What AUSTRAC’s Record Bank Penalties Teach Newly Regulated Tranche 2 Entities About Monitoring Adequacy

AUSTRAC transaction monitoring enforcement history holds a direct lesson for newly regulated businesses. AUSTRAC’s two largest bank enforcement outcomes, an AUD 1.3 billion penalty against Westpac in 2020 and an AUD 700 million penalty against the Commonwealth Bank in 2018, both centred on the same underlying failure: transaction monitoring and reporting programmes that existed on paper but did not work in practice.

Since 1 July 2026, Tranche 2 has brought an estimated 80,000 to 100,000 previously unregulated businesses into AUSTRAC’s regime. The individual dollar amounts involved will look nothing like a major bank’s.

The underlying question AUSTRAC will ask, does this monitoring programme actually work, is exactly the same one.

Both bank cases tested the same things: whether risk was assessed, monitoring ran, reports were filed and the board could see it working.

What two of Australia’s largest AML penalties found

In the Westpac case, the Federal Court found the bank had failed to report more than 19.5 million international funds transfer instructions worth over AUD 11 billion, and separately failed to adequately monitor customers for transactions potentially linked to child exploitation, contravening the AML/CTF Act on more than 23 million occasions. The presiding judge noted specifically that Westpac’s transaction monitoring programme was seriously deficient. The CBA case, two years earlier, centred on a failure to assess money laundering risk in its intelligent deposit machines, more than 53,000 threshold transaction reports not lodged on time for cash transactions worth around AUD 625 million, and three years of non-compliance with its own monitoring programme across hundreds of thousands of accounts.

In both cases, the finding was not that the institution had no AML programme. It was that the programme in place did not function as intended, for years, at scale.

Why the lesson transfers directly to Tranche 2 entities

A real estate agency or accounting practice captured by Tranche 2 for the first time is very unlikely to face a penalty on that scale, and the transaction volumes involved bear no resemblance to a major bank’s. But after the Westpac ruling AUSTRAC said financial institutions must have strong compliance systems, processes and resources in place, and it has since said that failing to manage money laundering and terrorism financing risk is a serious regulatory concern. Tranche 2 businesses are now reporting entities under the same Act. A newly regulated business that treats its AML/CTF programme as a policy document rather than an operating framework embedded in daily work is repeating, at a smaller scale, the gap between paper and practice that sat behind two of Australia’s largest AML penalties.

Where the risk concentrates for consolidators and franchise groups

The exposure is sharper again for any group that owns several Tranche 2 entities. A pattern of the same monitoring gap repeated across many offices under one ownership structure is closer to the systemic, multi-year failure pattern AUSTRAC penalised at Westpac and CBA than it is to an isolated lapse at a single small business. Boards overseeing these groups should treat Tranche 2 as a governance question with real precedent behind it, not a compliance formality absorbed at arm’s length by each local office.

Turning enforcement history into first-time programme design

The practical lesson for a business building its first AML/CTF programme is to design for verifiable operation from day one: documented risk assessment, monitoring that is actually reviewed rather than merely running, and case records that can show a report was considered and, where relevant, filed.

How Nexiant supports verifiable AML/CTF operation

FraudShield’s case-management workflow and reporting templates are built to make that operation visible and auditable, which speaks directly to the gap between paper and practice that both major enforcement cases exposed.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.