So we recorded one. The video below is a live run-through of a client AML check from start to finish. This article walks through what it shows and what it means for your firm.

First question: do you even need to do this?

Not every accounting firm is in scope, and the firms that are do not check every client.

AML obligations are triggered by the service you provide, not by your job title. AUSTRAC calls these designated services. If you provide one, the client receiving it needs to be checked. If you do not, you do not.

For accounting firms, designated services generally include setting up or running a company or trust, acting as or arranging a director, secretary or trustee, managing client money or assets, and helping buy, sell or transfer a business or real estate. Routine work such as preparing tax returns, financial statements and BAS is generally not a designated service on its own.

If you are not sure where your firm sits, AUSTRAC has a self-assessment tool that walks you through it.

The practical takeaway: you check clients at the point you provide a designated service. Not every person on your client list, and not every transaction.

The two jobs inside every check

Strip away the jargon and every AML check comes down to two jobs.

1. Work out the risk. Is this client low, medium or high risk for money laundering or terrorism financing? You make that call, and you record it.
2. Verify the identity. Confirm the client is who they say they are, against trusted, independent sources.

That is the spine of the whole thing. Everything else is detail hanging off those two jobs.

What the checks actually are

In the demo, the checks run in this order, all from the same onboarding flow:

Identity verification. The client scans their licence and takes a biometric selfie on their phone. Most clients never leave their phone to do it, and you are almost certainly doing some version of this already.

AML background check. This confirms the person against background data such as addresses and credit footprint, which helps verify they are who they claim to be.

PEP and sanctions screening. This flags politically exposed persons and anyone on a sanctions list.

Adverse media. Negative news and information that may not sit on any formal list. You only need this for enhanced customer due diligence, which usually means a client you have already assessed as higher risk. For most firms, with most clients, you will not run it.

The point of running these is not to hand over the decision. The tools surface the information. You make the call and record why.

A clean result is still a result

This is the part that trips people up. If a check comes back with no match, that is not a failure and it is not a dead end. Plenty of people have no adverse media, no sanctions hit and a thin credit file. A no match simply means nothing flagged.

What matters is that you record a determination either way. In the demo, that means assigning a risk rating, writing the short reason for it, and generating a PDF report that sits on the client’s file. If anyone ever asks how you reached your decision, the record is right there.

A check is not a loop you get stuck in. You put the result on the screen, read it, make the call, record it, and move on.

Where it fits in the work you already do

The reason the demo runs start to finish in one place is that the checks are built into onboarding rather than bolted on as a separate system.

A few things worth pulling out:

Lead links. You can add AML questions to a lead form, so a prospect answers a few questions before you have taken them on. That helps you decide whether you even want the work, before you provide any designated service.

Existing clients. You do not need to re-onboard people you already know. If a current client asks you to set up a company, you can pull their details from data already synced with Xero Practice Manager and run the check from there.

This sits inside Seamlss, with identity and screening powered by GBG and Comply Advantage and data held on Microsoft Azure. Checks run at $7.70 per AML screening and $5.50 for ongoing monitoring, both including GST, so the per-client cost is easy to predict.

What to do before 1 July

If your firm provides designated services, the short list is:

1. Enrol with AUSTRAC. Enrolment is open now and closes on 29 July 2026 for firms providing designated services from 1 July.
2. Put an AML program in place: a risk assessment, a named compliance officer, staff training, and your client due diligence and record-keeping processes.
3. Get your checks ready to run inside the onboarding you already do.

AUSTRAC has been clear that programs should be proportionate to the size and risk of your firm. A small practice does not need a bank’s compliance department. The goal for 1 July is simple: be enrolled, have a workable program, and be able to run and record a check when a designated service comes up.

Watch the full check

The recording shows the whole process on screen, including the questions that came up live from accountants on the call. If you would rather see it run with your own client data, you can book a demo.

This article is part of our AML series for accounting firms. For the full picture of what onboarding looks like under the new obligations, start with Tranche 2 for accountants: what onboarding actually looks like. To see how Seamlss handles these checks inside onboarding, see the AML Compliance Hub in the help centre.

The question is “what does this actually look like with a real client in front of me?”

That’s what we did at the last AML Accountants Forum. Less theory. Two real client scenarios, walked end to end. Same intake form. Completely different work.

Here’s the seven-step process every client onboarding runs through under the new rules, with two clients, Sarah and Marcus, used to show what it looks like in practice.

Two leads. Same form. Different files.

Two new leads come into your firm on the same day.

Sarah Wilson is in Melbourne. She’s filled in your website form. She wants a new Pty Ltd set up.

Marcus Reid is referred by one of your partners. Played golf with him for years, sound bloke, just put him through. He wants a corporate restructure plus a discretionary trust.

That’s all you know on day one. What follows is the same process applied to both of them. Same intake form. Same firm. Same staff doing the work. Two completely different outcomes.

The seven-step framework

Every client onboarding under the new AML/CTF rules runs through the same seven steps:

1. Inquiry
2. Designated service check
3. Identity and beneficial ownership
4. Country risk
5. Risk rating
6. Customer due diligence (Standard or Enhanced)
7. Decision

Doesn’t matter if they’re low risk or high risk. The steps are the same. What changes is the depth at each step.

The fork is at step 6. Standard CDD or Enhanced CDD. The trigger isn’t the client type. It’s not “individuals are easy, companies are hard.” The fork is decided by the rating from step 5.

That’s the bit most firms get wrong. Let’s walk it.

Step 1: Inquiry

Both clients land on the firm’s intake. New leads, captured, logged.

Nothing complicated here for either of them. The point is that you’re capturing what triggers the AML obligations downstream. Channel, services requested, who referred them. It all feeds the risk framework later.

Sarah: website form, Pty Ltd formation requested.

Marcus: partner referral, restructure plus trust setup, substantial fees.

Worth noting that the source of a lead can itself be a risk factor in some firms’ frameworks. Cold web enquiries from unknown clients in unusual industries can warrant a closer look. Long-trusted partner referrals can lull a firm into doing less work than they should. Both are real patterns, and your risk framework should anticipate them.

Step 2: Designated service check

This is the gate check. If what the client is asking for isn’t a designated service, the AML obligations don’t apply.

Most firms think AML applies the moment a client walks in the door. It doesn’t. It applies when you provide a designated service. Tax returns alone are not a designated service. Company formation is. Trust formation is. Acting as registered office is.

Sarah: company formation (item 6) plus registered office (item 9). Two designated services.

Marcus: company restructure (item 6), trust formation (item 7), registered address (item 9). Three designated services.

Both clients are now in the AML pipe. Same outcome at this step.

A practical note: many firms provide ongoing designated services without realising it. Acting as registered office is a designated service that quietly continues for years. So is providing trustee services or beneficial owner registers. If you’re providing one of those on an ongoing basis, the AML obligations don’t end when the client is onboarded. They continue, and they trigger periodic reviews and trigger-event reviews for as long as the service is being provided.

Step 3: Identity and beneficial ownership

Now we start to see them diverge.

For Sarah, this is clean. She’s the sole director and 100% shareholder. She’s an Australian resident, passport and address verified. The beneficial owner is Sarah. One human, one entity, no layering. Identity and BO verified, low risk.

For Marcus, this is where the work multiplies. He’s the sole director of three interlinked companies. One of those companies is registered in the British Virgin Islands. The trust beneficial ownership chain isn’t immediately clear. Discretionary trusts have multiple BO candidates: settlor, trustee, beneficiaries with 25% or more, and anyone with control like the appointor.

Marcus’ BO mapping isn’t a straight line. It’s an opaque chain through interlinked entities, and you’ve got to look at each layer.

This is where AML actually gets hard. As Ags from LYRA Risk and Compliance put it on the day, AML doesn’t fail on Sarah. It fails on Marcus. The 90 percent of clients you onboard cleanly aren’t where the risk lives. The risk lives in the 1 to 5 percent that catches firms out.

There’s a related point that came up several times in the Q&A. The cultural shift this represents for accountants is genuine. “I’ve known him for years, he’s a great guy, just put him through” is exactly the attitude that doesn’t fly anymore. It doesn’t matter how long you’ve known the client. It doesn’t matter that they’re a partner referral. The work has to be done, the evidence has to be on file, and the assessment has to be documented. AUSTRAC will not accept “I knew him” as your control.

Step 4: Country risk

For Sarah, this is a one-line check. Australia, Basel AML Index 0.9, no foreign jurisdictions involved. Country risk: low.

For Marcus, this step changes the engagement. Singapore is a medium-risk jurisdiction on Basel. But the BVI is FATF-monitored, which forces the rating to high regardless of where the client lives. The foreign jurisdiction overrides the Basel rating.

This is one of those bits where you genuinely need to know what to look for. Most accountants haven’t memorised which jurisdictions trigger automatic high. That’s where partnering with someone like Ags, or using a tool that flags it for you, earns its keep.

A question that came up in the Q&A: how do you even know a client has foreign exposure if they don’t volunteer it? You ask. Your intake form needs questions about beneficial ownership in foreign jurisdictions, foreign tax residency, and foreign source of funds. If they answer no and it later turns out they had a BVI entity all along, the responsibility shifts. You did the work. You asked the question. The client misled you. That’s a different situation than not asking at all.

Step 5: Risk rating

Step 5 is where the rating gets fixed. From here the path forks.

Sarah: PEP screening clear, sanctions clear, no elevated factors. Overall rating: low.

Marcus: one high-risk factor (BVI exposure) is enough to land the whole engagement at high. There’s also a foreign PEP connected to one of the entities. That alone forces Enhanced CDD.

A useful thing to remember: a single high-risk factor lands the whole engagement at high. You don’t average it out. You don’t wait for two or three. One is enough.

Worth flagging here that this is a risk-based approach, not a checklist. The Act gives you discretion in big chunks of how the rating is built. You’re the one applying the lens. Two firms with the same client could legitimately land on different ratings if their risk frameworks weight things differently. What AUSTRAC will look for is whether you’ve thought about it, documented your reasoning, and applied your framework consistently. Not whether you got the same number as the firm down the road.

Step 6: CDD

This is the fork. Sarah goes one way. Marcus goes the other.

Sarah’s path: Standard CDD

Sarah gets Standard CDD. ID documents verified. ASIC search clear. Nature and purpose of the engagement confirmed. This is the path 80 percent of your clients will follow. Done in a day, file the docs, move on.

The work at this step for a low-risk client is quick. The point isn’t to over-engineer it. The point is that you’ve done it consistently, applied your framework, and have the evidence on file.

Marcus’ path: Enhanced CDD

Marcus gets Enhanced CDD. That means:

• Source of funds (where is the money for this transaction coming from)
• Source of wealth (how did the client accumulate the wealth in the first place)
• Adverse media screening
• Senior manager approval before onboarding
• Enhanced ongoing monitoring throughout the engagement

Source of funds and source of wealth is the heaviest piece. You’re asking for bank statements, tax returns, sometimes sworn statements. Clients push back on this. The honest answer is that it’s been standard practice in financial services since 2006. The banking world has been doing it for nearly 20 years. The accounting world is just catching up.

A point Ags made on the day is worth repeating here: banks have spent billions on AML systems and still get it wrong. The expectation isn’t that small accounting firms run bank-grade controls. The expectation is that you do enough, consistently, with documentation that a reasonable assessor can follow.

Senior manager approval is the bit small firms ask about most. In a five-person practice, who is the senior manager? It can be the AML Compliance Officer, who in many small firms is also the principal. The point is that one person, with the right authority, signs off before the client is onboarded. Document who, when, and on what basis.

Adverse media is the step firms most often skip without realising they shouldn’t. For low-risk clients, you can usually rely on PEP and sanctions screening alone. For high-risk clients, adverse media screening is part of Enhanced CDD. That means a structured search for media coverage that might indicate criminal involvement, regulatory action, or reputational risk. Tools do this for you. If you don’t have a tool, you do it manually, and you document what you searched and what you found.

Step 7: Decision

This is the step nobody talks about until they get to it.

For Sarah it’s straightforward. Accept, onboard, file the engagement letter and ID docs, schedule a review in three years (LOW risk default, you can always do it more often based on your firm’s risk appetite).

For Marcus, there are three real options:

1. Continue with enhanced controls (annual reviews, ongoing monitoring, Enhanced CDD applied at every cycle)
2. Decline the engagement (some clients aren’t worth the risk-adjusted return)
3. Onboard with conditions and a defined exit clause

The decline option is real. If a client is outside your risk appetite, document the assessment and don’t take them on. AUSTRAC doesn’t punish you for declining. They punish you for onboarding without doing the work.

A point on documenting the decision. Whatever you decide, the evidence trail needs to capture not just what you decided but the policy version that governed the decision. Risk frameworks change over time. AUSTRAC guidance changes over time. If you’re audited in 2028 on a decision made in 2026, you want to be able to show “this is the framework we were operating under at the time, this is the rating it produced, and this is the decision that flowed from it.”

What this looks like once they’re onboarded

Onboarding is one piece. Ongoing monitoring is the other.

For Sarah, ongoing monitoring is light. She’s on a three-year review cycle. That review can be triggered earlier by what AUSTRAC calls trigger events: changes in the client’s circumstances, changes in the services you’re providing, or red flags in the day-to-day work. If nothing changes, it’s a periodic review every three years.

For Marcus, ongoing monitoring is enhanced and continuous. Annual reviews at minimum. Every transaction or event watched. Adverse media screening run periodically. Source of funds reverified if circumstances suggest the picture has changed.

It’s worth being clear about what ongoing monitoring is and isn’t. For accountants, ongoing monitoring is not bank-style transaction surveillance. You’re not watching every transaction in real time. You’re checking in periodically, watching for trigger events, and reassessing the risk rating on a defined cycle. Some competitors will try to sell you continuous transaction surveillance. That’s not what the regime requires for accounting firms.

Suspicious matters and the offence most firms don’t realise exists

One topic from the Q&A worth pulling out into its own section: Suspicious Matter Reports.

If you form a suspicion during the course of providing a designated service, you have an obligation to lodge a Suspicious Matter Report with AUSTRAC. The bar for “suspicion” is lower than “reasonable belief” but higher than “passing thought.” If you’ve got concrete reasons to think something’s off, you lodge.

Here’s the bit firms don’t always know. Once you’ve decided to lodge an SMR, telling the client that you’re doing it is a criminal offence. It’s called tipping off. It carries serious penalties. You can’t tell them, you can’t hint, and you can’t engineer the engagement in a way that effectively reveals it. You proceed normally with the engagement to the extent the law allows, and you let AUSTRAC do their work.

This is one of those areas where small firms can stumble badly without meaning to. A staff member trying to be helpful saying “we just need a bit more info from you, we’ve got some concerns” can be the offence. Train your team. Make sure everyone who interacts with the client knows what to say and what not to say once an SMR has been raised internally.

What this means in practice

A few things stand out from running both scenarios side by side.

The seven-step process is the same regardless of risk. What changes is the depth at each step. Sarah’s onboarding takes a day. Marcus’ takes about a week.

The risk rating drives the fork, not the client type. Don’t get caught thinking individuals are easy and companies are hard. Sarah was a company. Marcus had an individual at the top of his structure. The rating is what matters.

Most of your work will look like Sarah. Build your firm’s process so the low-risk path is fast and clean. Reserve the heavy lifting for the cases that actually need it.

And the bit that came up most in the Q&A: this is a risk-based approach, not a yes/no checklist. AUSTRAC wants you to think, not just follow a process. The Act gives you discretion in big chunks of how the assessment is built. You’re the one applying the lens. Document your decisions, document the policy version that governed them, and you’ll be fine.

What’s next

If you’d like to watch the full session, including the 30-plus minutes of Q&A on trusts, crypto, cash transactions, registered office reviews and more, it’s up on YouTube here:

The next AML Accountants Forum is on the last Thursday of the month at 12pm Sydney time. We’re doing a deep dive on trusts, which came up repeatedly in the Q&A and deserves its own session. Register here: [link to next forum].

If you want to try Seamlss for client onboarding, ID verification, engagement letters and document management, there’s a free trial at app.seamlss.com.au. The AML module is in build and we’ll have more to show in the coming weeks.

If you want hands-on help getting your AML/CTF program audit-ready before 1 July 2026, Ags’ team at LYRA does that work directly: lyrariskcompliance.com.au.

See you at the next forum.

Questions from the session

Some of the live questions and a few that came in via the registration form. The full Q&A is in the recording.

If I onboarded a client a few months ago and ID’d them then, do I have to do it all again when they engage me for a new designated service?

If the information is still valid and recent (within about three months), no, you don’t need to re-verify. If it’s been a year, you should run the checks again. Pre-commencement clients don’t need to be re-ID’d until they engage in a designated service post 1 July 2026. The whole approach is risk-based, not a fixed re-verification cycle.

What triggers a review for ongoing registered office services?

Two things. First, your defined periodic review cycle (every three years for low risk by default, more often if your firm wants it). Second, a trigger event: the client changes their address, changes a director, or anything else that itself constitutes a designated service. When that happens, the review cycle restarts.

If a client is investing in crypto, does that automatically make them high-risk?

No. An individual buying and selling crypto on the side is not your concern. The crypto exposure becomes relevant if it links to structures you’re setting up: an SMSF that holds crypto, a crypto trading company, or similar. In those cases the customer profile may shift up the risk scale, but personal investment in crypto by itself doesn’t drive an accounting client into high risk.

Do we need to monitor all cash transactions in and out of a client’s bank account?

No. That’s the bank’s job, and they get fined billions when they get it wrong. Your concern is cash that comes directly to you, in payment for your services. You’re not running surveillance on your clients’ bank accounts unless you spot suspicious behaviour.

How do I know if a client has foreign exposure if they don’t tell me?

You ask. Your intake form needs questions about foreign tax residency, foreign beneficial ownership, foreign source of funds, and any international entities in their structure. “They didn’t tell me” is not a defence. “I asked, they said no, I documented it, and it later turned out they lied” is a different situation, and that’s grounds for an SMR.

Beneficial ownership in a discretionary trust where someone listed 20 family members 20 years ago. Who do I check?

The 25% threshold applies to anyone who actually stands to benefit. For discretionary trusts, the people you check are the ones with control (the trustee, the appointor) and the actual beneficial owners (anyone with a 25% or greater interest in distributions). You don’t ID 20 distant relatives who once received small distributions. You ID the people the structure is actually built around.

When can I raise a Suspicious Matter Report?

Any time you form a suspicion during the course of providing a designated service. The bar is “suspicion,” which is lower than “reasonable belief” but more than a passing thought. SMRs can cover money laundering, terrorist financing, fraud, scams, sanctions evasion, and tax evasion. There are no wrong answers when raising one. AUSTRAC has been clear that under-reporting is the bigger problem.

Can I tell my client I’m raising an SMR?

No. Telling a client you’re raising an SMR is a criminal offence. It’s called tipping off, and it carries serious penalties. Don’t tell them, don’t hint, don’t engineer the engagement in a way that effectively reveals it. The SMR sits between you and AUSTRAC.

Questions we didn’t get to

A few questions came in via the registration form that we didn’t get to in the live Q&A. Worth answering here.

Which should come first: the engagement letter or KYC?

Practical order: KYC first, engagement letter second, conditional on KYC passing. Otherwise you’ve signed up to a client you may have to refuse to act for. Some firms run the KYC process under a separate “KYC engagement” or scoping letter that authorises the checks, then the full engagement letter is issued only if the client passes. That structure protects you both ways: you’ve got authority to run the checks, and you haven’t committed to acting.

If you’ve already issued the engagement letter and KYC subsequently fails, document the issue, decline to proceed with the engagement, and refer to your firm’s risk framework on what notice (if any) you give the client. Be careful here, because the reason for refusal may be something you can’t disclose under the tipping-off rules.

What is the bare minimum a sole practitioner needs to do to be compliant?

The minimum is the same as for any other firm. The seven steps still apply. The work scales with the risk profile of your client base, not the size of your practice.

In practical terms, for a sole practitioner with a domestic, low-risk client base:

• Documented AML/CTF program (one document)
• Documented risk assessment (one document)
• Onboarding process that captures designated services, runs ID and PEP/sanctions checks, and assesses risk
• Periodic reviews on a defined cycle (three years for low risk by default)
• Trigger event reviews when something changes
• Records kept for seven years

You are also the AML Compliance Officer in a sole practitioner firm. That’s not a problem, it just means you’re the one who signs off on enhanced cases when they come up.

Does Item 6 “restructuring” cover routine ASIC agent work?

Item 6 covers company formation and restructure of an existing company. Routine ASIC agent updates (change of officeholder, change of address, registration or cancellation of a business name, deregistration) are not in themselves “restructuring” in the AML/CTF sense. Restructuring implies a material change to the entity structure: changes in beneficial ownership, share class structure, parent company arrangements, or similar.

That said, those routine ASIC services may still constitute Item 9 (registered office or address services) on an ongoing basis. So the AML obligations attach via Item 9, not Item 6. The trigger event for the periodic review is when the client makes the change, not when you file it for them.

Do we need to do anything for existing clients?

Not until 1 July 2026. Pre-commencement clients are grandfathered in the sense that you don’t need to retrospectively run AML checks on them just because the new regime starts. But the moment a pre-commencement client engages you for a designated service after 1 July, the AML process kicks in for that engagement, and that’s when you do the checks.

If I’ve decided not to provide any designated services from 1 July, should I still register with AUSTRAC?

If you genuinely don’t provide any designated services, you don’t need to enrol. There’s no requirement to “register and declare yourself out.” But be careful here: tax services alone aren’t a designated service, but if you act as a registered office, prepare or assist with company formation, set up a trust, or hold yourself out to provide any of the nine designated services, you’re in scope. If in doubt, run your service list against the designated service list (Item 1 to Item 9) and document your conclusion. That document itself is part of your governance.

More AML guides for accounting firms

• Customer due diligence for accountants: what Australia’s new AML laws actually require
• How to implement AUSTRAC’s 30 AML documents
• What an AML check actually looks like for an accounting firm
• The 7 AML questions every accounting firm is asking right now
• AML for accountants: AUSTRAC starter kit
• You can stop panicking about AML compliance now
• AML Compliance Hub
• AML Risk Assessment

To see how Seamlss builds these checks into client onboarding, see plans and pricing or watch the demo.

Clients, Contacts and Groups

The biggest change explained. What Contacts and Entities are, why they’re separate, and how it all connects to ID verification and AML.

Read the help guide

Dashboard Overview

Your requests are now in one consolidated view. See how to switch between Drafts, Follow-ups, and Actioned, plus sorting, filtering, and quick actions from the three-dot menu.

Read the help guide

Onboard Your First Client

The updated request flow from start to finish – adding a Contact and Entity, selecting forms, attaching ID verification, customising the engagement letter, and sending it out.

Read the help guide

Push Data to XPM

Syncing now works at the Entity level, not the Contact level. This video shows how to find the Entity, push it to XPM, and sync or merge with existing XPM records.

Read the help guide

More on the way

These four videos cover the areas that generated the most support questions. We’re working on more, including guides for custom forms, ID verification, ethical clearances, and searching across contacts and clients. We’ll update the help centre as each one is ready.

The good news: FBT doesn’t have to mean weeks of back-and-forth emails, lost workpapers, and clients throwing your Excel template straight in the bin. With the right system, it becomes one of the most predictable workflows in your practice.

This guide walks through a practical framework built around two Fetch Forms, Smart Links, and a follow-up sequence that protects your firm while making life easier for clients.

What’s New for FBT 2026

Three changes firms need to brief clients on this year:

1. Dual-cab utes are an ATO priority. The ATO has named FBT compliance as one of its quarterly small business priorities for 2026, with dual-cab utes specifically called out. The common assumption that utes are automatically exempt is wrong. Exemption depends on both the vehicle’s design (one-tonne load capacity or passenger-purpose test) and actual use (minor, infrequent, and irregular private use only). Many popular models fail the load test. Worth flagging with every tradie, construction, and agriculture client on your books.
2. PHEVs lost their exemption from 1 April 2025. Plug-in hybrid electric vehicles are no longer classified as zero or low-emission vehicles under FBT law. New arrangements entered into after 1 April 2025 attract full FBT. Existing arrangements may still qualify if a financially binding commitment was in place before that date and no changes have been made. Clients with salary-packaged PHEVs need this reviewed.
3. Data-matching is catching non-lodgers automatically. The ATO now cross-references state motor vehicle registries, payroll records, and BAS data to identify businesses with company-registered vehicles that have never lodged an FBT return. The ATO has publicly used a Melbourne restaurant case study where the total liability reached $938,000 (base tax plus a 75% penalty for reckless behaviour plus interest). Penalties for failure to lodge can reach up to 200% of the tax owed, plus interest.

These three shifts are why the audit-window argument is now the strongest hook for client conversations. If a client never lodges, the ATO can go back to day one of the business. A lodged return (even a nil one) caps the review window at three years.

Key Dates for FBT Year Ending 31 March 2026

• FBT year ends: 31 March 2026
• Self-lodgers return due: 21 May 2026
• Tax agent electronic lodgement: 25 June 2026
• Payment due (agent lodgement): 25 June 2026

Build your internal timeline back from these dates. Most firms should be distributing their client forms by 28 March 2026 to give themselves processing time.

The FBT Challenge

Tracking down logbooks, salary package details, and entertainment expenses is time-consuming and error-prone. The back-and-forth drags on for weeks and increases the risk of missed deadlines.

With the right systems in place, you can:

• Eliminate repetitive manual chasing
• Automate client follow-up and document collection
• Create a clear documentation trail that protects your firm
• Integrate directly with XPM and your existing practice management tools

Before You Begin: Get the Engagement Letter Signed

Before you send a questionnaire, chase a logbook, or open a workpaper, get the engagement letter signed.

This isn’t just good practice. From 1 July 2025, the TPB’s updated Code of Professional Conduct requires registered tax agents to have a written engagement in place that covers the scope of services, fees, complaints process, and a number of mandatory disclosures. FBT is no exception.

A compliant FBT engagement letter should cover:

• Scope of services (what’s included and what’s not)
• Fee arrangement and payment terms
• Client responsibilities (logbooks, declarations, timely information)
• Safe harbour explanation
• TPB mandatory disclosures – conflicts of interest, referral arrangements, complaints process
• NOCLAR obligations

Getting this signed upfront also protects your firm. If a client fails to provide information and you can’t lodge, you have a documented record of the engagement terms they agreed to.

Free template: We’ve put together a starting-point FBT engagement letter template you can adapt for your firm.

If you’re using Seamlss, you can paste the template straight in and have it client-ready in minutes, with digital signing built in.

Download the Free FBT Engagement Letter Template

The Two-Pathway System

This is the shift that makes the 2026 process work. Instead of one monster questionnaire, Seamlss gives you two Fetch Forms:

Pathway A: FBT Screening Form

Who it’s for: Clients you’re not sure about. The ones who might have an obligation but probably don’t. The ones you want a documented “no” from.

The screening form uses conditional logic, so clients only see a handful of simple yes/no questions upfront (vehicles, entertainment, salary packaging, car parking, expense reimbursements, loan forgiveness). If they answer no to everything, they’re done in under two minutes and you have a signed nil position on file.

Follow-up questions only appear when a client answers yes, so the form is as short or as detailed as the client’s situation requires.

Use this when: You want to send a wide net to your client base and protect your firm with documented nil sign-offs.

Pathway B: FBT Workpaper Data Collection Form

Who it’s for: Clients you already know have FBT obligations. The ones who lodged last year, the ones with company vehicles, the ones running salary sacrifice arrangements.

This form collects the detail your accountants actually need: odometer readings, logbook status, make and model, employee vs director use, entertainment breakdowns, receipts, and declarations. Conditional logic keeps it efficient – clients only answer questions for the categories that actually apply to them. A client with just one vehicle doesn’t wade through sections on entertainment, car parking, and employee loans.

It’s a proper workpaper replacement, not a triage tool, but it’s been built so clients move through it quickly.

Use this when: You’ve already triaged the client (or you know from history) that there’s a return to lodge.

How to Choose

Firms can use these forms however suits them. Some options:

• Send the screening form to your full client base, then escalate confirmed yes responses to the data collection form
• Send the data collection form straight to your known FBT clients (last year’s lodgers, ATO portal list), and the screening form to everyone else
• Embed the Smart Link in a blog post, SMS, or email campaign and let clients self-select
• Use Smart Links in your next-steps page after an engagement letter is signed

The point is: you’re not reinventing anything. You’re just making it easier for the client to respond and easier for your team to action.

Your 5-Step FBT Transformation Framework

Step 1: Set Up Your Internal FBT Process

Purpose: Establish clear responsibilities and workflows before FBT season begins.

Define team roles:

• Admin: Distribute Smart Links and Fetch Forms, track responses, handle initial follow-ups
• Client Manager: Handle technical queries, convert yes responses into workpaper tasks
• Partner: Review critical decisions and final sign-off

Create your tracking dashboard:

• Use the Seamlss dashboard (or your XPM job board) for real-time progress tracking
• Configure integration with your practice management system
• Establish status indicators: Not Started, Awaiting Client, In Progress, Complete

Set critical timelines for FBT 2026:

• Engagement letters sent and signed: Before any FBT work commences
• Smart Link distribution: By 28 March 2026
• First follow-up for non-responses: 7 days after distribution
• Final notice to non-respondents: 14 days after distribution
• Internal processing deadline: At least 2 weeks before lodgement due date

Step 2: Engage Clients With Smart Forms

Purpose: Quickly identify which clients require FBT services while making compliance easy.

Seamlss includes the two FBT Fetch Form templates you can add straight from the template library. To add these to your workspace, see Adding Template Forms in the Seamlss Help Centre.

Smart Forms transform your client outreach by:

• Using plain-language questions clients actually understand
• Showing only relevant follow-up questions based on previous answers
• Enabling document uploads directly within the form
• Auto-saving as the client progresses (so they don’t lose anything)
• Automatically notifying your team when submissions are complete

Pro tip from the field: Most firms have an Excel workpaper template somewhere that nobody actually enjoys filling out. Clients look at it, put it aside, and you end up chasing them for weeks. The Fetch Form replaces that. Same data, much better experience.

Distribution options:

• Mass BCC email to all potentially affected clients (fastest)
• MailerLite or FYI automated campaign
• Include the Smart Link in your blog post, newsletter, or SMS
• Use Zapier or FYI workflows to trigger after an engagement letter is signed

Ready-to-send initial outreach emails:

Option A: Screening Pathway (Mass BCC to Client Base)
Use when you want to send a wide net and identify who actually has FBT obligations. Most clients will get a documented nil return from this.

Subject: Quick action needed: Your 2026 FBT obligations made simple

Hi [First Name],

It's that time of year again. The ATO requires businesses to report on any fringe benefits provided to employees for the FBT year ending 31 March 2026.

Even if you don't think FBT applies to you, we need a documented position on file. Here's why that matters: without a lodged FBT return, the ATO can review your business going back to day one. A lodged return (even a nil one) caps that window at three years.

Dual-cab utes are a specific ATO priority for 2026, so if you have a work ute, this is worth flagging.

We've simplified the whole thing.

Instead of confusing paperwork, we've created a smart online questionnaire that:

- Takes a few minutes for most clients (longer only if FBT actually applies to you)
- Only asks questions relevant to your specific situation
- Guides you through exactly what (if anything) to upload
- Gives us a signed record of your FBT position for the year

Complete your quick FBT check here: [Smart Link]

Not sure what counts as a fringe benefit? Common examples include:

- Work vehicles used privately by employees
- Christmas parties, client events, or staff entertainment
- Employee loans, housing, or salary packaging arrangements

The questionnaire will walk you through these.

Need help? Reply to this email or call us on [Phone].

Regards,
[Your Name]
[Firm Name]

Option B: Data Collection Pathway (Known FBT Clients)
Use when you already know the client has FBT obligations. Last year’s lodgers, clients with company vehicles, or clients running salary sacrifice arrangements.

Subject: FBT 2026 - Time to collect your information

Hi [First Name],

We're kicking off FBT preparation for the year ending 31 March 2026.

Because you lodged an FBT return last year (or we know your business provides fringe benefits to staff), we need the detailed information to get this year's return done.

We've replaced the old Excel workpaper with a smart online form. It's much easier to complete:

- Auto-saves as you go
- Upload receipts, logbooks, and documents directly
- Only asks the questions that apply to your setup (skip sections that don't apply)
- Much quicker than the old Excel workpaper

Start your FBT data collection: [Smart Link]

What you'll need handy:

- Vehicle details (odometer readings, logbook if applicable)
- Details of any entertainment or staff functions
- Salary packaging or novated lease information
- Any employee loans or other benefits provided

Engagement letter terms are included in the form for you to sign before we start.

Any questions, reply here or call me on [Phone].

Regards,
[Your Name]
[Firm Name]

Step 3: Convert Responses to Actionable Tasks

Purpose: Transform client data into structured workflow items.

Initial sorting:

• All-NO responses: Routed to nil return preparation queue. Quick sign-off, engagement letter charged, done.
• YES responses: Flagged for full FBT assessment. Client manager reviews the conditional logic answers to see what’s needed.
• UNCERTAIN or partial responses: Flagged for immediate client manager follow-up (phone call).

Documentation review:

• Use the Fetch Form document upload to capture logbooks, invoices, and declarations
• Missing items trigger an InstaFetch request for the specific documents you still need
• No need to send a whole new form, just pull the exact file you’re missing

Workpaper preparation:

• Generate pre-populated workpapers directly from client responses
• Assign to the appropriate team member based on complexity

Schedule critical tasks:

• Set calendar reminders for method elections (50/50 split or 12-week register)
• Schedule final review dates and lodgement deadlines

Step 4: Strategic Client Follow-Up

Purpose: Secure responses from non-responsive clients without drowning your team.

The follow-up phase is critical. Each day without client confirmation increases your risk of missing the lodgement window.

Build your follow-up sequence into the workflow from the start:

• Day 0: Initial email or Smart Link sent
• Day 7: First follow-up (gentle reminder, why it matters)
• Day 14: Final notice / disengagement warning
• Day 21: Disengagement letter on file

Each stage escalates slightly in tone and urgency. Here are the templates:

Day 3 to 5: Pre-deadline nudge
Use when the client hasn’t opened or started the form yet, but it’s only been a few days. Keep it gentle.

Subject: Just a quick nudge - your FBT check

Hi [First Name],

Quick reminder that we sent through the FBT questionnaire for the year ending 31 March 2026.

If you've been meaning to get to it, now's a good time. It only takes a few minutes and gets the whole thing off your plate.

[Smart Link]

If FBT doesn't apply to your business this year, the form is even quicker. A few no's and you're done.

Any questions, just reply.

Regards,
[Your Name]

Day 7: First proper follow-up
No response after a week. Start building urgency with ATO context.

Subject: Important: Your FBT deadline is approaching - action required

Hi [First Name],

We sent through the FBT questionnaire a week ago for the year ending 31 March 2026, and haven't seen a response yet.

Why this matters:

The ATO has significantly increased audit activity in this area, using data-matching to identify businesses that:

- Provide company vehicles to employees (including dual-cab utes)
- Hold staff functions or entertainment events
- Offer salary packaging or novated lease arrangements

These potential fringe benefits require proper documentation, even if you ultimately have no FBT liability.

What happens if you don't respond:

- Without a lodged FBT return, the ATO can go back to day one of your business when auditing. A lodged return (even a nil one) caps that window at three years.
- Penalties for failure to lodge can reach up to 200% of tax owed plus interest. The ATO recently publicised a case where the total liability reached $938,000.
- Data-matching across motor vehicle registries, payroll, and BAS is now catching non-lodgers automatically.

The form only takes a few minutes for most clients and provides immediate protection.

[Smart Link]

Still have questions? Call us on [Phone].

Regards,
[Your Name]
[Firm Name]

Day 10 to 12: Mid-process escalation
One week out from the disengagement deadline. Signal that inaction has consequences.

Subject: One week left - FBT 2026

Hi [First Name],

We still haven't received your FBT questionnaire response.

We need it back by [Date] or we won't be able to lodge an FBT return for the year ending 31 March 2026 on your behalf. After that point, we'll need to formally record that you've elected not to engage us for FBT this year.

This isn't a threat. It's about protecting both of us. Without your data, we can't lodge. Without a documented record, neither of us has a defensible position if the ATO asks questions later.

If FBT doesn't apply to your business, the form is quick. A few no's and you're done with a signed nil position on file.

[Smart Link]

If you'd rather handle this over a quick call, ring me on [Phone].

Regards,
[Your Name]

Bonus: Post-submission follow-up (more info needed)
Use when a client has submitted the form but something is incomplete (missing logbook, unclear entertainment breakdown, etc).

Subject: Thanks for your FBT submission - one more thing

Hi [First Name],

Thanks for getting the FBT questionnaire back to us. We're working through it now.

To finish the return, we need a few more things from you:

- [Specific item 1]
- [Specific item 2]

I've set up a quick upload link so you can send these straight through: [InstaFetch Link]

No need to fill out another form. Just upload what's listed and we'll take it from there.

Regards,
[Your Name]

Bonus: Nil return confirmation
Use when a client completed the screening form with all no’s. Confirms their position and closes the loop.

Subject: FBT 2026 - All sorted

Hi [First Name],

Thanks for completing the FBT questionnaire.

Based on your responses, your business doesn't have an FBT liability for the year ending 31 March 2026. We've recorded your position on file.

What this means:

- No FBT return needs to be lodged for your business this year
- Your signed questionnaire is your documented position, which protects you if the ATO ever reviews prior years
- We'll be in touch again next FBT season (around March 2027) to re-check

If anything changes during the year (you buy a work vehicle, start salary packaging, run a staff function), let us know so we can reassess.

Invoice for this work is attached.

Regards,
[Your Name]
[Firm Name]

Step 5: Risk Mitigation Through Clear Disengagement

Purpose: Protect your firm with definitive documentation of client decisions.

If a client elects not to engage you for FBT (or simply doesn’t respond), you need a documented record. Without it, you’re exposed if they later get audited and claim you never told them.

Seamlss stores every form response, engagement letter, and reminder in one place with a timestamped audit trail. If a client doesn’t respond despite multiple reminders, you have a defensible position.

Two disengagement scenarios to handle:

1. Clients with previous FBT returns on file: More urgent. The ATO has history and will be expecting continuity.
2. Clients without previous FBT returns: Still need documentation. Even nil lodgements protect them from reverse-engineering years down the track.

Scenario 1: Clients with previous FBT returns on file
More urgent. The ATO has history and will be expecting continuity.

Subject: URGENT: Final notice regarding your FBT obligations

Hi [First Name],

Despite multiple attempts to contact you regarding your Fringe Benefits Tax obligations for the year ending 31 March 2026, we haven't received your response.

Important notice of disengagement:

As your tax professionals, we must formally document that:

- We have attempted to assist you in meeting your FBT obligations on [Dates]
- Without your completed questionnaire, we cannot lodge an FBT return on your behalf
- As of [Date], we will record that you have elected not to engage our services for FBT compliance this year
- Our firm cannot accept responsibility for any penalties or audit consequences arising from unmet FBT obligations

Because you've lodged FBT returns in previous years, the ATO will be expecting one for the 2026 year. A gap in lodgement history typically triggers review activity.

It's not too late to act: [Smart Link]

Please contact us urgently on [Phone] if you want to discuss this.

Regards,
[Your Name]
[Firm Name]

Scenario 2: Clients without previous FBT returns
Softer tone but still documents the position.

Subject: Protect your business: Final FBT compliance reminder

Hi [First Name],

Even businesses that haven't previously lodged FBT returns may still have obligations to assess and document their position each year.

Without a completed assessment, your business may be exposed to:

- Questions during future tax or compliance reviews
- Potential challenges to expense deductions (vehicles, entertainment, benefits)
- The burden of proving your position retrospectively, which gets harder as time passes

Our quick online questionnaire provides the documentation that protects your position:

[Smart Link]

It's the screening form, so if FBT doesn't apply to your business, you're finished in a few minutes with a documented nil position on file.

If we don't hear from you by [Date], we'll record that you've elected to handle your FBT compliance independently for the year ending 31 March 2026.

Need help? Call us on [Phone].

Regards,
[Your Name]
[Firm Name]

Measuring Your FBT Process Improvement

A robust FBT workflow gives you data you can actually use:

• Response analytics: Track client response rates and time-to-completion
• Efficiency metrics: Measure total admin time saved per client
• Risk dashboard: Visualise compliance gaps across your client base
• Year-on-year comparison: Track improvement in process efficiency

These metrics help refine your process each year while demonstrating clear value to partners and clients.

Client Resources: FBT FAQ

Providing this simple FAQ to clients reduces follow-up enquiries and helps clients understand why you’re asking.

Simple FBT FAQ for Clients

What exactly is Fringe Benefits Tax (FBT)?
FBT is a tax paid by employers on certain benefits provided to employees or their associates outside of regular salary and wages. It’s assessed for the year ending 31 March each year.

Why do I need to worry about FBT if I’ve never lodged a return before?
The ATO requires all businesses to assess their FBT position annually. Even if you ultimately have no liability, you need documentation showing you’ve properly evaluated your situation. A documented nil position protects you if you’re ever audited.

What happens if I ignore FBT obligations?
Penalties for failure to lodge can reach up to 200% of the tax owed, plus interest. The ATO recently publicised a case where one business’s total liability reached $938,000 (base tax plus penalties plus interest). Without a lodged return, the ATO can go back to day one of the business. A lodged return, even a nil one, caps that window at three years.

What are the most common fringe benefits that trigger FBT?

• Company cars available for private use (including dual-cab utes that don’t meet the one-tonne load test)
• Certain entertainment expenses (Christmas parties, client events)
• Employee loans with reduced or no interest
• Housing or accommodation benefits
• Salary sacrifice and novated lease arrangements
• Private health insurance paid on behalf of employees

How long does the questionnaire take?
Most clients are done in just a few minutes. The form uses conditional logic, so you only see questions relevant to your situation. If FBT applies to your business and we need detailed data (logbooks, odometer readings, entertainment breakdowns), it takes a bit longer, but you only answer questions for categories that apply.

What if I’m not sure how to answer a question?
The form auto-saves as you go, so you can pause and come back. If you’re stuck, reply to the email or call us and we’ll walk you through it.

How does the smart questionnaire help me?
The form only asks questions relevant to your situation. It guides you on what documentation to provide and establishes a clear record of your position, protecting both you and your business.

Ready to Streamline Your FBT Process?

FBT season doesn’t have to be a scramble. With engagement letters signed upfront, Smart Forms sent to clients, and automated follow-up running in the background, it becomes one of the most predictable workflows in your practice.

If you’re not sure where to start, the engagement letter is the easiest win. Download the free starting-point template, review it for your firm, and get it into your workflow before the next FBT year begins.

Download the Free FBT Engagement Letter Template

If you want to see how Seamlss handles the whole process, from engagement letter to client signing to FBT questionnaire, book a demo or start for free today.

Book a DemoStart for Free

This post was updated in April 2026 to reflect the TPB Code of Professional Conduct changes effective 1 July 2025 and the FBT year ending 31 March 2026.

If you have used Seamlss for a while, you will have noticed the friction. A company, a trust, and the three directors behind them all lived in one flat list. When you sent a request, it was not obvious who it was actually going to. When you pulled a report, groupings got fuzzy. And every time we tried to add something new, like compliance tracking or offboarding, we kept bumping into the same wall.

That wall is gone.

The new three tier model

From today, every record in Seamlss sits in one of three places.

Contacts are people. One record per real human. They have names, emails, phone numbers and verifications. A Contact never moves. If the same person sits behind three companies, that is still one Contact.

Clients are entities you act for. There are 13 Client types now, covering Individuals, Sole Traders, Companies, Trusts with their different trustee structures, Partnerships, SMSFs, Not for Profits and more. A Client is what you actually bill, lodge for and engage with.

Groups bundle Clients that belong together. A family group, a company and its trust, a holding structure with its subsidiaries, whatever shape the real-world relationship takes.

Every request, every report, every verification, every document now sits against the right layer. It sounds simple written down. That was the goal.

What this unlocks right now

The new data model is the reason so much else in this release even exists.

The request system has been rebuilt on top of it. Client Request, Insta Fetch and InstaSend all use the new Contacts and Clients structure, so recipients resolve cleanly, the client portal shows the right cards, and you stop sending three copies of the same ask.

Additional reports became possible. We now have a Reports area with six live views: contacts, clients, groups, requests, verifications, and leads.

Ethical Clearances, Client Offboarding with secure 2FA transfer, the AML Compliance Hub, the Setup wizard, re-engagement flows. Every one of these features needed the new model to work properly.

What it lets us build next

Here is the part that matters most.

The reason we invested in this rebuild is not just the features we could ship this week. It is the features we could never ship before.

A cleaner data model means we can finally move on things that were blocked:

• Per-Request item permissions – send to multiple contacts, allowing some to view and others to edit
• Multi-sign engagement letters
• Deeper XPM and accounting system integrations that actually keep two-way sync tidy
• Practice-wide dashboards that show real client health rather than ticket counts
• Automated workflows that trigger off Client, Group or Contact events
• Smarter verification renewal tracking against the right legal entity
• Richer audit trails for compliance teams
• Bulk actions that respect group relationships instead of flattening them

More quietly: every new feature we ship from here costs a lot less to build, because it slots into a structure that already knows what a Client is.

What you need to do

Not much. The migration will run overnight on the 15th April. Your existing data will be reshaped into Contacts, Clients and Groups automatically, and you will see the new layout under Client Management in the left nav.

If you want to understand the new model in depth, start with Understanding Contacts, Clients and Groups. For day-to-day use, Managing Contacts and Managing Groups cover the common actions. If you want to send a request in the new shape, How to Send a Client Request walks through the full three step wizard.

Thank you

This one has been in the works for a long time. Thank you for sticking with us through the beta quirks and the ten different iterations of what a “Contact” should even mean. The version shipping this week is the version that lets us build the future of Seamlss.

If you hit anything odd, click the support button in-app. Every note helps.

Clayton and Daniel

This article is part of our AML series for accounting firms. For the full picture of what onboarding looks like under the new obligations, start with Tranche 2 for accountants: what onboarding actually looks like. To see how Seamlss handles these checks inside onboarding, see plans and pricing.

With just 140 days until the July 1 deadline, 75% of Australian accounting firms haven’t started their AML compliance implementation. That’s not because firms don’t care. It’s because the information wasn’t there, and now that it is, it’s overwhelming.

On February 11, the third AML Accountants Forum webinar tackled the question every practitioner is asking: where do I actually start? Clayton from Seamlss and Agnieszka Szczepanik from Lyra Risk & Compliance broke down AUSTRAC’s recently released Accounting Program Starter Kit into practical, actionable steps.

The Starter Kit: An Unexpected Gift

When AUSTRAC dropped 30 documents on January 29, the collective groan from the accounting profession was audible. But according to Agnieszka, who has worked across AML regimes globally for 20 years, this kit is exceptional.

“I’ve worked in seven banks across multiple AML regimes globally. I’ve never seen anything that’s come to this level of detail,” she explained. “I was quite taken aback at the practical nature of what they’ve done and the comprehensiveness.”

The kit includes policies, risk assessments, onboarding forms, customer due diligence procedures, personnel forms, and maintenance documents. It’s pragmatic, comprehensive, and designed specifically for small accounting firms with 10 employees or fewer (though firms up to 20-25 people can use it with appropriate customisation).

But here’s the critical point: you can’t just download the documents, drop them in a folder, and call it done. The kit is a foundation, not a fill-in-the-blanks solution.

The Four Layers You Need to Understand

The starter kit is organised into four distinct layers, and understanding the hierarchy matters:

1. Core Documents (Start Here)

The AML/CTF Program (policy document) and the Risk Assessment are your foundation. These two documents define what is considered risky and explain to your team and regulators what your firm is doing about it.

Agnieszka emphasised approaching implementation top-down: “You need to look at it top down first before you can go bottom up. Your policy document and your risk assessment are the two core foundational frameworks that will impact what you do and how you think.”

The policy document is the “what and why.” It translates the legislation into your firm’s specific approach, covering personnel roles, due diligence requirements, reporting obligations, and record-keeping procedures.

The risk assessment is the methodology for evaluating clients. AUSTRAC provided a simpler approach than expected: assign high, medium, or low ratings to customer characteristics (who they are, where they operate, how they conduct business), then sum these up for an overall risk rating per customer. Higher risk equals more checks.

2. Personnel Forms

These cover employee due diligence, AML compliance officer appointments, role assignments, and training documentation. Even sole practitioners need to train themselves and maintain records.

The compliance officer must be someone senior enough to be accountable to the regulator. For most small firms, that’s a partner, owner, or manager. While operational work can be delegated to junior staff, the ultimate accountability and decision-making authority must stay with the senior compliance officer.

3. Client Forms

This is where the onboarding happens: identity verification, customer due diligence questionnaires, beneficial ownership checks, and risk ratings. If you’re already using structured onboarding software like Seamlss, you’re likely collecting 70-90% of the required data already.

The additional AML layers include beneficial owner identification (anyone with 25% or more control), PEP screening, sanctions checks, and applying that different lens to make informed risk decisions.

4. Maintenance Forms

Ongoing monitoring, periodic reviews, trigger event assessments, effectiveness testing, and annual compliance reporting. The compliance work doesn’t stop on July 1. It becomes part of your firm’s operating model.

The Pre-Commencement Relief That Changes Everything

One of the biggest anxiety-killers from the session: existing clients don’t need ID checks before July 1.

Pre-commencement customers can continue being serviced without new identity verification unless you provide them with a new designated service or key information changes (like their ASIC registered office address for company office holder services).

This significantly reduces the implementation burden. You’re not retrofitting your entire client base. You’re building the framework for new clients and triggered events going forward.

The Implementation Roadmap

Here’s the practical timeline that emerged from the session:

February 2026:

• Appoint your AML compliance officer
• Download and start customising the starter kit
• Map which of the nine designated services your firm actually provides

March 2026:

• Complete your risk assessment framework
• Finalize your policy document
• Prepare for AUSTRAC enrolment (opens March 31)
• Begin staff awareness and communication

April-May 2026:

• Implement the framework with pilot clients
• Train staff on procedures
• Test workflows and identify gaps

June 2026:

• Conduct end-to-end testing
• Document everything
• Ensure systems are ready

July 1, 2026:

• Go live
• Enroll with AUSTRAC by July 29

The regulators won’t be knocking on doors on July 1. They’ll start checking compliance after firms submit their first annual compliance reports in Q1 2027. But that doesn’t mean you can procrastinate. Daily non-compliance fines start at around $18,000, and they compound quickly.

What’s Not in the Kit

The starter kit covers the basics brilliantly, but it won’t solve everything:

1. Technology integration – You still need systems to collect, store, and retrieve data efficiently. Record-keeping is an obligation under the AML/CTF Act.
2. Complex structures – If you deal with international clients, intricate beneficial ownership chains, or high-risk industries, you’ll need to enhance the basic framework.
3. Screening tools – PEP checks, sanctions screening, and adverse media monitoring require third-party providers or sophisticated platforms.
4. Ongoing training – The kit provides the framework, but AUSTRAC-compliant training modules need to be sourced separately.

The Designated Service Questions

A question that came up repeatedly: does AML apply to every client?

No. AML requirements only apply when you provide a designated service. These include:

• Creating or managing trusts, companies, partnerships, or associations
• Acting as an ASIC agent (company office holder changes)
• Managing client funds or accounts
• Preparing or lodging documents for business structures
• Buying or selling businesses

If you’re just doing data entry for BAS or preparing tax returns without any of the above services, you’re probably not caught. But most accountants provide at least one designated service, which means the valve on the AML pipeline opens.

The key is mapping your services against the nine designated services to clearly identify where AML procedures are required.

See more Q&A’s at the end of this blog post.

When Customisation Becomes Critical

The starter kit is designed for firms of 10 people or fewer. Larger firms up to 20-25 employees can use it with tailoring. Beyond 50 people, you’ll need significant enhancement of the policy document and risk assessment methodology.

You’ll also need more sophisticated approaches if you:

• Provide services to regulated entities (other accountants, financial planners, remittance providers)
• Have clients in high-risk jurisdictions
• Manage complex entity structures
• Deliver services primarily through online platforms

For firms struggling with complexity or simply overwhelmed by the volume of work required, Lyra Risk & Compliance offers a one-day AML immersion solution covering kit review, designated service mapping, roles and responsibilities, operating model integration, gap analysis, and practical guidance on risk assessment and customer due diligence.

The Minimum Viable Effort

What’s the absolute minimum you need to do to be compliant?

Download the starter kit, customise it for your firm’s size and services, appoint your compliance officer, implement the framework, train your staff, and test the process end-to-end before July 1.

It’s not rocket science, but it does require focused effort. Agnieszka framed it perfectly: “What they’ve given you is an MVP. You cannot go below. You can only go up.”

Doing it right the first time is always cheaper than remediation later. Banks have learned this lesson the expensive way. Accounting firms have the advantage of learning from their mistakes.

What’s Next

The next AML Accountants Forum webinar will dive deep into risk assessments and scenario planning. As firms start implementing the starter kit, the questions shift from “where do I start?” to “how do I apply this to my specific clients?”

Understanding how to evaluate client risk, what triggers enhanced due diligence, and how to document your decision-making process will be critical. The risk assessment isn’t just a compliance checkbox. It’s the engine that drives every decision about whether to take on a client, what level of verification to perform, and how often to review the relationship.

The July 1 deadline is real. There’s no grace period. But the path forward is clearer now than it’s been at any point since Tranche 2 was announced.

The AUSTRAC starter kit provides a genuine foundation. It won’t do the work for you, but it gives you the framework, the language, and the structure to build a compliant AML program without reinventing the wheel.

For most small firms, this isn’t an insurmountable challenge. It’s a systematic process that needs to be worked through methodically over the next five months. Start with the core documents, understand your designated services, build the framework, test it, and go live.

The firms that will struggle aren’t the ones who start now and work through it imperfectly. They’re the ones who wait until May and try to compress six months of work into eight weeks.

Watch the full webinar recording:

Common Questions from Practitioners

The webinar chat revealed the questions keeping accountants up at night. Here are the answers that matter:

Do I need to ID check all my existing clients before July 1?

No. Pre-commencement customers (existing clients before July 1, 2026) don’t require immediate identity verification. You only need to conduct CDD checks on existing clients if:

• They request a new designated service you weren’t previously providing
• There’s a significant change in their circumstances that triggers medium or high risk
• You need to file a suspicious matter report about them

This is one of the biggest anxiety-killers in the entire framework. You’re not retrofitting your entire client base overnight.

If I’m an ASIC agent and a client’s registered office address changes, do I need to do a new ID check?

Yes, if you’re providing ASIC agent services (company office holder changes), a registered office address change is a designated service trigger. However, this doesn’t mean full identity verification from scratch. You’re conducting a risk assessment to determine if enhanced due diligence is needed based on the nature of the change.

If a client just moves their home address but you’re not updating ASIC records, that’s not a trigger.

As a sole practitioner, do I need to complete personnel due diligence and training on myself?

Yes. Even if you’re the only person in the firm, you still need to:

• Document that you’ve completed AML/CTF training (and maintain records)
• Confirm your fitness and propriety (though being registered with the Tax Practitioners Board already addresses much of this)
• Appoint yourself as the compliance officer

You’re wearing all the hats, which means you need to check all the boxes, even if they feel redundant.

If I acquire an accounting firm after July 1, do I need to ID check all the inherited clients?

You need to understand which clients are receiving designated services and what information the previous firm collected. You can place reliance on previous due diligence if it’s adequate, but you must:

• Review what CDD was performed
• Assess whether it meets current requirements
• Fill any gaps in documentation
• Consider the acquired firm’s compliance practices as part of your due diligence

The compliance quality of an acquired firm should now be a key criteria. Firms with poor AML documentation represent higher risk and should be assesses accordingly.

Does this apply to bookkeepers or just accountants?

It depends on which services you provide, not your job title. If you’re a bookkeeper who only does data entry and BAS preparation, you’re likely not caught. But if you:

• Manage client funds or accounts
• Act as an ASIC agent
• Prepare documents for business structures
• Provide any of the nine designated services

Then yes, you’re subject to AML/CTF requirements regardless of whether you call yourself a bookkeeper, accountant, or business advisor.

What about changes to share structure or adding shareholders?

Yes, this falls under designated service #2 (creating or managing companies). Any change to share structure, addition of shareholders, or modification to company ownership requires you to conduct appropriate due diligence based on your risk assessment.

Will AUSTRAC provide flowcharts for complex scenarios like trust beneficiaries?

The starter kit includes process documents, which is more than regulators typically provide. However, AUSTRAC won’t give you a “if this, then that” flowchart for every scenario. The risk-based approach means your policy and risk assessment determine how deep you go.

For trust beneficiaries, you’ll need to identify beneficial owners (those with 25% or more control) and apply your risk assessment methodology. Complex structures may require external tools from providers like LexisNexis or Dun & Bradstreet.

How do I find an AML auditor for independent evaluations?

You don’t need one immediately. Independent evaluations are required every three years, with the first due by 2029. However, Agnieszka recommends considering an independent review within your first year of operation, especially if you’re writing your program from scratch, to catch any gaps early.

By the time you need an auditor, the market will have matured significantly. For now, focus on implementation.

I work in a niche, low-risk industry. Does that simplify my AML requirements?

Yes and no. A low-risk client base means simpler procedures and less frequent monitoring. But you still need:

• The complete AML/CTF program documentation
• Risk assessment methodology
• Staff training
• Enrolment with AUSTRAC
• All the foundational compliance framework

The risk-based approach scales the operational work, not the structural requirements.

Does the kit work for firms that deliver services primarily online?

The starter kit is designed for traditional service delivery models. If your firm operates entirely online (video conferencing, digital onboarding, cloud-based workflows), you’ll need to enhance sections covering:

• Identity verification without face-to-face contact
• Higher risk considerations for digital channels
• Additional fraud prevention measures
• Enhanced monitoring for technology-facilitated services

Firms over 10 employees or with complex delivery models will need to tailor the starter kit significantly.

This article is part of our AML series for accounting firms. For the full picture of what onboarding looks like under the new obligations, start with Tranche 2 for accountants: what onboarding actually looks like. To see how Seamlss handles these checks inside onboarding, see the demo.

If you’ve been putting this off because “the guidance wasn’t out yet” – that excuse is gone.

What the AML for Accountants Guidance Actually Includes

AUSTRAC put out a proper starter kit for accountants. Step-by-step stuff. Templates. Examples of how to deal with clients in real scenarios.

It’s designed for small, low-complexity firms. Which is most of us.

The guidance covers:

• How to build your AML/CTF program
• A document library with templates
• Real examples of client situations
• When you’re caught, when you’re not

If you haven’t looked at it yet: austrac.gov.au/reforms/sector-specific-guidance/accountant-guidance/accounting-program-starter-kit

The Timeline (Still the Same)

Nothing’s changed here:

• Now to March – Get your program sorted, train your team
• 31 March – AUSTRAC enrolment opens
• 1 July – Obligations kick in

Five months. It’s tight but it’s doable if you actually start.

What AUSTRAC Expects from Accountants

A lot of this stuff isn’t new work. It’s formalising what decent firms already do.

You probably already:

• Collect client details at onboarding
• Verify ID for ATO and TPB requirements
• Store documents
• Have engagement letters signed
• Know your clients reasonably well

The AML piece is about documenting it properly, adding a few extra checks, and having a system to track it.

What Seamlss Already Covers

We’ve been doing client onboarding for accounting firms for years. When I looked at what AUSTRAC actually requires versus what Seamlss already handles, a fair chunk is already there.

Already in Seamlss today:

AUSTRAC Requirement	Seamlss Feature
Collect client identity info (name, DOB, address)	Client onboarding forms
Verify identity documents	ID verification (Stripe Identity, source docs)
Store records for 7 years	Document storage with retention
Digital signatures on agreements	E-signatures on engagement letters
Entity details (companies, trusts)	Entity management
Audit trail of who did what	History and activity logging
Client portal for updates	Client area

What’s coming:

• AML screening (sanctions, PEP, adverse media)
• Risk assessment questionnaires matching AUSTRAC’s framework
• Beneficial ownership collection and tracking
• CDD workflows tied to your onboarding
• Review scheduling and reminders
• Compliance documentation and evidence storage

The point is: if you’re already using Seamlss for onboarding, you’re not starting from zero. You’ve got the foundation. We’re working on adding the AML layer on top – more details soon.

AML for Accountants: What to Do This Week

1. Read the starter kit

Not skim. Actually read it, here.

2. Figure out if you’re caught

Use AUSTRAC’s tool: Check if you may be regulated

If you’re setting up companies or trusts, acting as director or secretary for clients, providing a registered office address, managing ASIC lodgements, or handling money beyond your fees – you’re in. If you’re not sure, review the designated services list in the starter kit.

3. Pick someone to own this

Every firm needs an AML/CTF Compliance Officer. In most small practices, that’s you. The role can sit alongside other responsibilities, but someone has to own it.

4. Look at your client base

Who’s higher risk? International connections, cash businesses, complex structures? You don’t need software for this – a spreadsheet works fine to start.

Join Us Next Week

We’re running the next AML Accountants Forum on Wednesday 11 February at 12pm AEDT. This one’s focused on “Where do I actually start?” – walking through the starter kit and giving you a practical roadmap.

Free, online, no sales pitch. Agnieszka from LYRA and I break down what to focus on now versus what can wait.

Can’t make it live? Register anyway – we send the recording.

The Bottom Line for AUSTRAC Accountants

The guidance is out. The deadline is real. But this isn’t the disaster some vendors want you to believe.

If you’re a small to medium firm doing standard accounting work for mostly Australian clients, the requirements are manageable. AUSTRAC expects accountants to document their processes properly. If you’re already using Seamlss you’re almost there. Build a proportionate program. Document what you do and if you need too use AUSTRAC’s templates as your starting point

And if you’re already using Seamlss? You’re further ahead than you think.

This article is part of our AML series for accounting firms. For the full picture of what onboarding looks like under the new obligations, start with Tranche 2 for accountants: what onboarding actually looks like. To see how Seamlss handles these checks inside onboarding, see the demo.

We’ve run two sessions with hundreds of practitioners in the past month. The chat windows fill up, and the same themes keep coming back. So here’s what firms are actually asking, and what we’re telling them.

For context: when we polled attendees, 58% said they hadn’t started preparing yet. Another 35% had started researching but weren’t sure what to do. Only about 7% felt mostly sorted. If you’re feeling behind, you’re in good company.

1. Do I need to verify all my existing clients before July 2026?

No. This is the biggest relief message we can give you.

In AUSTRAC language, clients you have before 1 July 2026 are “pre-commencement customers”. You don’t need to perform customer due diligence on them unless one of two things happens:

• You need to file a suspicious matter report about them, OR
• There’s a significant change in the relationship that moves them to medium or high risk

So if you have 200 clients on 30 June 2026, you’re not rushing through 200 identity verifications before the deadline. You need systems ready for when triggers occur. But you’re not starting from scratch with everyone on day one.

The catch: any new designated service you provide to an existing client after 1 July 2026 will require customer due diligence before you proceed. Existing client, new service, new obligation.

2. We use our office as the registered address for clients. Does this trigger AML?Yes. Registered office services are specifically listed as a designated service.

This one came up constantly. Lots of firms don’t think of it as a “service” – it’s just something they’ve always done. You set it up years ago and nothing happens unless ASIC sends a letter or the client needs to change something. But under the reforms, it counts.

The good news: existing arrangements fall under the pre-commencement rules. If you’re already providing this before 1 July 2026, you don’t need to immediately verify those clients. The obligation only kicks in when something actually happens – a change of address, an ASIC notice that requires action, until something is triggered requiring an AML action. Until then, it’s pre-commencement and you’re not required to do anything.

Should you change all your clients’ registered addresses to their own? That’s a business decision. Some firms are stopping the service entirely. Others are keeping it and building it into their AML program. Neither is wrong, but you need to decide. This is also where a lot of firms suddenly realise they’ve been doing things on autopilot for years.

3. I’m a director or shareholder for clients – estate planning trusts and that sort of thing. Am I caught?

Yes. Acting as a nominee director or shareholder is a designated service.

This catches more accountants than people expect. If you hold shares or directorships in client structures – whether for estate planning, asset protection, or just administrative convenience – you’re providing a designated service.

The question of who you’d actually be risk-assessing is a fair one. You’d be assessing the beneficial owners of the structure, which is typically your client and their family. It gets a bit circular when the whole point of the arrangement is that you’re the legal owner to simplify things.

We don’t have perfect clarity on how this plays out in practice yet. Existing arrangements are pre-commencement, so you have time. But you’ll need to document these relationships properly and have them in your AML program.

4. What about existing clients with foreign shareholders who we make payments for?

Two separate triggers here.

Making payments for clients: If you’re managing client funds or accounts, that’s designated service #3. This includes making payments on their behalf from accounts you control.

Foreign shareholders: Having foreign shareholders doesn’t automatically make a client high-risk, but it’s a factor in your risk assessment. A majority foreign shareholder, particularly from certain jurisdictions, may elevate the rating.

For existing clients, the pre-commencement rules apply. But if you’re making payments for clients with complex ownership structures, think about whether your ongoing monitoring would actually pick up anything unusual. That’s where most firms are landing at the moment, based on what we’ve seen.

5. If a client is high-risk, won’t they know they’re being assessed?

Yes. And that’s fine.

This worry comes up a lot. Accountants don’t want to offend clients or make them feel suspected of something.

But AML compliance is becoming standard across all professional services. Lawyers, real estate agents, financial advisers – everyone’s going through this. Your legitimate clients will understand you’re meeting regulatory requirements, not accusing them of anything.

Enhanced due diligence might mean asking about source of funds, understanding their business activities better, or getting senior approval within your firm before acting. These are reasonable questions in a professional relationship.

If a client reacts badly to basic compliance questions, that’s actually information worth having.

6. If a client receives cash and we know about it for tax, do we need to report it?

Not automatically.

The $10,000 threshold transaction report applies when you receive or pay physical currency of $10,000 or more. If your client’s business receives cash and tells you about it for their BAS or tax return, that’s different from you handling the cash yourself.

But this is where ongoing monitoring matters. If you know a client routinely receives large amounts of cash, and it seems inconsistent with their business type or declared income, that’s worth examining. Cash-intensive businesses aren’t inherently suspicious. Unexplained cash is.

7. Why aren’t financial planners caught?

They largely already are, through different mechanisms.

Financial planners work through product providers – fund managers, platform operators, insurance companies – who are already reporting entities under the existing AML regime. When they complete forms for investment bodies, those bodies are doing the AML checks.

The Tranche 2 reforms target professional services that weren’t previously covered: accountants, lawyers, real estate agents, trust and company service providers.

If a financial planner is also providing accounting services or setting up structures, they’d be caught for those activities like any other accountant.

What to do now

AUSTRAC’s sector-specific guidance is expected in January 2026. That will fill in a lot of the detail.

Most firms don’t need a 50-page AML plan right now. They need a handle on three things:

Work out which designated services you actually provide. Many firms discover they’re doing more than they thought – registered office services, nominee arrangements, client fund management.

Don’t panic about existing clients. The pre-commencement rules give you breathing room. Focus on having systems ready, not verifying everyone immediately.

Think about how new client onboarding changes from 1 July 2026. What information will you collect? How will you verify identity? What does the process look like?

How we’re handling it

This is usually when people ask what we’re doing about it.

If you’re a Seamlss user, you’ll see an AML Compliance Hub in your sidebar. It’s a 5-phase checklist that tracks your progress toward July 2026, with tasks unlocking as AUSTRAC releases guidance. Timeline view, links to AUSTRAC resources, countdown to the deadline. No extra cost – it’s just there.

We’re building AML into the onboarding process and have all the tools you need covered in Seamlss to assist your AML journey.

We’re also running a monthly AML Accountants Forum where practitioners can ask questions and share what they’re figuring out. Next one is 18 December.

These are informal sessions. No sales pitch, just honest conversation about getting ready.

Register here: events.humanitix.com/aml-accountants-forum

This article is part of our AML series for accounting firms. For the full picture of what onboarding looks like under the new obligations, start with Tranche 2 for accountants: what onboarding actually looks like. To see how Seamlss handles these checks inside onboarding, see plans and pricing.

Every firm I’ve spoken to lately says the same thing: the inbox is full of AML warnings, LinkedIn is shouting at them, and no one actually knows what they should be doing. It’s noise, and it’s stressing people out.

Here’s what they’re not telling you: You literally can’t even register with AUSTRAC until March 31, 2026. The guidance you need to make informed decisions won’t arrive until January 2026.

And that “perfect” AML solution anyone is pushing? It might be perfect for problems you don’t actually have.

The Truth About The Timeline

Let’s cut through the sales noise and look at what’s actually happening. Yes, the Anti-Money Laundering and Counter-Terrorism Financing Amendment Act 2024 is law. Yes, you’ll need to comply.

Here’s the real timeline:

Look at that timeline. You don’t need to spend a dollar right now. The only date that matters today? January, when AUSTRAC finally tells us what’s real.

The Question Nobody’s Asking

Here’s what should make you pause before signing any contract: We don’t actually know what small firms need yet.

AUSTRAC hasn’t released:

• Specific requirements for accounting firms
• Risk assessment templates for your sector
• Monitoring expectations for different service types
• Starter programs for small practices

Signing up for AML software now is like buying a suit before you even know if you’re invited to the wedding. You’ll probably end up with the wrong fit and it won’t be cheap. Sure, you might get lucky, but you’re probably going to end up with something that doesn’t fit.

The Payroll Trap That Changes Everything

Here’s the kicker that most firms don’t realise: if you provide payroll services where you actually manage client funds (not just process them), you’re likely covered by these regulations.

This isn’t about complex trusts or offshore entities. It’s about the everyday payroll service that thousands of firms provide. But here’s the thing – we still don’t know if AUSTRAC expects real-time transaction monitoring for payroll services or if periodic reviews will suffice.

The vendors selling you “comprehensive monitoring solutions”? They don’t know either. They’re just hoping you won’t ask.

What You Should Actually Do Right Now (It’s Free)

This Week:

Check if you’re even covered
Use AUSTRAC’s free assessment tool. Pay special attention to:

• Payroll services (the big surprise for many)
• Trust account management
• Company formation services
• Registered office services

Start learning for free
AUSTRAC’s e-learning platform has 10 free modules. No registration required. Each takes about 20-25 minutes. This is better than any vendor “education” because it’s from the people who’ll actually enforce the rules.

Before December 2025:

Complete all AUSTRAC training modules
List which services you provide that trigger obligations
Join your professional body’s AML working group
Start documenting your current processes

After December 2025:

Review AUSTRAC’s guidance thoroughly
Identify who’ll be your Compliance Officer
Draft your AML/CTF Program using AUSTRAC templates
THEN evaluate software solutions

What NOT to Do:

Sign software contracts before January’s guidance
Pay for “early bird” implementations
Believe vendors who claim to know unpublished requirements
Buy enterprise features for your suburban practice

The Integration Reality Check

Vendors love to claim “seamless integration” with Xero and MYOB. Here’s what they don’t tell you:

What’s actually your job:

• Mapping your data (you know it best)
• Setting risk parameters (your risk appetite)
• Training your staff (your procedures)
• Managing the change (your clients)

The vendor should handle the technical bits. But most of the work? That’s on you regardless of when you buy.

What January’s Actually Changes

AUSTRAC’s January’s guidance will include:

• Specific requirements for accounting firms
• Practical examples you can follow
• Risk assessment templates
• Starter AML programs
• Clarification on what “monitoring” means for firms like yours

This last point is crucial. Do you need real-time transaction monitoring for every client payment? Or will quarterly reviews suffice for low-risk clients?

Nobody knows yet. Including the people trying to sell you “comprehensive monitoring solutions.”

What Seamlss Is Doing (The Honest Approach)

At Seamlss, we’re taking a different path. We already help firms with:

Available today:

• Client identity verification (for tax agent linking)
• Digital engagement letters
• Secure document management
• Xero Practice Manager integration

What we’re NOT doing:

• Selling you AML features that you don’t need.
• Pretending we know requirements AUSTRAC hasn’t published
• Pushing “comprehensive” solutions for simple needs
• Creating fake urgency

When January’s guidance arrives, we’ll build what you actually need. Not what we imagine you might need. And we’ll price it for suburban accounting firms, not multinational banks.

The Bottom Line

The AML compliance deadline is real. The panic is manufactured.

You have time to:

• Learn what you actually need
• Wait for proper guidance
• Make informed decisions
• Choose appropriate solutions
• Implement properly

What you don’t have time for is making expensive mistakes based on fear.

Here’s your actual plan:

1. Take a breath.
2. Learn from AUSTRAC, not vendors.
3. Sit tight until January’s .
4. Then make smart calls.

That’s it. No panic required.

That’s when AUSTRAC tells you what you actually need. That’s when real requirements replace speculation. That’s when you can make informed decisions.

Because at Seamlss, we believe you should buy compliance software when you know what you’re complying with, not before.

Disclaimer: This article provides general information only and is not legal advice. Always consult qualified professionals for your specific situation. But definitely consult them before signing any software contracts.

About Seamlss

Seamlss provides client onboarding and verification tools for Australian accounting firms. We’re building AML capabilities based on real requirements, not imagined ones. When you’re ready (after January), we’ll be ready too.

Learn more at seamlss.com.au

This article is part of our AML series for accounting firms. For the full picture of what onboarding looks like under the new obligations, start with Tranche 2 for accountants: what onboarding actually looks like. To see how Seamlss handles these checks inside onboarding, see the AML Compliance Hub in the help centre.