (s 8(1)). Section 8 also allows commencement of a designated service before carrying out the identification procedure in specified circumstances mirroring the status quo as at 30 March 2026 (s 8(2)), but conditions this on later carrying out the procedure in accordance with the then‑applicable s 34 requirements as at 30 March 2026 (s 8(3)).

• Continue to report IFTIs under section 45 as in force on 30 March 2026 until the IVTS reporting transition date for reporting entities, or 31 March 2029 for other persons (s 10(2)). The instrument also preserves the legal architecture and AML/CTF Rules that applied to IFTI reporting as at 30 March 2026 (s 10(3)(a)-(c)). There is, however, a narrow exception where the reporting entity reasonably determines within 10 business days that the transfer will not occur and takes reasonable steps to ensure it will not occur: then no report is required (s 10(4)).

• For registrable virtual asset services provided before 1 July 2026, the duty to enrol and apply for registration is modified. If the person provides such a service on or before 30 June 2026 and submits an application under s 76D no later than 29 July 2026, s 76A (prohibiting provision without registration) does not apply to their provision (s 14(1)). Alternatively, if they applied for registration before providing the service and the AUSTRAC CEO had not issued a registration decision by the time they provide the service, s 76A also does not apply provided the application was submitted no later than 29 July 2026 (s 14(2)).

• Meet timing for first independent evaluations. Section 16 sets timing for reporting entities that were enrolled and already subject to independent reviews on or before 30 March 2026: the first independent evaluation must be conducted before the later of four years after the last independent review of Part A under the 2007 Rules Instrument or 31 March 2027. Section 17 prescribes a staggered schedule tied to enrolment identifier digits for reporting entities who did not previously require independent reviews.

Rights and protections created or preserved

• Right to continue earlier customer identification procedures in limited circumstances, subject to maintaining specified policies and risk‑based appropriateness (s 7 and s 8). This is a practical recognition right to use the pre‑existing “applicable” procedures for initial CDD for a transitional window up to 31 March 2029.

• Right to preserve IFTI reporting obligations and associated AML/CTF Rules as they existed on 30 March 2026, rather than immediately adopt the amended IVTS reporting obligations (s 10(2)-(3)). This affords reporting entities continued reliance on the prior reporting architecture until their IVTS transition date.

• Right to apply for substitution of the IVTS reporting transition date. Reporting entities required to give IFTI reports may give the AUSTRAC CEO notice in writing of a substitute IVTS reporting transition date between 31 March 2029 and 30 September 2029, subject to notice timing safeguards (s 9(2)). However, entities that provide certain transfers involving virtual assets before 31 March 2029 are ineligible to substitute (s 9(4)).

• Procedural protection in registration timing for virtual asset service providers. If a person submitted a registration application by 29 July 2026 before providing a registrable virtual asset service on or before 30 June 2026, or applied before providing and the AUSTRAC CEO had not yet given a decision, s 76A does not apply (s 14(1)-(2)). This prevents immediate criminalisation or prohibition for those who applied within the windows.

• A saving for the foreign law defence notice. For conduct occurring on or before 30 June 2026, a reporting entity is taken to have complied with paragraph 236A(1)(c) if it gives the written notice required on or before 30 June 2026, even if the notice is given after the conduct (s 20). This is a narrow preservation of the right to assert the defence where notice timing might otherwise have been strict.

Who decides compliance status: the instrument frequently defines the conditions under which a reporting entity is “taken to” comply with Principal Act requirements. That legal fiction shifts the immediate compliance determination to a test of whether the entity has maintained the specified policies, lodged specified notices or applied for registration by the prescribed times. AUSTRAC retains decision‑making powers over registration outcomes and will be the addressee and recipient of notices required to effect some transitional rights.

This instrument does not itself create new civil penalties, monetary sanctions or criminal offences beyond the operative deemings and deferrals. Enforcement and penalty mechanisms remain those established in the Principal Act and the preserved historical IFTI regime where the instrument maintains it. Several provisions of the instrument expressly direct application of existing Principal Act enforcement machinery to transitional reporting.

• Preservation of enforcement frameworks for IFTI reporting. Section 10(3)(a) expressly continues the Principal Act as in force on 30 March 2026 to the extent it relates to compliance with, or enforcement of, the IFTI reporting obligation. That means civil penalty provisions, offence provisions and enforcement processes that applied to IFTI reporting on 30 March 2026 continue to apply to persons required to submit IFTI reports during the transitional window.

• Applicability of specific Principal Act sections to transitional reporting. Section 10(5) takes section 48A of the Principal Act to apply to reports given to the AUSTRAC CEO in accordance with the transitional IFTI reporting continuation set out in s 10. Section 10(6) applies section 49 of the Principal Act to information communicated to the AUSTRAC CEO in accordance with this section. Section 10(7) applies section 51 of the Principal Act to communications made or information given under this section. Those sections in the Principal Act relate to matters such as the CEO’s use of information, protection of confidentiality, and other procedural elements. The instrument therefore ensures the existing enforcement and information‑use processes apply to reports made under the transitional relief.

• Deemed compliance reduces exposure if conditions met. The “taken to comply” provisions (for example s 7(1) deeming compliance with paragraph 26F(3)(b) if policies meet specified content and risk tests, s 8 deeming that establishment of reasonable grounds is satisfied where applicable procedures as at 30 March 2026 are used) function substantively to remove immediate exposure to enforcement for entities that meet the retrospective policy and procedural conditions. That reduces the immediate risk of fines or other penalties where the entity follows the transitional steps. However, those protections are conditional and time‑limited, and failure to meet the policy content requirements or to conduct the required procedures within the specified windows will leave the entity subject to normal enforcement.

• Registration deadlines and potential prohibition enforcement. Section 14 suspends the operation of s 76A (prohibition on providing registrable virtual asset services without registration) in narrow circumstances. Outside those conditions , for example, if an entity provides a registrable virtual asset service on or after 1 July 2026 without meeting the registration requirements , the standard prohibitions and potential sanctions under the Principal Act will apply. The instrument therefore creates a safe harbour only where the specified application timing and conditions are met.

• Timing‑based enforcement exposures. Independent evaluation deadlines under s 16 and s 17 and AML/CTF compliance officer notification deadlines under s 18 and s 19 are framed as requirements of the Principal Act. Failure to meet the deadlines that the transitional rules set effectively leaves the entity subject to any enforcement mechanism that applies to the underlying Principal Act obligations. The instrument’s use of “taken to comply” where the entity meets the transitional steps reduces immediate enforcement risk for compliant entities, but it does not otherwise modify the Principal Act’s penalty architecture.

• Defence notice timing preserved for pre‑cut‑off conduct. The instrument’s saving for paragraph 236A(1)(c) (s 20) is procedural: it takes a reporting entity to have complied with the requirement to give written notice for conduct occurring on or before 30 June 2026 where the notice is given on or before that date. This reduces the risk of enforcement where timing of the notice might otherwise have been a technical non‑compliance. It does not create a substantive immunity from civil penalty exposure on merits, only a procedural fix for the notice timing.

AUSTRAC’s investigative and enforcement tools are not changed by this instrument; what is changed is the temporal scope of obligations, the conditions for deemed compliance, and the administrative windows that postpone or replace immediate application of particular Principal Act provisions. Reporting entities that fail to meet the transitional conditions or miss the windows may be subject to the ordinary enforcement regime under the Principal Act.

This instrument operates as a transitional layer between the Principal Act as amended by the Amending Act 2024 and the pre‑existing regime (including the position of the AML/CTF Rules and the 2007 Rules Instrument). Its interaction with other legal instruments is principally effected by cross‑reference and saving clauses.

• Made under the Amending Act and tied to the Principal Act. The instrument is made pursuant to the Anti‑Money Laundering and Counter‑Terrorism Financing Amendment Act 2024 (s 3). It consistently defines terms by reference to the Principal Act (s 4). Therefore the transitional rules augment and interpret the amended Principal Act rather than displacing it.

• Preserves specific prior versions of the AML/CTF Rules and the Principal Act for transitional purposes. Section 7 requires reporting entities to use customer identification procedures that comply with the AML/CTF Rules as in force on 30 March 2026. Section 10(3)(b) preserves AML/CTF Rules in force on that date for IFTI reporting. Section 16 refers to independent reviews carried out in accordance with the Anti‑Money Laundering and Counter‑Terrorism Financing Rules Instrument 2007 (No. 1). Those references create an explicit temporal link: transitional compliance must be measured against prior versions of Rules and instruments rather than subsequent changes, unless the reporting entity elects otherwise under the new regime and the conditions of the instrument are not relied upon. The instrument therefore creates an interaction where both historic and amended instruments govern at different times.

• Cross‑references to Principal Act sections for compliance assessment. Multiple provisions of this instrument operate by reference to specific sections of the Principal Act as in force on 30 March 2026 (for example s 7(1) referencing subsection 28(1) obligations; s 8 referencing subsection 28(2), s 33 and s 34 as in force on 30 March 2026). Those cross‑references mean the instrument’s protections and permissions are underpinned by the content and scope of the Principal Act sections as they were prior to the Amending Act’s operationalisation.

• Maintains continuity of registration categories by mapping old registrations into new categories. Section 5 preserves remittance registration statuses; section 6 takes registered digital currency exchange providers to be registered under s 76E as virtual asset service providers from 31 March 2026. The instrument therefore functions as a conversion vehicle, mapping prior registration regimes to the revised registration categories in the amended Principal Act.

• Interaction with AUSTRAC administrative architecture. Notices and applications are to be given to the AUSTRAC CEO (for example s 9(2) for substitute IVTS reporting transition dates). The instrument therefore sits within the administrative structure under the Principal Act, and any interoperability with privacy, confidentiality or intelligence‑sharing laws will follow the Principal Act’s cross‑references. Section 10 takes sections 48A, 49 and 51 of the Principal Act to apply to reports and communications made under the transitional IFTI continuation; those sections deal with the CEO’s use and disclosure of information, which implies interaction with confidentiality protections and information‑sharing frameworks under the Principal Act.

• No express interaction with non‑Commonwealth law. The instrument refers to a foreign law defence under paragraph 236A(1)(c) of the Principal Act (s 20), but it does not attempt to reconcile Commonwealth obligations with state or territory obligations. Where foreign law prevents compliance, the instrument provides a narrow procedural saving for notice timing where the conduct occurred on or before 30 June 2026 and the notice is given on or before that date (s 20).

• Time‑limited coexistence of reporting regimes. The instrument creates a coexistence regime for IFTI reporting (historic framework) and IVTS reporting (new framework) during a transition window up to entity‑specific IVTS transition dates (s 9-10). That coexistence creates an administrative interaction between legacy reporting obligations and the new IVTS obligations. Where reporting entities continue under the IFTI regime, the Principal Act’s enforcement and AML/CTF Rules as of 30 March 2026 continue to apply; when the IVTS transition date arrives, the new s 46 reporting architecture will apply and prior rules cease for that entity.

Overall, the instrument is a program of temporal and procedural adjustments that layers onto the amended Principal Act and pre‑existing Rules Instruments. It makes selective parts of prior instruments temporarily binding and defers application of selected parts of the Principal Act to enable staged compliance. Parties must therefore read the instrument alongside both the Amending Act and the Principal Act, and with reference to the versions of the AML/CTF Rules and the 2007 Rules Instrument as at 30 March 2026 where the instrument specifies.

The instrument itself provides limited amendment and commencement metadata. The key points in the amendment and commencement record are as follows.

• Instrument name and date. The instrument is the Anti‑Money Laundering and Counter‑Terrorism Financing Transitional Rules 2026 and is dated 27 March 2026. It is signed by the Minister for Home Affairs (Tony Burke) and made under the Anti‑Money Laundering and Counter‑Terrorism Financing Amendment Act 2024 (s 1 and s 3).

• Commencement. The instrument’s provisions commence, or are taken to have commenced, on 31 March 2026. The instrument contains a commencement table (s 2) that records the whole instrument commencing 31 March 2026. The instrument expressly notes that the commencement table relates only to provisions as originally made and will not be amended to reflect later amendments (s 2(1) note).

• Built‑in expiry for some transitional provisions. Section 7, which permits the continued use of applicable customer identification procedures where specified AML/CTF policies are in place, ceases to have effect on 31 March 2029 (s 7(5)). The instrument does not introduce express expiry dates for many other provisions; those operate as transitional deferrals to specific dates set out in the relevant sections. For example, s 12 defers application of specified Parts of the Principal Act to certain virtual asset services until 1 July 2026; s 11 defers application of section 46A in relation to unverified self‑hosted virtual asset wallets until 31 March 2029.

• Deadlines established for administrative filings. The instrument establishes several firm administrative deadlines that have legal effect. For example:

  • For persons providing registrable virtual asset services before 1 July 2026, an application for registration under s 76D must be submitted no later than 29 July 2026 to avoid s 76A applying (s 14(1)).
  • Those enrolled as reporting entities on 30 March 2026 must notify AUSTRAC of the AML/CTF compliance officer on or before 30 May 2026 to be taken to comply with subsection 26M(1) (s 18).
  • Reporting entities with delayed enrolment must give the notification required by subsection 26M(1) by the later of 14 days after entry on the Reporting Entities Roll or 29 July 2026 (s 19).

• Specific arrangements for independent evaluations. The instrument sets timing for first independent evaluations in ss 16-17. Section 16 ties the first independent evaluation to a later of four years after the last independent review carried out under the 2007 Rules Instrument or 31 March 2027 for certain entities. Section 17 sets a staged schedule for other entities, keyed to the last two digits of the enrolment identifier and providing dates from 30 June 2029 through 31 December 2030.

• No amendment notes within the instrument beyond commencement metadata. The instrument’s s 2 commencement table contains a Column 3 note indicating that any information in column 3 is not part of the instrument and may be edited in published versions, but the instrument itself contains no later amendment record. Therefore, the dated instrument as made on 27 March 2026 with commencement on 31 March 2026 is the operative text.

For users of the instrument, the relevant amendment history context is the relationship between the Amending Act 2024 and the 2026 Transitional Rules. The Transitional Rules implement the Amending Act’s operational rollout by establishing phased compliance windows, preserving portions of prior Rules, and converting some legacy registration categories into the newly named categories under the Principal Act as amended.

The instrument does not record any case law, administrative appeals or litigation history. It names no judicial decisions, tribunals, or reviews. Consequently, there is no litigation history in the instrument to cite.

Potential litigation or administrative review themes that could arise from the transitional rules, based on the text, include:

• Interpretation of “taken to comply” and the preconditions. Parties may litigate whether an entity’s AML/CTF policies satisfy the content and risk appropriateness requirements in s 7(1)(a)-(b) when a regulator or third party contests the adequacy of the policies. Questions likely to attract dispute include whether the classes of customer identified are sufficiently defined, whether the specified dates from which a customer identification procedure will no longer be applied are clear, and whether the policies are “appropriate” to the nature, size and complexity of the business as required by s 7(1)(b)(ii). The instrument itself frames these as prerequisites to deemed compliance.

• Disputes over the scope of deferred application. Where a reporting entity asserts that Part 1A, Part 2, Part 3, Part 5 or record keeping Divisions 2-6 of Part 10 do not apply to them until 1 July 2026 under s 12, AUSTRAC or a complainant may challenge the service classification or the scope of item 50A exclusions in table 1 of section 6 of the Principal Act. That is a factual and legal question involving statutory interpretation and application of table items.

• Challenges to registration timing treatment. The instrument creates a safe harbour where registration applications are lodged by 29 July 2026 for services provided on or before 30 June 2026 (s 14). Litigation could arise where AUSTRAC refuses to accept an application on the basis it was late, where there is disagreement about the date a service was first provided, or where the AUSTRAC CEO’s failure to make a decision before provision of services is contested in respect of s 14(2).

• Disputes about IVTS transition date eligibility. Under s 9(4), a reporting entity is not eligible to have an IVTS reporting transition date other than 31 March 2029 if before that date the entity provides a designated service covered by items 29 or 30 in table 1 and the transfer involves a virtual asset. Litigation could test whether a particular service falls within items 29 or 30, or whether a transfer involved a virtual asset for the purposes of s 9(4), creating a definitional dispute with potential consequences for reporting obligations.

• Challenges around independent evaluation timing. Section 17 adopts a mechanical schedule based on the enrolment identifier’s last two digits. Disputes could arise over the correct enrolment identifier for a particular entity or the interpretation of “conducted before” the relevant due date, which may give rise to administrative review of regulator decisions that rely on that schedule.

These potential litigation themes are inferred from the instrument’s text; the instrument itself does not identify any actual litigation.

The transitional rules contain numerous operational pitfalls that can cause inadvertent non‑compliance if not actively managed. The following are concrete “gotchas” grounded in the instrument’s text.

• “Taken to comply” is conditional, not absolute. Sections 7 and 8 use deeming language to take entities to comply with specified Principal Act obligations if they meet detailed policy and procedural conditions. That deeming only applies where the entity maintains AML/CTF policies that identify classes of customers, cessation dates, and meet appropriateness tests (s 7(1)(a)-(b)). If the policy wording is loose, vague, or lacks the required identification of classes and dates, the entity will not be in the safe harbour. The policy obligations’ content requirement becomes a material compliance test.

• Timing requirements are precise and vary across cohorts. Different deadlines apply depending on the entity’s status:

  • AML/CTF compliance officer notification: enrolled entities on 30 March 2026 must notify AUSTRAC on or before 30 May 2026 (s 18). Entities with delayed enrolment must notify by the later of 14 days after entry on the Reporting Entities Roll or 29 July 2026 (s 19). Missing those dates removes the “taken to comply” protection.
  • Registrable VASP registration application: applications must be submitted by 29 July 2026 to benefit from the s 76A non‑application (s 14(1)-(2)). Submitting a day late risks exposure to prohibition under s 76A.
  • IVTS transition date substitution: notices under s 9(2) must be given no earlier than 31 March 2029 and no later than 30 September 2029, and at least 10 business days before both the previous and substitute transition dates (s 9(2), (7)). There are also eligibility constraints in s 9(4) if a reporting entity provides services involving virtual assets before 31 March 2029.

• Enrolment identifier digits determine independent evaluation deadlines. Section 17’s schedule for first independent evaluation depends on the last two digits of the enrolment identifier. Entities must verify their enrolment identifier digits and map them correctly to the due dates in s 17(2)(a)-(d). Mistaking digits or applying the wrong schedule risks missing the mandated timing.

• Reporting regime coexistence logic is not automatic. The transition from IFTI to IVTS reporting is not automatic for all entities on the same date. The default IVTS reporting transition date is 31 March 2029 (s 9(1)(a)), but entities may substitute a date within a narrow window, provided they were required to give IFTI reports (s 9(2)-(3)). Where an entity provides certain virtual asset transfers before 31 March 2029, the entity is ineligible to substitute, and the default remains (s 9(4)). Failure to understand whether the ineligibility applies can force an entity to report under the IVTS regime earlier or later than expected.

• Be careful with commencement windows for virtual asset services. Section 12 defers application of Part 1A, Part 2, Part 3, Part 5 and specified record keeping divisions to certain registrable virtual asset services until 1 July 2026. But section 13 applies if a person provides a registrable virtual asset service before 1 July 2026 and does not provide other kinds of designated services, and modifies the enrolment timing in s 51B(1) to 29 July 2026 (s 13(2)). Entities must ensure they correctly classify their services and understand whether they are covered by item 50A of table 1 in section 6 to determine applicability.

• Section 7’s non‑application to ongoing due diligence. Section 7(3) clarifies that the deeming of compliance with paragraph 26F(3)(b) does not extend to policies relating to ongoing due diligence under subsection 30(1) of the Principal Act. Entities may mistakenly assume the transitional flexibility applies to ongoing CDD; it does not. Ongoing due diligence remains governed by the Principal Act’s requirements.

• Exception for transfers that will not occur. Section 10(4) provides an exception to IFTI reporting where within 10 business days the reporting entity reasonably determines the transfer will not occur and takes reasonable steps to ensure it will not. The “reasonable steps” standard is subjective. A poor record of decision‑making or insufficient documentary evidence of the steps taken could leave the entity exposed to enforcement if the regulator disputes the reasonableness of the determination or steps taken.

• Narrow saving for foreign law defence notices. Section 20 permits notice after the conduct occurs only where the conduct occurred on or before 30 June 2026 and the notice is given on or before 30 June 2026. That is a narrow window and applies only to the specific paragraph 236A(1)(c) requirement. Entities relying on foreign law defences for conduct after 30 June 2026 will not benefit from this procedural saving.

• Record‑keeping and program parts deferred but not removed. Sections like s 12 defer record‑keeping Divisions 2-6 of Part 10 until 1 July 2026 for certain registrable virtual asset services, but those obligations will apply from that date. Entities may under‑invest in systems during the deferment and then face a compressed implementation timeline.

• Multiple notices permitted but timing rules strict. More than one notice can be given under s 9(6) to substitute the IVTS reporting transition date, but each notice must meet the timing rules in s 9(7). A sequence of notices given too late or without respecting the 10 business‑day minimum before prior and substitute dates may be invalid.

To manage these “gotchas”, legal and compliance teams must create a compliance matrix mapping entity status, service types, enrolment identifiers, and key dates to the instrument’s provisions, and maintain contemporaneous records evidencing the policies, notices and reasonable steps referenced in the instrument.

Compliance under these transitional rules requires a practical, documentation‑oriented approach that maps each reporting entity’s services and status to the instrument’s specific windows and conditions. The following steps translate the instrument’s text into an implementation checklist.

1. Determine legal status and service classification

   • Confirm whether the entity was enrolled as a reporting entity on 30 March 2026, was a registered digital currency exchange provider immediately before 31 March 2026, or holds any remittance registration status preserved by s 5 or s 6 (s 5-6). Document the evidence proving the relevant status and the dates of registration/enrolment.
   • Map each service provided to table items in section 6 of the Principal Act to assess whether services are registrable virtual asset services, whether an item 50A exclusion applies, and whether services fall within items 29 or 30 (for IVTS eligibility under s 9(4)).

2. For entities electing to rely on “applicable customer identification procedures”

   • Draft or update AML/CTF policies to explicitly:
     • Provide for the carrying out of initial customer due diligence using customer identification procedures that comply with the AML/CTF Rules as in force on 30 March 2026 (s 7(1)(a)(i)).
     • Identify classes of customers to which those procedures will be applied in relation to commencing to provide a designated service at or through a permanent establishment in Australia (s 7(1)(a)(ii)).
     • For each class, identify the date from which the customer identification procedure will no longer be applied (s 7(1)(a)(iii)). Note that the class and date identification requirements apply on and after 1 July 2026 (s 7(2)).
     • Ensure policies include risk‑based justification and are proportionate to the entity’s nature, size and complexity (s 7(1)(b)).
   • Maintain contemporaneous records that show how the policy meets the “appropriate” standard referred to in s 7(1)(b). The instrument deems compliance only where the policy meets the enumerated standards.

3. Operationalise initial customer due diligence and commencement rules

   • If relying on s 8, ensure that customer identification procedures carried out are those that would have been the applicable procedures within the meaning of the Principal Act as in force on 30 March 2026 (s 8(1)(a)).
   • If starting to provide a designated service before carrying out the ID procedure, confirm that the circumstances would have been permitted by section 33 as in force on 30 March 2026 and that the ID procedure will be completed in accordance with section 34 as in force on 30 March 2026; otherwise the s 8(2) permission will not apply and s 8(3) will disapply the deemed compliance (s 8(2)-(3)).

4. IVTS/IFTI reporting transition planning

   • Identify whether the entity has been required to give IFTI reports under section 45 as in force on 30 March 2026. If so, the entity may give written notice to the AUSTRAC CEO of a substitute IVTS reporting transition date that is no earlier than 31 March 2029 and no later than 30 September 2029 (s 9(2)).
   • If giving a substitute IVTS date, ensure the notice is given at least 10 business days before the previous IVTS reporting transition date and at least 10 business days before the substitute date (s 9(7)).
   • Check whether any provision of the entity’s services involves transfers covered by item 29 or 30 in table 1 that involve a virtual asset before 31 March 2029. If so, the entity is ineligible to have a substitute IVTS reporting transition date (s 9(4)).
   • Maintain IFTI reporting under section 45 as in force on 30 March 2026 until the entity’s IVTS reporting transition date (s 10(2)). Use the 10 business‑day exception in s 10(4) only with strong evidence and contemporaneous documentation of the reasonable determination and steps taken.

5. Virtual asset service provider enrolment and registration

   • For entities providing registrable virtual asset services before 1 July 2026 that are not covered by item 50A:
     • Apply s 13(2): note that s 51B(1) is adapted so that the enrolment period is taken as 29 July 2026 if the person commenced the service before 1 July 2026 and provided no other designated services (s 13(2)).
     • If providing a registrable virtual asset service on or before 30 June 2026, submit an application for registration under s 76D no later than 29 July 2026 to ensure s 76A does not apply (s 14(1)).
     • If an application was submitted before providing the service and the AUSTRAC CEO has not issued a decision at the time the service is provided, s 76A does not apply by virtue of s 14(2), provided the application was submitted no later than 29 July 2026.
   • Prepare registration applications early and retain evidence of submission dates, as s 14 relies on the timing of submission.

6. Independent evaluations scheduling

   • For entities that were enrolled and had independent reviews before 30 March 2026, plan to conduct the first independent evaluation before the later of four years after the last independent review under the 2007 Rules Instrument or 31 March 2027 (s 16).
   • For entities newly subject to independent evaluations under the Amending Act, map the last two digits of the enrolment identifier to the four date bands in s 17(2)(a)-(d). Schedule procurement of an independent evaluator and prepare the AML/CTF program materials needed for evaluation well in advance of the relevant date.

7. AML/CTF compliance officer notifications

   • If enrolled as a reporting entity on 30 March 2026, notify AUSTRAC of the AML/CTF compliance officer on or before 30 May 2026 to be taken to comply with subsection 26M(1) (s 18).
   • If the entity is in the delayed enrolment cohorts (as described in s 19), notify AUSTRAC within 14 days after name entry on the Reporting Entities Roll or by 29 July 2026, whichever is later. Keep documentary proof of the date of entry on the Roll and of the date the notice was given.

8. Records and system readiness

   • Although some record keeping Divisions are deferred for certain registrable virtual asset services until 1 July 2026 (s 12), ready record systems for the moment they become applicable. Implement data capture and retention processes that will be necessary both for ongoing AML/CTF program obligations and for the independent evaluation processes.

9. Documentation and audit trail

   • Maintain contemporaneous records of policy approvals, the risk assessment justifying policy appropriateness under s 7(1)(b), notices to AUSTRAC (including date and content), registration application submissions (receipts, timestamps), and determinations under s 10(4) where a transfer is cancelled. Those records will be relevant both to demonstrate the right to “taken to” compliance and to defend against enforcement inquiries.

10. Legal review and remediation plan

• Obtain legal review of the AML/CTF policies to ensure they meet the instrument’s content tests. Where policies identify classes of customers and cessation dates, ensure those dates are realistic and the entity has an operational plan to migrate to new procedures by the stated dates.
• Build a remediation plan for migrating from applicable customer identification procedures to the updated procedures once the transitional period ends or the entity’s stated cessation dates for classes are reached.

11. Engage with AUSTRAC and seek clarifications if necessary

• Where classifications are uncertain (for example, whether a service is covered by item 50A or whether a transfer involves a virtual asset), consider seeking regulator clarification or contemporaneous legal advice, and document any regulator communications in the event of later disputes.

Following this checklist will position a reporting entity to take advantage of the instrument’s transitional deference where available while mitigating the risk of falling outside the narrow safe harbours the instrument creates.