AML compliance for non-bank financial services

Yes, in most cases. Tranche 2 expands the designated-service list, tightens beneficial-ownership and source-of-funds expectations, and raises the bar on transaction monitoring and independent review. Programs written in 2018–2020 typically need a refresh against the new Rules, the updated AUSTRAC guidance, and the broader expectations that have crystallised through enforcement action against the major banks. Most providers offer a gap-assessment as a fixed-price first engagement, producing a prioritised remediation list rather than a full rebuild.

Brokers who arrange for a person to receive a designated service from a lender are themselves providing a designated service under the arranger limb of the Act. This captures most residential, commercial, and asset-finance brokers when they introduce a borrower to a lender. The exact obligations depend on whether the broker also touches funds, holds client money in a trust account, or merely arranges the introduction — but enrolment, CDD on the borrower, and SMR obligations apply at the arranger level even where no funds flow through the broker. The MFAA and FBAA have been engaging with AUSTRAC on guidance for the channel; we are tracking the final position closely.

Making a loan or providing credit in the course of business is a long-standing designated service, so non-bank lenders are already in the regime. Tranche 2 brings sharper expectations rather than first-time enrolment for most. Buy-Now-Pay-Later and embedded point-of-sale credit have been a regulatory grey zone but are increasingly treated as in-scope, particularly where transaction sizes, structuring patterns, or third-party use create ML/TF risk. Fintechs operating through partner banks should not assume the bank's AML program covers their customer-facing flow — partnership arrangements typically split obligations explicitly.

Digital currency exchanges (DCEs) and remittance service providers have a separate AUSTRAC registration obligation, on top of the standard reporting-entity enrolment, and have been in the regime since 2018 (DCEs) and earlier (remittance). Tranche 2 does not change the registration requirement but does sharpen surrounding expectations on customer due diligence, travel-rule compliance, and transaction monitoring. Providers in this space tend to be specialists — we are onboarding a small number into the directory and will surface them as the segment matures.

ASIC and AUSTRAC have a coordinated supervisory posture for AFSL holders, credit licensees, and financial-services intermediaries. AML failings frequently surface in ASIC reviews, and ASIC enforcement actions (responsible lending, fee-for-no-service, design-and-distribution) increasingly include AML/CTF findings as a contributing factor. Practical implication: your AML program, your responsible-lending controls, and your DDO product-governance work should reuse the same customer data, the same risk taxonomy, and the same monitoring infrastructure rather than running as parallel silos.