AML/CTF and Tranche 2 FAQ

Tranche 2 extends AML/CTF obligations to newly regulated sectors, including accounting, real estate, legal and other professional services. Obligations started on 1 July 2026. A firm must apply to enrol with AUSTRAC within 28 days of starting to provide a designated service (s 51B). A firm that provided only these newly designated services before 1 July 2026, and no other designated service, had until 29 July 2026.

Firms that provide designated services under the AML/CTF Act, including many accounting and real estate businesses. If you are not sure whether your firm does, start with the readiness assessment.

Most firms need an AML/CTF program, an AML/CTF compliance officer (AMLCO), staff training, a customer due diligence (CDD) process, record-keeping controls, and a way to report suspicious matters where required.

No. duely is not approved, endorsed or certified by AUSTRAC. It is workflow software that helps firms organise their compliance work and keep audit-ready records.

No. duely helps you show the procedures you followed and the decisions you made. Your firm remains responsible for its own compliance judgements and approvals.

All five verticals duely supports are live: accounting firms, real estate agencies, conveyancers, law firms, and jewellers and bullion dealers. Tranche 2 also covers trust and company service providers. Each has its own versioned program template and designated-service catalog, and the legal vertical includes the privilege-aware suspicious matter workflow.

You probably won't replace it. Most firms keep their existing search and document tools and add duely to hold the compliance record, because AUSTRAC expects the firm to produce the engagement file.

With duely you pay for the full record in one plan: automated identity verification, screening, suspicious matter XML export, versioned and hashed evidence packs, and management of your reliance partners. A free tier usually leaves some of these for you to build or buy separately.

Import your existing customers from a CSV file, then upload documents as evidence. Most firms run duely alongside their existing tools for a quarter, then consolidate.

We review AML/CTF Rule amendments and AUSTRAC starter kit updates as part of maintaining duely, and the program templates for each industry are versioned. Keeping your program current, and judging what a change means for your firm, stays with your firm and its AMLCO.

duely organises the work by customer. Due diligence (identity verification and screening) is done once per customer and attached to each engagement. Risk is assessed per engagement that includes a designated service, and every engagement goes through approval and keeps its own records and evidence.

No. Banks and remitters hold accounts, so they watch a continuous feed of transactions and alert on patterns in it. An accounting firm or a real estate agency holds no such feed, and the Act does not ask them to build one. For Tranche 2, obligations attach to the designated service you provide. Each engagement that includes a designated service carries its own risk assessment, and every engagement has its own approval and records, with the customer's CDD attached automatically. duely assesses risk at that level rather than surveilling a transaction stream. Ongoing due diligence still applies: a daily monitoring job queues customers whose screening is stale (refreshed every 6, 12 or 24 months by risk rating) or whose scheduled review is due, and trigger events flag a customer for re-review when something changes. That is review of the customer and the engagement, not transaction surveillance, and duely does not claim to detect suspicion automatically. The s41 judgment is the AMLCO's.

duely guides staff through a hosted document check or a staff-recorded verification from documents they sight or certified copies. It records which method was used, the sources relied on and the evidence collected.

Yes. Automated identity verification is live and included, white-labelled as duely Verify. It is a hosted check covering liveness, document capture and face match, and the result and evidence are written straight into the engagement. Guided manual verification is available for cases where a hosted check isn't appropriate. Customers are screened against sanctions and PEP lists, and adverse media with the person's consent or as part of enhanced due diligence, and screening can be re-run on demand at any time.

Screening runs against 130+ sanctions lists, with PEP data covering 230+ territories. Both Australian sources are included: the DFAT Consolidated List and the Listed Terrorist Organisations list, alongside OFAC, the EU, the UN and the UK's OFSI. Australian PEP coverage extends to relatives and close associates.

See every list we screen against

Yes. Identity documents from more than 200 countries and territories are supported, across passports, national ID cards, driver licences, residence permits and health insurance cards. The customer gets a link by email, signs the consent form, then verifies with their document and a selfie from their own phone, wherever they are. They do not need an Australian visa or a trip to Australia. Every document collected is checked for forgery and tampering, including signs that the image is a screenshot, a photo of another screen, or a digitally altered document. duely does not check a foreign document against the issuing country's database. The optional DVS check is available for Australian documents only. For every other country, duely captures and checks the document, and the decision to accept it remains yours. There is no additional fee for verifying a foreign document or for screening someone overseas; both are included in the subscription.

See the countries and documents supported

Both. Where you broker the sale, the Act names the seller and the buyer as customers of that designated service, so each goes through their own CDD with their own verification and evidence. A sale with two sellers and two buyers is four customer records on one transaction. Our guide to who is your customer in a property sale covers when each party becomes a customer, what happens at auction, and why an attorney signing for someone is recorded as a party rather than a customer.

Yes. Sanctions, PEP, criminal watchlist and adverse-media screening is independent of the verification path, so a staff-recorded verification is screened the same way a hosted check is. You can record the certified copy, your file note of the call, and any other evidence against the customer or the engagement. Each CDD review is versioned, so a later re-screen adds a record rather than overwriting the one you relied on at the time.

duely doesn't translate documents. Upload the accredited translation alongside the original and both sit on the same customer record, available in the evidence pack with the rest of the verification.

Not yet. duely currently sends secure document requests and upload links. A full self-service portal with login and dashboard is on the roadmap.

duely records customers and their beneficial owners, maps who controls the entity, and builds a structure profile for companies, trusts and partnerships, with your rationale and evidence attached to the engagement.

Yes. You build the structure and duely works out who the beneficial owners and controllers are, then requires CDD on each of them. Corporate trustees, directors, trustees, members and controllers are all handled. Company details come from an ABR lookup; ownership structure comes from an ASIC extract or manual entry. Overseas companies and foreign trusts can be recorded and mapped the same way, though the beneficial-owner validation rules are written to Australian requirements, so expect more of the ownership work by hand.

Yes. Customer-level risk applies when you profile a customer. Engagement-level risk applies when you engage them on a designated service, using a question set drawn from the AUSTRAC starter kits. duely proposes a rating; the final rating is always your staff member's or AMLCO's decision, recorded as theirs. Where the rating comes out High, an ECDD case opens with Source of Funds, Source of Wealth and supporting documents, and an approver (the AMLCO, or a user with the Approver role) signs it off. A PEP answer, a confirmed sanctions hit or a failed identity verification also opens ECDD.

Yes. The risk assessment scores unfinanced purchases explicitly: a purchase without a mortgage is a medium risk factor, and physical currency of $50,000 or more is a high one. Where the assessment comes out High, duely opens an ECDD case automatically with Source of Funds, Source of Wealth and approver sign-off on the actions required. It is a guided step inside the engagement rather than something you have to remember.

Yes. duely has one plan and no Tranche 2 obligation is gated behind anything. It includes the AML/CTF program generated for your industry and versioned with an approval workflow, the compliance registers, an append-only audit trail per engagement with tamper-evident, versioned evidence packs you can export, and the retention anchor date recorded for each engagement, with the statutory seven-year retention period shown from it. Staff training modules with assignment and completion tracking are included too.

An evidence pack is a versioned export of the compliance record for an engagement: decisions, rationale, timestamps, approvals and supporting context. Each pack is hashed so any later change can be detected. A matching hash shows the pack is unchanged, not that its content is accurate.

Suspicious matters are handled in a shadow case that only the AMLCO can see. It is kept out of shared engagement views to reduce the risk of tipping off.

duely prepares submission-ready records and an XML export for suspicious matter reports. It does not lodge reports with AUSTRAC: you submit through AUSTRAC Online and record the submission reference in duely.

duely is one plan: $59 a month for 30 customers a year and 3 users, with all the compliance functionality included. If you grow past 30 customers, duely adds flex customer slots at $3 a month each. Extra users are $9 a month each. There is no plan upgrade to buy. A DVS document check ($8) and document intelligence ($3) are optional. A DVS check is charged for each check the agency answers, whatever the answer, and not charged if the check can't be completed; document intelligence is charged only when you run it. All prices are in AUD and exclude GST.

There's no free trial, but you get full access from day one. You can cancel anytime from your billing settings and keep access to the end of your current billing period. The launch offer of a free first month ended in August 2026. Cancellation and refund terms are set out in our Refund and Cancellation Policy.

Yes. A card is required at signup and billing starts with your first subscription period. You can change the payment method or cancel anytime from your billing settings.

Yes. Cancel from your billing settings and you keep access to the end of the current billing period. There is no long-term contract. Cancel a new subscription within 14 days (in billing settings or by emailing billing@duely.com.au) for a refund of the subscription fees for that first period, not per-use charges. Otherwise there's no partial-month refund, except where you cancel because of a fee change or an adverse change to the terms, or as otherwise set out in our Refund and Cancellation Policy, and subject to your rights under the Australian Consumer Law.

No. duely is billed monthly only, with no lock-in. Cancel from your billing settings and you keep access to the end of the current billing period.

You carry on working. When you activate a 31st customer, duely adds a flex slot at $3 a month and lets you know. The slot is added immediately and charged in full to your stored payment method, $3 for that month with no proration, then renews on your billing date. Five extra customers is $74 a month, ten is $89, twenty is $119. There is no higher plan to move to.

30 a year, counted from your subscription date. A customer takes one of your 30 included slots when you start their due diligence, and keeps it until your anniversary even if their engagement concludes earlier. Included slots are one-time use, so concluding an engagement does not free one, and a customer who comes back for another engagement in the same year goes back to their own included slot. On the anniversary duely re-counts: customers with an open engagement fill the 30 included slots first, and any flex slots you no longer need are cancelled automatically. Past customers do not keep adding to your bill.

You don't need to do anything. When their last engagement concludes they become inactive automatically: scheduled re-reviews stop (monitoring becomes trigger-only) and their records stay in duely while your firm subscribes, with the retention anchor date recorded for each engagement and the seven-year retention period shown from it. If they were in one of your 30 included slots, that slot is counted until your anniversary. If they were in a flex slot, the slot is free straight away for your next customer, or you can cancel it and it stops billing from your next cycle. Flex slots are not reserved, so a returning customer takes whichever flex slot is free, or a new one is added.

No. A company, trust, partnership or SMSF with up to 6 relevant individuals uses one customer slot. Each further group of up to 6 relevant individuals uses one more, so a partnership with 9 partners uses two. A relevant individual is a person you must keep in duely for CDD, verification or screening, such as a director, trustee, beneficial owner or controller, not a contact person. The same rule applies to included slots and flex slots.

Count the customers you take through CDD in a year. For an accounting firm that is your active client list, so a firm with 45 clients would hold about 15 flex slots and pay $104 a month. For a real estate agency count every party: a sale with two sellers and two buyers is four customers, and a party only needs a slot while their sale is open, so an agency doing 60 sales a year would hold around 35 flex slots at a time and pay about $164 a month. A company, trust or SMSF counts once, or one more for each 6 people beyond the first 6 you must verify. The pricing page has an estimator. You can always start at $59, and duely adds flex customer slots only when you need them.

There is no monthly allowance. Biometric ID verification through duely Verify (document capture, liveness and face match), company lookups and sanctions, PEP, criminal watchlist and adverse-media screening are included in your plan, under our fair-usage policy. What the subscription counts is customer slots, not how often you verify. Optional extras are charged per check: an optional government document check (DVS) is $8 per check.

Identity documents are checked in real time against the issuing agency's records through the Attorney-General's Department's Document Verification Service; duely shows its identity opinion, not the agency's answer. The DVS check is optional. It costs $8 plus GST per check, not per person. It is charged for each check the agency answers, whatever the answer, and not charged if the check can't be completed. duely shows the charge before the check runs and adds it to your monthly invoice.

No. There is no setup fee and no minimum volume, and the subscription runs month to month, so you can leave at the end of any billing period.

The government document check (DVS) and document intelligence are optional add-ons, and the AML/CTF Rules do not require either. DVS checks are $8 plus GST per check, billed as used (see the question above). Document intelligence, which reads a trust deed or ASIC extract and drafts the beneficial owners for your review, is $3 per use. It is off until a firm administrator turns it on, and when it runs the document is sent to an overseas AI provider to be read. Both show their price before they run. You are charged once a document intelligence run starts, even if the reading then fails or you edit the result. Nothing is charged if the document is never sent. Everything else is included in your plan.

No. duely bills your firm, and your firm decides whether to absorb the cost, add it to your own invoice or include it in your fee. When you run a DVS check or document intelligence you can mark it as a client-recoverable cost, and duely keeps a record of those for your firm's own books. duely does not decide whether it is a disbursement for you.

You keep full access to the end of your paid period, then read-only access to your records. Every evidence pack (PDF, versioned and integrity-hashed), each customer's history report (PDF), every AML program version (PDF), your uploaded documents and your training records (CSV) can be downloaded at any time while you have access. You can resume your subscription and get full access back, but nothing new can be created while it is ended, so generate any evidence pack or report you need before your subscription ends. duely does not prepare exports or send copies of records on request. We email your firm's administrator at least 30 days before your firm's data is deleted. Your firm must keep its AML/CTF records for 7 years, so download them before then. duely is not an archive after you leave.

Engagement records, documents and evidence packs are stored in Australia. Identity verification runs in the EU, with transfers to other countries including the United States under standard contractual clauses: the provider deletes each session about one month after the check, and we delete our copy of the selfie within 7 days, except a copy included in a reliance pack your firm releases to another firm, which is kept with that pack. Screening runs in Switzerland and the EU. A one-off check holds the name, date of birth, gender and any declared citizenship only for the duration of the request; ongoing monitoring keeps the name, date of birth and gender while the person is part of an active engagement. Dee and AI document reading use an AI provider that stores data in the United States and may process it in other countries where it runs its models. It does not train on it and normally deletes it within 30 days, subject to legal and usage-policy exceptions. When duely makes Dee available, it is on for every firm unless a firm administrator turns it off; document reading is off until a firm administrator turns it on. Our privacy policy lists each service and country, and our DPA describes the providers that process customer verification, screening and AI data and where they process it.

Only AMLCO-authorised users can access suspicious matter workflows and related records. No suspicious matter indicators appear on shared dashboards, engagement lists, exports or notifications.

No. duely provides workflow, record-keeping and evidence tools. Firms remain responsible for legal and compliance judgement.