New anti-money laundering and counter-terrorism financing laws take effect on 1 July 2026, and accounting firms are among those now covered. From that date, DFK Everalls becomes a reporting entity, which changes how we onboard and manage certain client engagements.

We have been preparing for these changes for some time and want to ensure our clients understand what is happening, what it means in practice, and how we are handling the additional data obligations that come with them.

For most clients, day-to-day work continues unchanged. Where the new requirements do apply, we will make the process as straightforward as possible.

Why is this happening?

Australia’s anti-money laundering framework has long covered banks and financial institutions. Professional services firms, including accountants, lawyers, and real estate agents, have been a recognised gap in that framework for years.

Australia has been on FATF’s radar for years. FATF is the international body that sets the rules on financial crime prevention, and our professional services sector was a known gap in the framework. Parliament closed that gap in late 2024, with the new obligations taking effect from 1 July 2026.

Which services are affected?

The obligations apply to what the law defines as ‘designated services’. These are not your routine accounting tasks. They relate to higher-risk engagements involving transactions, structures, or the movement of assets.

For DFK Everalls clients, the services most likely to trigger the requirements include:

• Buying, selling, or transferring real estate as part of a transaction we are assisting with
• Setting up, restructuring, or transferring a company or trust
• Buying or selling a business or business interest
• Managing or holding funds or assets as part of a transaction
• Arranging debt or equity financing
• Acting as a director, trustee, or company secretary on your behalf
• Providing a registered office or principal place of business address

Tax returns, BAS, payroll, and general advisory work are not designated services. Those engagements continue as they always have.

What we will need from you

When you engage us for a designated service, we must verify your identity and understand the nature of the engagement before we can begin. This applies to new and existing clients alike. The law makes no exception for long-standing relationships.

For individuals

We will typically ask for a current passport or driver’s licence, a Medicare card or similar, and proof of your residential address. In most cases we can do the verification electronically, so you will not need to come in.

For companies, trusts, and complex structures

This is where the requirements go further, and it is the area most relevant to a significant portion of our client base.

Where a company or trust is involved in a designated service, we are required to look through the entity and identify its beneficial owners: the real people who ultimately own or control the structure, even if they are not the named party to the transaction.

Depending on your structure, we may ask for:

• Company registration details and ACN
• Names and identity documents for directors
• Details of shareholders holding 25% or more
• For trusts: the trust deed, trustee details, and information about beneficiaries

For clients with layered structures across multiple entities, this mapping process takes a little time. We will work through it with you and be clear about exactly what we need and why.

In higher-risk situations

Some engagements require us to go further. If we are acting for a politically exposed person, dealing with international transactions, or handling a high-value or complex matter, we will carry out additional checks. This may include asking about the source of funds or wealth involved.

We know this feels like a significant ask. For most clients, it will not arise. When it does, we will explain why and handle the information with appropriate care.

How we are handling your data

The new framework creates real obligations around data collection, storage, and security. This is the area our clients have asked about most, and rightly so.

Under the new framework, we are required to collect verified identity information, beneficial ownership details, and in some cases source of wealth documentation, and keep all of it for a minimum of seven years. For most accounting firms, including us, this represents a step up in the volume and sensitivity of personal data we formally hold.

What this means in practice

We have reviewed our data security infrastructure and are strengthening it where needed, so that AML/CTF records are stored securely, access is limited to the right people, and we can meet any breach notification obligations. Identity documents and ownership information are held separately from your general client file.

We are also looking closely at how we collect information digitally. We may be using approved new software to assist with these processes. When you provide identity or ownership details through our onboarding process or client portal, you will see a clear privacy notice explaining what we are collecting, why we need it, and how it is stored.

The privacy connection

The AML/CTF changes are not happening in isolation. Broader Privacy Act reforms are also in progress, aimed at strengthening how businesses collect, handle, and disclose personal information. They are separate laws, but they point in the same direction — and professional services firms are squarely in scope for both.

We are treating both sets of obligations together rather than in isolation, which means the data practices we are putting in place for AML/CTF compliance will also support our broader privacy responsibilities.

If you have specific questions about how your information is handled, please speak with your adviser. We are happy to walk through our approach in detail.

Timing and what to do now

You do not need to do anything today.

If you have a transaction, restructure, or structural matter coming up, bring it to us early. The verification process is straightforward, but it takes time. No one wants to be chasing paperwork the week a deal is due to settle.

If you are not sure whether your planned engagement falls under the new framework, ask us before work begins. That is the easiest way to avoid any disruption to your matter.

DFK Everalls has been preparing for these obligations well ahead of the July 2026 commencement date. Our AML/CTF program and our data practices have been reviewed to meet the new requirements.

These are real changes, and we are not treating them lightly. Where they affect your work with us, we will make sure the process is clear, the ask is complying with requirements, and the whole thing is handled the way you would expect from us.

Please get in touch with your DFK Everalls adviser if you have any questions.