You just inherited a vault. You’ve been told exactly what needs to be stored inside it, passports, bank details, ownership papers, and you are the one responsible for its security.
Good luck.
Now that’s a wild situation to be in, but it’s the one the AML/CTF reforms brought into effect, and you’re not in it alone.
On July 1st 2026, every law firm, conveyancing practice, accounting firm, real estate agency and precious metals dealer caught by the AML/CTF reforms got handed the same vault.
Here’s what that means for you, and why cyber security services just moved up your list. Your files now hold identity documents, bank details and ownership records they never needed before. Your business hasn’t changed, but the value of what it holds has. Even if you turn over less than three million dollars a year, the Privacy Act now applies to that information, with reasonable steps and breach reporting obligations attached. And there are three clear places to start.
Key takeaways
From 1 July 2026, the AML/CTF reforms pulled law firms, conveyancers, accountants, real estate professionals and precious metals dealers into a regime that also removes the Privacy Act’s small business exemption for AML/CTF activities. You’ll now collect identity and financial information you’ve never handled before, and the law expects you to protect it. Here’s what changed and what your cyber security services need to cover.
What’s below
What personal information do I have to collect under the AML/CTF reforms?
AML/CTF due diligence requires your business to collect identity documents, beneficial ownership details and, for higher-risk clients, source of funds information, data most professional services firms have never held at this scale before.
Before 1 July, your file might have held a name, an address, a signed engagement letter. Now, if you handle client money, transfer property, or set up companies and trusts, you need to verify passports and other identity documents, check where client money comes from when the risk calls for it, and keep records tracing who owns the entity you act for. AUSTRAC has confirmed the number of businesses it regulates jumps from around 19,000 to nearly 100,000 nationwide from 1 July 2026, what AUSTRAC calls the most significant overhaul of the regime in more than 20 years.
That changes what’s worth stealing. A leaked email password can be reset. A leaked passport scan can be sold on the dark web. The Australian Cyber Security Centre reports identity fraud remained the most reported cybercrime last financial year, and that attackers now use AI to write convincing, error-free phishing emails, often aimed at staff with access to sensitive information and financial transactions. That describes most conveyancing and accounting teams.
How do the AML/CTF reforms affect my
Becoming an AML/CTF reporting entity brings the personal information you handle for AML/CTF purposes under the Australian Privacy Principles, including APP 11’s reasonable steps requirement and the Notifiable Data Breaches scheme.
Your AML/CTF program is separate work. Enrolling with AUSTRAC, appointing a compliance officer, building a risk assessment and doing the due diligence are compliance work, often done with legal or compliance advisers, and cyber security services don’t replace that. From here the focus is protecting what you now hold.
Do I still qualify for the Privacy Act small business exemption?
Not for your AML/CTF work. Once you’re a reporting entity, the small business exemption no longer covers personal information you handle for AML/CTF purposes, regardless of turnover. For many firms, that’s the first time the Australian Privacy Principles have applied to them at all.
Banks have had decades to build security around identity data. A two-person conveyancing practice is now bound by the same privacy obligations as a much larger business for every client file it holds for AML/CTF purposes, because of what it handles, not what it earns, and with far less time to get there.
In practice, those records sit in the same inboxes and file systems as everything else, so protecting them means securing the systems they live in.
What do APP 11 and the Notifiable Data Breaches scheme require of me?
APP 11 requires you to set your own reasonable steps to protect personal information, no standard combination is supplied. The Notifiable Data Breaches scheme requires you to notify the OAIC and affected individuals of an eligible breach.
The lock is fitted, the combination is yours to set, and the OAIC’s guidance for AML/CTF reporting entities gives you the first few numbers. Take only the client information the regime asks for. Don’t keep a full passport copy if the rules only need the details from it. Tell clients what you’re collecting and why, and clear out records once you no longer need them.
Then test your own setup against it. Who in your team can open a client’s passport scan? Could it be downloaded and emailed to a personal account? If a staff member’s Microsoft 365 login was phished on Friday, would anyone notice before Monday? If you’re not sure, that’s where your reasonable steps begin.
What cyber security services do I need for AML/CTF compliance?
The cyber security services you need depend on what you hold and how you hold it, which a review will confirm. ONGC’s cyber security team offers managed cyber security services at three levels, Reach Ignite, Reach Protect and Reach Secure, each suited to a different stage of a firm’s security maturity.
Which ONGC Reach package fits my firm?
Reach Ignite gets the basics right, controlling who can log in, managing passwords and keeping backups. Reach Protect puts eyes on your systems day and night, responds to every incident with no cap, checks the dark web for your team’s details and trains your staff to spot a phish. If the reforms mean your firm now handles client passports and bank details, Reach Secure is the benchmark to measure against. A review shows how far off it you are.
What’s included in Reach Secure?
Reach Secure is built to align with Maturity Level 2 of the Essential Eight, the Australian Cyber Security Centre’s recommended baseline strategies. In practice, only approved software runs on your machines, your systems are watched around the clock, and you’re told if your team’s logins turn up on the dark web. Data loss prevention helps stop a client’s passport scan leaving the business without approval. You also get the paperwork, including incident response and recovery plans, so if a breach happens, you’re not writing your Notifiable Data Breaches response from scratch at 2 am. Backups and offsite recovery sit under disaster recovery and offsite backup.
An annual roadmap keeps you aligned year on year, and co-managed security covers you if your internal team stays involved.
From open door to locked vault
Children’s Hospital Foundation had little visibility over its cyber security posture and needed alignment with the Essential Eight and the Privacy Act. ONGC built and delivered a 12 month roadmap, and CHF now runs a fortified posture with full compliance.
CHF started where your firm may be now, holding sensitive information with little visibility over how well it was protected. It didn’t fix that in one step. ONGC built its cyber security strategy from the ground up and worked through it over 12 months, with regular updates keeping leadership across the progress.
Where do I start with AML/CTF cyber security compliance?
Confirm which of your services trigger the reforms, confirm your Privacy Act exposure, then book a review with a cyber security managed services provider to see which tier fits your business.
What are my first three steps?
- Confirm which of your services count as designated services.
- Confirm your Privacy Act exposure.
- Get a cyber security review to see which Reach tier fits.
Do these three steps, and you’ll know exactly what you are holding, what you are required to protect, and what setting the combination actually involves for your business.
The bottom line
The AML/CTF reforms bring two obligations. The first is the compliance program, and that’s work for you and your legal or compliance advisers. The second is setting the combination, protecting what you’re now required to hold under APP 11 and the Notifiable Data Breaches scheme, and that’s where your cyber security comes in. Collecting more client information means protecting more of it. A review and the right Reach tier get you there, and you do not have to set it alone.
Talk to ONGC’s cyber security team about what reasonable steps look like for your business.
The AML/CTF reforms bring two obligations. The first is the compliance program, and that’s work for you and your legal or compliance advisers. The second is setting the combination, protecting what you’re now required to hold under APP 11 and the Notifiable Data Breaches scheme, and that’s where your cyber security comes in. Collecting more client information means protecting more of it. A review and the right Reach tier get you there, and you do not have to set it alone.
What else do I need to know about AML/CTF and Privacy Act compliance?
Does the AML/CTF regime apply to my law firm or accounting practice?
Only if your firm provides a designated service, such as handling client money, buying, selling or transferring property for a client, or setting up companies and trusts.
The regime is triggered by what you do, not what you are. Two accounting practices on the same street can land on opposite sides of the line. One prepares tax returns and gives general advice. The other also sets up family trusts for clients. Even within one firm, a single service can bring the whole business in. AUSTRAC’s online checker is the quickest way to confirm where you sit, and if you are captured, you need to enrol within 28 days of first providing a designated service.
What’s the difference between my AML/CTF obligations and my Privacy Act obligations?
Your AML/CTF obligations tell you what client information to collect, and what to report to AUSTRAC.
Think of them as two halves of the same file. The AML/CTF regime requires you to run a compliance program, verify who your clients are, report suspicious matters and keep records. The Privacy Act, overseen by the OAIC, governs how that information is stored, accessed and protected, and what happens if it’s breached. The two also interact. The Privacy Act generally expects you to delete personal information you no longer need, but AML/CTF record keeping rules require you to hold due diligence records for a set period, so those records stay in the vault longer than you might expect.
What counts as a reasonable step under APP 11?
There’s no fixed checklist. What’s reasonable depends on how much personal information you hold, how sensitive it is, the harm a breach could cause, and the size of your business.
Passports and bank statements sit at the sensitive end of the scale, so the bar is higher than for a client mailing list. For most small practices, reasonable steps start with the basics done properly. That means multi-factor authentication on every Microsoft 365 account, access to identity documents limited to the people who need it, and patched devices with an endpoint protection subscription. Add encrypted storage, tested backups, staff who can spot a phishing email, and a written plan for what happens if something goes wrong. The OAIC’s guide to securing personal information is the official reference, and the Essential Eight is a practical benchmark to measure against.
