Confidentiality vs. Compliance: How Law firms can navigate Tranche 2’s reporting demands
Tranche 2 of Australia’s AML/CTF reforms is set to reshape the legal landscape when it comes into effect in July 2026.
One of the most sensitive changes?
For the first time, legal professionals will be required to report suspicious matters to AUSTRAC, Australia’s anti-money laundering and counter-terrorism financing regulator.
For a profession grounded in confidentiality and legal privilege, this creates serious questions:
How do you meet your legal obligation to report potential criminal activity without breaching your client’s trust? Where do you draw the line between protecting client information and complying with the law?
This article examines how legal professionals can strike this balance and why a proactive, informed approach will be crucial in the years ahead.
Understanding the new reporting landscape
Under Tranche 2, legal practitioners who provide certain services, including property transactions, trust and company formation or managing client funds, will become “reporting entities” under the Anti-Money Laundering and Counter-Terrorism Financing Act.
This means law firms will be required to:
- Conduct customer due diligence (CDD)
- Monitor client activity for suspicious transactions
- Submit Suspicious Matter Reports (SMRs) to AUSTRAC when red flags arise
These obligations align the legal sector with existing rules for banks, remittance providers, and other financial institutions. But for lawyers, this is more than a regulatory shift – it’s a cultural one.
Why this feels like a conflict
Confidentiality is a cornerstone of the legal profession. Legal professional privilege (LPP), also known as client legal privilege, protects communications between a lawyer and their client that are made for the dominant purpose of giving or receiving legal advice or preparing for litigation. It allows clients to speak freely, knowing that what they say won’t be disclosed to third parties, even under regulatory pressure. Lawyers are trained to preserve that trust, even under pressure from regulators like the ATO or AUSTRAC.
Tranche 2, however, introduces a new obligation that can feel like it’s at odds with that protection. If you suspect your client is involved in money laundering, are you now required to report them? Wouldn’t that breach confidentiality, or worse, violate privilege?
The answer is nuanced. While Tranche 2 introduces mandatory reporting, it doesn’t override LPP. Section 242 of the AML/CTF Act makes this clear: legal practitioners are not compelled to report information that is subject to client legal privilege.
However, the new obligations do require legal professionals to rethink how they assess risk and when their duty to report applies.
Where the boundaries lie
It’s essential to distinguish between:
- Legal professional privilege (LPP) – protects advice and litigation-related communications
- General confidentiality – covers broader client information, including commercial dealings
- Statutory obligations – override confidentiality in some regulated scenarios.
AUSTRAC has confirmed that LPP will remain protected under the new laws. Lawyers will not be compelled to disclose privileged communications and will be able to assert privilege using an AUSTRAC-provided LPP claim form. This form allows you to formally declare that certain information is protected by LPP, providing a clear and documented assertion of privilege.
(Note: ministerial guidelines will be issued at a future date to provide details on the process for managing and resolving assertions and claims of LPP.)
As AUSTRAC states:
“The common law doctrine of legal professional privilege will remain unchanged under the reformed laws. This ensures that the AML/CTF Act does not require disclosure of any information or document that a person reasonably believes is subject to legal professional privilege.”
But not all information provided by clients is privileged. Many AML-relevant services, such as forming a company, managing a trust or handling funds, are administrative or transactional in nature and unlikely to be protected by privilege.
To complicate things further, obligations may arise before a formal lawyer-client relationship is established. For example, if a lawyer develops a suspicion during an initial consultation, they may be required to report it, even if the privilege hasn’t attached.
And as seen in the UK, where similar AML laws apply to the legal profession, the practical application of privilege is often narrower than many lawyers expect. Determining whether a communication is truly privileged can be complex and disputing that determination can be costly.
The Law Council's position
The Law Council of Australia has strongly expressed concerns about Tranche 2 and its impact on legal practice and the justice system.
In its February 2025 submission on the draft AML/CTF rules, the Council warned of significant consequences if legal practitioners are treated the same as financial institutions.
Key concerns include:
- Undermining client confidentiality and LPP
- Eroding trust between lawyers and clients
- Jeopardising the independence of the legal profession
- Increasing regulatory burden and costs
As the Council noted, compelling lawyers to disclose information in compliance with AML/CTF laws may effectively turn them into agents of law enforcement — a role fundamentally at odds with their obligations to their clients. In short, lawyers would become compelled to disclose information that they are duty-bound to keep confidential.
The Law Council has called for:
- Clearer guidance from AUSTRAC on the scope of LPP in SMRs
- Stronger protections for sensitive information (e.g. redaction or secure reporting channels)
- More education and training to help legal professionals understand and meet their obligations
A voluntary, best-practice risk management model, rather than full regulatory alignment with financial entities.
How law firms can prepare for this balancing act
Despite the concerns, Tranche 2 will proceed from July 1 2026. Here’s how law firms can prepare to navigate this complex regulatory landscape:
1. Clarify the boundaries of privilege
Ensure your staff understand what is and isn’t protected under LPP. Internal policies, legal training and guidance from your professional body can support clearer decision-making. Be sure to stay up to date with AUSTRAC’s latest guidance.
2. Document your reasoning
If you choose not to submit an SMR due to LPP, keep a clear and detailed record of the legal basis for your decision. This shows your firm is acting in good faith and provides a defensible audit trail.
3. Identify red flags earlier
Use automated identity verification technology to detect high-risk factors early, such as politically exposed persons (PEPs), adverse media, or complex offshore structures. Early detection gives your firm time to assess risk without being rushed into compliance decisions.
4. Standardise your reporting process
Develop a firm-wide policy for handling suspicious matters, including who is responsible for making the final decision to report, how to document that decision, and how to escalate concerns. Proactively monitor AUSTRAC’s website to ensure you are fully prepared to comply with the specific procedures for asserting legal professional privilege.
Where technology can help
Technology won’t resolve legal privilege debates, but it can give your firm the structure, speed and certainty it needs to respond effectively.
Advanced identity verification and AML tools support your compliance efforts without sacrificing confidentiality:
- Early warning systems, including biometric checks, document analysis, and real-time watchlist screening, help flag suspicious activity before it becomes a privilege issue.
- Automated recordkeeping: Secure, encrypted systems ensure that only authorised staff can access sensitive information and keep it safe for the required seven-year retention period.
- Privacy-first design: Many IDV solutions offer anonymisation or tokenisation, reducing the exposure of client data while meeting regulatory requirements.
- Audit trails: Digital logs make it easier to prove compliance, document decisions and respond to future AUSTRAC requests without over-disclosing information.
The right technology partner doesn’t just tick a compliance box. It helps your firm demonstrate professionalism, protect client data, and avoid mistakes in a rapidly changing environment.
Final thoughts
Tranche 2 places new responsibilities on legal professionals, not to undermine trust, but to play a greater role in protecting the financial system from abuse.
Handled carefully, these changes won’t force lawyers to abandon their professional duties. But they will require new skills, systems and support. With the right tools and training, law firms can honour their ethical obligations while fulfilling their legal ones.
Need help simplifying your AML/CTF compliance?
Partnering with a trusted provider like GBG can ensure you meet all regulatory requirements while minimising disruption to your client experience. Contact our team of experts today to learn more about how we can help.
